Facebook is enhancing its existing protection against account takeovers with cryptographically based security keys that can be used as a second factor of authentication, the social network is announcing today.
A handful of online services—including Google, Dropbox, GitHub, and Salesforce—already support security keys based on the open Universal 2nd Factor, or U2F, standard, created by the Fido Alliance. Now Facebook is offering them, too. The inexpensive devices, which plug into users’ USB port, were recently shown to beat out smartphones and most other forms of two-factor verification in a two-year study of more than 50,000 Google employees. That assessment was based on the ease of using and deploying keys, the security they provided against phishing and other types of account-takeover attacks, and the lack of privacy trade-offs that accompany some other forms of two-factor authentication.
Just as attackers can use phishing techniques to trick people into divulging their passwords, attackers can also trick people into divulging the one-time passwords that form the basis of most two-factor authentication schemes. Security keys, by contrast, rely on a cryptographic secret baked into their silicon. This data can’t be easily divulged. Security keys also can’t suffer from dead zones that often prevent cellphones from receiving text messages. The keys are also not susceptible to the types of malware compromises that can hit smartphones.
The keys, which sell from about $10 to $18, also provide a reasonable degree of convenience. A single key can work for any service that supports the U2F standard and on any computer with a USB port. Right now, the biggest disadvantage is that they work only with the Chrome and Opera browsers. And for now, Facebook’s implementation doesn’t support the mobile Facebook app. For those reasons, Facebook will require security key users to register a separate two-factor authentication method. Mobile users with a near field communication-enabled Android device can also use a special key to receive two-factor protections.