Together, they account for about two-thirds of desktop browsing and are available on Windows, macOS, and Linux, so a good portion of the market is covered, but if you prefer Firefox, Safari, or another browser, you'll need to switch.Īnd U2F only works on a handful of sites and services at present, but they do include some major ones like Google, Facebook, Salesforce, GitHub, and DropBox. U2F is currently only supported by two browsers, Google Chrome and Opera. It's much easier than juggling a smartphone and authentication codes. On a smartphone, an NFC key can simply be placed against the back of the phone to send the codes.Īnd that's all there is to it. The first 12 characters of the code are the public key of the device being used and the remaining 32 are a unique passcode for the login attempt. The disc triggers the key to transmit a 44-character code to confirm the login. MARTYN WILLIAMS/IDGNSĪ dialog box greets users signing into a Facebook account protected by a security key. Authenticating with the key is simply a matter of plugging it into a USB socket and pressing the small gold disc. Hardware security keys from Feitian (left) and Yubico.įirst, once you've bought a key, it needs to be registered with the site. When subsequently logging in, a prompt appears after a username and password have been entered. Google supports a format called FIDO Universal 2nd Factor (U2F), which it helped develop. Keys are available that work over USB, Bluetooth, and NFC, so they can be used with a smartphone or tablet in addition to a PC.

Google suggests a security key as a more secure alternative. These are little USB devices that generate one-time tokens in place of the six-digit codes from authenticator apps. A security warning message displayed by Google.

Fido u2f security key google