The idea is that a hacker who has your password won't have your smartphone and thus can't receive or generate the correct one-time passcode.Įnter the passcode into the login page, and you're in. Authenticator apps can also generate one-time passcodes for each account. This factor is often a one-time passcode (OTP) sent to your phone via text message, email, 'push' notification or voice call. When you log into a website from a new computer or mobile device, the login page will ask you to enter a second secret 'factor' along with your password. One data breach could result in many accounts being hijacked, even months or years later.Īside from never reusing passwords, the best way to protect an online account is to use 2FA. It doesn’t matter how strong your password is if hackers can use 'credential stuffing' to find other accounts where you use it. Not only do many people use weak or similar passwords for every account, but advanced algorithms and powerful computers can figure out many “strong” passwords with enough time and effort.įurthermore, if you reuse the passwords and usernames on multiple sites, you multiply the risk that those login credentials will be exposed in a data breach. Passwords are easier to figure out than you'd think. Though a USB security key may sound redundant on paper, it brings major benefits. How USB security keys fit into two-factor authentication A couple have Lightning plugs to connect to iPhones and older iPads.

Though they're most typically plugged into a computer's USB-A or USB-C port, some security keys feature wireless Bluetooth or NFC capabilities to connect to mobile devices too. Thanks to a chip inside that contains codes and protocols, each one of these physical keys can connect to online servers to verify that you are the person accessing whatever device you've plugged it into. Some are so small that they barely stick out when plugged into a laptop. Security keys look like small USB drives and can be plugged into a wide collection of devices.

Google u2f key