Two-factor authentication based on a USB key is the most robust and fastest security solution for accessing these various web services. But this additional protection requires you to carry a USB key permanently with you. To overcome this drawback, Google now offers the possibility of using its Android phone as a security key..
What are the security keys for?
Phishing attacks have become commonplace. Not a week goes by without a phishing (phishing) affair making headlines in computer magazines. And unfortunately it no longer concerns only large companies.
Hardware type USB security keys are the best defense against this type of attack. This method of identity verification is particularly effective in protecting Internet users against identity theft and theft of personal data..
These types of keys are simple to configure and their use does not require any particular knowledge of computer security. Once the password for your Google account has been entered, you just need to put the key in a USB port on the computer. The chip contained in the device will then be responsible for confirming the identity of the user to Google and for checking whether the site to which you are trying to connect is legitimate.
This device is much more effective than the traditional SMS. Even if a hacker manages to steal your credentials, he will not be able to access your accounts. Everything is encrypted in the key and no two are the same..
Authenticate using your smartphone
It is a fact, this authentication key greatly improves the security of access to various Google web services. However, this device has several drawbacks. First it has a cost. It takes several tens of euros for a USB key that supports the U2F protocol (compatible with Facebook, Dropbox and of course Google services).
In addition, it is essential to have this key always with you. And this is indeed its biggest problem. Indeed today there are few people ready to move permanently with a USB key only to connect to their Google account or their email.
The American giant hopes to solve this problem by transforming our Android smartphones into a USB security key. The advantage of this device is that you always have it with you. We walk it everywhere, at work, on vacation. This could also give a boost to the adoption of the two-factor system.
The principle remains the same as the encrypted security key except for one detail. Authentication is no longer done via the computer's USB port but using a Bluetooth wireless connection. Google initially thought of forcing users to connect their phone using a USB cable. But for practical reasons this choice was not retained.
Note that authentication is done via a local connection between your machine and your phone. No data passes through the internet. Another strong point of this technology, the process works even if the two devices are not paired.
Follow these steps to turn an Android smartphone into a security key
The authentication key appears to be on the verge of solving the problems of password theft and identity theft. Unlike other solutions, it is inexpensive, easy to set up and allows you to access these Google services (Gmail, Google Cloud, G Suite) from any computer.
Google still specifies that all devices (tablet and computer) will not be compatible with the security key option. Your machine should not only have a Bluetooth module and run on the latest version of Windows 10, Chrome OS or macOS.
- Connect to your Google account from your Android smartphone
- Activate your Bluetooth connection
- Launch the Chrome browser on your computer
- Make sure it's the latest version of Google’s browser
- Open the following page https://myaccount.google.com/
- Make sure you’re signed in to the same Google Account you’ve opened on your phone
- Select the Two-step verification option
- Press the blue button to validate this option
- Click the Add Security Key button
- Choose your phone from the list of available devices
The next time you are asked to connect to a Google service, you will be asked to approach your phone to your computer and activate your Bluetooth connection. A new window will open on your smartphone screen telling you that someone is trying to sign in to your Google Account. You just need to press the it's me button to finalize the authentication procedure.
Google recommends that these customers keep a backup USB security key in a safe place. So if you lose your phone or the battery is empty, you will still be able to access your email and online accounts.