A process called two-step verification is absolutely necessary to protect your online accounts. But because of laziness or apathy, few people worry. Most likely, they think that “no one will ever hack my account.” But this is a risk that should never be taken.
If you want a secure and easy way to use 2-Step Verification, consider purchasing a YubiKey.
What is 2-step authentication?
Usually when you log into an online account, you need a password. Get the correct password and you’re signed in. But with 2-Step Verification, you need a second code to sign in successfully, which is entered after you successfully enter the first password.
Think of it as unlocking and walking through the front door of a house only to find the second door you need to open. It’s just extra security.
One of the most secure two-step verification methods is Google Authenticator, which puts codes on your phone. The open source alternative is Authy. Other websites send codes to your phone in a text message, which is very dangerous if your phone is cloned. The same is true for codes sent by email, which should be avoided at all costs.
Therefore, the YubiKey, which looks like a USB stick, is the best option. As long as you keep the key in a safe place, no one can pick it up remotely, unlike a text message from your phone.
– / –
Some facts about YubiKey
If you think this is a niche product that very few people use, think again. Yubikeys have been endorsed and used by some active gamers including Google, Facebook, Dropbox and the UK government, just to name a few.
The 3G YubiKey also touts itself as “nearly indestructible.” To quote a company:
“The standard size YubiKey is made of injection-molded plastic that covers the circuitry, and the exposed parts are military-grade hardened gold. Waterproof and shockproof, the standard-sized YubiKey attaches to your keychain along with your home and car keys. ”
Plus they are cheap. You can get it on Amazon for $ 27. Google is also known for giving them away for free at conferences.
How it works?
As I said, it looks like a USB stick. You must register the key with online accounts that support this technology using the account’s 2-Step Verification settings.
Then, when you log in, insert the dongle into the USB port. The gold button with the key logo will light up blue. Touch that golden button with your finger and that touch will trigger an electrical charge that enters a one-time code that enters you into your account.
How do you set it up?
Here’s how to set it up for your Gmail account. This will show how convenient this concept is in general.
First, go to your Google account page, under security and 2-Step Verification.
Once logged in, to verify your identity, scroll down to the various authentication methods available. One of them is “Electronic Key”. Click “Add dongle”.
Then it will ask you to insert the key into the USB port and press the golden button.
As soon as you press the golden button, it will inform you that the key has been registered for your account and will prompt you to name it. There is no need to complicate this part.
After you click “Finish”, the security key will be displayed as an authentication method.
That’s all. The setup is complete. I told you it was easy.
Its advantages
If you are not already using the YubiKey, let’s look at three benefits of using it.
It’s very easy to use
It is completely impossible to screw up your YubiKey usage. Once you’ve set it up for each online account, just insert the dongle into the USB port and press the illuminated button once. This is it. You have to be a complete idiot to screw it up!
Additional account security without the hassle
Two-Step Verification is great, but it can be annoying. When I talk to someone who doesn’t have one, my usual excuse is, “It’s too troublesome.”
While the benefits of 2-Step Verification far outweigh the lack of it, I still get it. Two-Step Verification involves signing in, then getting a code and entering it. Doing it once is not a problem, but when you do it regularly it becomes tiresome.
YubiKey removes this annoyance and forces you to use additional protection. One touch and you are in business.
Unable to get a virus
One of the things I’ve noticed the most while reading about YubiKeys is people saying “will they get infected through a public internet terminal?” No thanks! “.
Although you should not use public Internet connections for security reasons, YubiKeys cannot get viruses as it cannot move any files to it. This is how it differs from a conventional USB device. In addition, all information about the key is write protected.
Its shortcomings
Are there any disadvantages to using the YubiKey? Well, yes, there is. Whether or not they violate the terms of the deal will depend on your individual situation.
This does not work on smartphones and tablets
For a person who uses mobile devices and tablets a lot, this is a huge disadvantage. My iDevices are great, but I have one weakness – no USB port. So where is YubiKey?
The short answer is it won’t go anywhere since YubiKey doesn’t work with smartphones and tablets. When you log into your account, it detects that you are not on a regular computer and reverts to your fallback authentication option. This is why you should always have at least one additional authentication process on your account.
YubiKey also doesn’t work with on-premises email clients like Outlook and Apple Mail.
Only works in Chrome
Don’t ask me to explain it, I don’t understand it. But at the time of this writing, YubiKey only works in Google Chrome. So out of luck users of other browsers.
If someone gets your account key and password, it’s game over
The point is, regular 2-Step Verification is that any attacker would need physical access to your phone in order to receive an SMS or Google Authenticator code. Prevent phone cloning, having a passcode on your phone stops an unauthorized third party from accessing your two-step authentication codes.
But if someone gets hold of your YubiKey and also knows your account password, then that’s it. They won’t have a smartphone password to bypass to access your SMS codes or the Google Authenticator app.
The best solution is to use a very long account password that is difficult to guess (and store it in a password manager). And keep your YubiKey in a very safe place like a keychain in your pocket.
–