This Simple USB Pen Drive Helps Google Protect Its 85,000 Employee Accounts From Getting Hacked

If you've been hacked anytime recently, it was probably the result of a phishing email rather than a virus.

It's actually the easiest hack method to fall victim to, but Google has the best way to prevent it from happening. It involves physical security keys.

Images courtesy: Yubikey

Phishing scams are fairly common, partly because they're so easy to set up. All you need is a convincing looking email, tweet, or Facebook post. In fact, even the most cautious people can be taken in by a phishing message, the one time they don't notice the misspelled handle of the sender. That's the basis of phishing; you focus on the weakest link in the security chain, i.e. the end user.

However, in a chat with Krebs on Security, Google says it's had a flawless security record for more than a year thanks to it embracing two-factor authentication. In a recent policy, the company mandated that all 85,000-odd employees use physical security keys when logging into their various accounts.

What's a security key? Well, if you've used two-factor authentication, you know it involves typing in your password and then either keying in an OTP texted to you, or verifying with a registered smartphone click if you're on a desktop. While Google employees still have their password, instead of being texted another code, their second layer of security comes via plugging in a physical USB drive that only they possess. While you're password can be stolen online, (and even an OTP text intercepted) a hacker has to physically steal your USB key to log into your accounts.

ˇ°We have had no reported or confirmed account takeovers since implementing security keys at Google,ˇ± a company spokesperson said in the report. ˇ°Users might be asked to authenticate using their security key for many different apps/reasons. It all depends on the sensitivity of the app and the risk of the user at that point in time.ˇ±

The thing is, as safe as Universal 2nd Factor (U2F) is, it's pretty inconvenient for most people to remember to carry around a physical key. In addition, unless you work at a major trading company or tech giant, you're likely not thinking about getting hacked. That's why support for the system isn't very widespread.

Chrome has easily accessible U2F, while Firefox needs you to manually activate it. Microsoft Edge is still to roll out compatibility for the system this year, and Apple has made no mention of when (or even if) Safari will support it. Whether other online platforms and services look at this as a worthwhile reason to implement the standard is anyone's guess.