There's an increasing recognition that passwords alone are not going be an adequate form of online security in the future. Two-factor authentication can vastly improve security, by simply introducing a second means of verification alongside a password. Google's new USB Security Key does just that.
There are various possible alternatives to using passwords or passwords alone for security. Google already offers a number of different two-step methods. Users can be sent codes via text message or phone call to input in addition to their password, they can generate a code via a mobile app, use back-up one-time-use codes or register a regularly-used computer or device as a second means of verification.
Google says that the Security Key pairs with its Chrome browser to offer even stronger security than its existing methods. It is also more convenient. Users simply insert the key into a USB port on their computer and press a button on it when prompted.
In addition to providing a second means of authentication, the key also verifies that the site requesting the password is actually a Google site and not a fake. As it is a USB key, the device is highly portable and avoids the need to rely on receiving codes or even having mobile connectivity available.
The Security Key uses the FIDO Alliance's open Universal 2nd Factor (U2F) protocol, which utilizes a standard public key cryptography approach. FIDO U2F will work with other websites as well as Google's and the company says that, in the interests of standardization, it hopes other browsers will add FIDO U2F support.
Source: Google
This is going to prove conclusively that I am who I say I am. That way, only *I* have access to my PayPal account, say. It means nobody can spend my money but me. Cool.
The website I'm working with, on the other hand, doesn't need to prove anything to me at all. The site could share my information with anyone it wishes, lie to me about it, and be legally in the clear. Is this right?
I don't see what FIDO is the cure for...except maybe, public distrust of Google.
You always (Always) need a password or possibly bio-id not just a USB or other token,
Just a little niggling concern; seeing that computers can be hacked to the point where key strokes can be logged, what is to stop them being hacked to log what the USB stick's unlock instruction code is?
It is nice to know that Google are working on the problem, but I don't think this is the solution.