Google recently shared that since it made employees use physical security keys instead of passwords and one-time codes, none of them – and there are over 85,000 – have been successfully phished.
On Wednesday, the company announced that they have created their own line of security keys called Titan Security Key and that they’ve been testing it in-house for over a year.
The Titan Security Key
Security keys are physical keys that are used to provide user authentication over Bluetooth and USB. They won’t work on phishing sites made to look like the real deal.
Titan Security Key adheres to the FIDO (Fast IDentity Online) specification and includes firmware developed by Google to verify its integrity.
“We’ve long advocated the use of security keys as the strongest, most phishing-resistant authentication factor for high-value users, especially cloud admins, to protect against the potentially damaging consequences of credential theft,” noted Jennifer Lin, Product Management Director, Google Cloud.
Titan Security Keys are currently available for Google Cloud customers and will soon be available for anyone to purchase on the Google Store.
Users will be able to use the key to authenticate to non-Google services, too, although the integrity verification firmware might not work on them.
Increased security
Because passwords and second factor authentication codes (codes sent via SMS or received via apps like Google Authenticator) can be intercepted or phished, Google has been promoting the use of physical security keys for a more secure authentication process for a while now.
In October last year, Google launched the Advanced Protection setting for Google accounts. Aimed at high-risk users such as journalists, activists and politicians, the setting includes the use of a security key.
They also advised users to create two of them, so they’ll have a backup key in case they lose they main one.