SoylentNews is people
SoylentNews
from the upcoming-optimization:-put-the-physical-keys-in-the-cloud dept.
Google: Security Keys Neutralized Employee Phishing
Google has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical Security Keys in place of passwords and one-time codes, the company told KrebsOnSecurity.
Security Keys are inexpensive USB-based devices that offer an alternative approach to two-factor authentication (2FA), which requires the user to log in to a Web site using something they know (the password) and something they have (e.g., a mobile device).
A Google spokesperson said Security Keys now form the basis of all account access at Google.
"We have had no reported or confirmed account takeovers since implementing security keys at Google," the spokesperson said. "Users might be asked to authenticate using their security key for many different apps/reasons. It all depends on the sensitivity of the app and the risk of the user at that point in time."
(Score: 2) by darkfeline on Wednesday July 25 2018, @04:02AM
The physical token is necessary but not sufficient. Other measures in place prevent authentication long enough for the lost/stolen token to get revoked.
You don't have to outrun the bear, you just have to outrun your friend.
Join the SDF Public Access UNIX System today!