Digital Life

Google security keys may offer extra layer of online protection

Strong passwords alone are not enough to guarantee online safety, but now you can add an extra layer of protection to keep hackers at bay.

With online security breaches regularly making the headlines, Google is looking beyond passwords to help keep us safe online.

Security has generally revolved around the idea of logins and passwords, but the trouble is that people are often lazy. We tend to choose passwords that are easy to remember, but these will be easy for hackers to guess or find online, such as the names of our children or pets. Or we might choose a simple password that's easy to crack with a brute force attack, such as the ever-popular "letmein" or "password1". Then we compound our folly by using the same weak password on multiple online services.

The best defence: The most effective passwords are long, complicated, unique, and look like gibberish to anyone else.
The best defence: The most effective passwords are long, complicated, unique, and look like gibberish to anyone else. Photo: Louie Douvis

The best passwords are long, complicated, unique, and look like gibberish to anyone else. For example, you might take the first letter from each word in a phrase or lyric and throw in some capitalisation, numbers and symbols to spice things up. The opening lines to Advance Australia Fair might become AaLuR*FwAyAf+1788 – which is long and complicated but easy enough to remember if you sing along in your head.

Unfortunately, strong passwords alone aren't enough to guarantee online safety, and several recent high-profile security breaches have seen hackers get their hands on long lists of logins and passwords. Thankfully you can add an extra layer of security, known as "two-factor authentication", to keep hackers out of your online accounts, even if they do manage to discover your password.

Two-factor authentication relies on something you have and something you know, says David Hall, a security expert with mobile security specialist TeleSign.

"Bank ATMs already rely on a form of two-factor authentication – the something you have is your bank card and the something you know is your PIN – so you can't get money out with just one piece of the puzzle," Hall says.


"When you apply this to the internet the something you know is your login and password. The something you have can be your phone, and you prove you have it by entering a one-off code sent by SMS or generated by an app. Google already supports this, but now it's adding the option to use a special USB stick – called a security key – as the something you have."

The security key is designed to work with Google's Chrome web browser running on Windows, Mac or Linux. You insert the USB stick when logging into your Google account, rather than entering a one-time code. This can come in handy if you're out of range of a mobile network or travelling overseas and can't receive text messages.

Along with supplying an alternative form of two-factor authentication, the security key also works with the browser to ensure you're visiting a legitimate Google website. This extra security check thwarts sophisticated attacks that use lookalike websites in an attempt to steal both your Google password and your one-time code.

A security key is registered to your Google account, not a specific computer, so you can use it on any computer that runs the Google Chrome browser and has a USB port. One-off codes can still be used with smartphones and tablets that don't have a USB port. Should you lose the security key, it's of no use to anyone else unless they know both your Google login and password.

Google will provide the extra layer of security free of charge but it requires buying a FIDO (Fast IDentity Online) Universal 2nd Factor (U2F) compatible USB stick from the likes of Yubico. FIDO U2F is built on an open standard so it can be implemented by other websites, plus some Yubico USB sticks support other security standards.

If you're keen to lock down your online accounts, you'll find Apple, Microsoft, Yahoo, Facebook, Twitter, Dropbox and PayPal also offer two-factor authentication to help keep hackers at bay. They'll send you one-time codes, plus some are compatible with two-factor smartphone apps and USB sticks.

"It's not just the big web players who are keen to add two-factor authentication," Hall says "At TeleSign we're helping businesses of all sizes upgrade to offer two-factor protection. There was a time when a strong password was enough to keep you safe, but as hackers become more sophisticated we all need to step up our defences to stay safe online."