Google ramps up security to make its accounts IMPENETRABLE: Tech giant introduces security key to keep out hackers

• Security Key only grants access to accounts when plugged into a USB port
• Users must then enter their password, and the combination of the two creates a secure connection
• It is designed to stop hackers accessing accounts, and the Chrome browser
• The key is sold by Yubico and doesn’t need software or drivers to use
• It is currently only available in the US and costs $17.99 (£11)
• In addition, the key works with any site that uses similar security protocols

By Victoria Woollaston for MailOnline

Published: 12:04 EST, 22 October 2014 | Updated: 13:56 EST, 22 October 2014

Many firms are bolstering their attempts to keep accounts secure using two-step verification, which typically sends an access code to a phone in addition to asking for a password.

But Google is planning to expand this in an attempt to make its accounts, products and even hardware impenetrable from hackers.

When using its Security Key, users can only access their Google account, sign into Chrome or access their Chromebook, by plugging the device into the computer’s USB port and entering their password.

Security Key (pictured) is sold by California-based Yubico. It only lets users access Google accounts by plugging the device into a USB port, after which they must also enter their password. The combination of the two creates a secure connection

The key can only be used with a connected Google account, which is linked during the set-up process.

And it will only grant access when the correct private key, or password, matches the account it's connected to.

The Security Key is sold by Yubico and doesn’t need software or drivers to use, ultimately removing an extra point that the hackers could attempt to infiltrate.

For example, earlier this year, the firmware on typical USB drives was exposed as being vulnerable to attack - a flaw dubbed BadUSB.

The key is designed to stop hackers accessing Google accounts and the Chrome browser and is currently only available in the US for $17.99 (£11)

Berlin-based researchers reverse-engineered the software files that control how the USB drive's software works - and revealed how this so-called firmware can be reprogrammed to take complete control of a PC.

In addition to protecting Google accounts, Yubico’s key works with any website that supports the Universal 2nd Factor specification. 

U2F is an authentication standard created by the Fast IDentity Online (FIDO) Alliance, the security industry consortium. 

In a blog post, Nishit Shah, product manager at Google Security said: ‘If you use 2-Step Verification, you can choose Security Key as your primary method, instead of having verification codes sent to your phone.

‘With Security Key, there’s no looking at codes and re-typing - you simply insert your Security Key into your computer’s USB port when asked.’ 

With 2-Step Verification, Google requires something a user knows, such as their password, and something they have, including their phone or the Yubico Security Key. 

Mr Shah continued: ‘Sophisticated attackers could set up lookalike sites that ask you to provide your verification codes to them, instead of Google.

‘Security Key offers better protection against this kind of attack, because it uses cryptography instead of verification codes and automatically works only with the website it's supposed to work with. 

‘No mobile connection or batteries needed. 

‘Security Key works without a data connection, and you can carry it wherever you go on a keychain or in your wallet.’ 

Apple recently ramped up security on its own iCloud service by including backups in its two-step verification process. When the security feature is enabled, users are sent a four-digit code to a trusted device that must be entered in addition to the iCloud account password when accessing the account online

Apple recently ramped up security on its own iCloud service by including backups in its two-step verification process. 

When the security feature is enabled, users are sent a four-digit code to a trusted device that must be entered in addition to the iCloud account password when accessing the account online. 

Last month,, chief executive Tim Cook promised to strengthen security after hackers stole hundreds of celebrity selfies from the cloud service.

The code isn't needed when a backup takes place, because the information is coming directly from a trusted device - it is only needed when users try to access their iCloud account from a web browser. 

Under the security measure, the majority of iCloud features remain locked until the user's identity has been verified. 

The only feature that is enabled without verification is the Find My Phone tool, which helps locate devices if they are lost or stolen. 

It is assumed that if a user doesn't have their trusted device, they can't receive the four-digit verification code. 

Two-step verification is an optional security feature, and settings are managed through the My Apple ID page.

Comments (22)

Share what you think

• Newest
• Oldest
• Best rated
• Worst rated

 View all

The comments below have not been moderated.

The views expressed in the contents above are those of our users and do not necessarily reflect the views of MailOnline.

Add your comment

Enter your comment

By posting your comment you agree to our house rules.

Submit Comment Clear

Who is this week's top commenter? Find out now