Google’s 85,000 employees all avoid successful phishing attempts with a $20 YubiKey security key

Getty

• Google told Business Insider that none of its employees
  had been successfully phished since it started requiring them
  to use security keys to log in.
• Phishing, or using misleading emails to steal
  passwords, is one of the most common ways people get
  hacked.
• Google attributes its success to products called
  security keys, or USB devices that you need in addition to a
  password to log in to a protected account. 

One of the most common ways that people get hacked is called
phishing or spearphishing.

Basically, attackers craft an email that looks just like
something you’d normally click on, like a bill or an email
telling you to change your password. Unsuspecting people click on
the link in the phishing email, leading them to a site designed
to look legitimate. The victim plugs in their username and
password, unwittingly giving it to the attacker. Now there’s a
good chance that account will be hacked.

Spearphishing was one of the main ways Russian spies were able to
break into the Democratic National Committee’s network before the
2016 US election,
the Justice Department says.

It’s a big problem for businesses. You can make sure your
computers are as secure as possible, but all it takes is one
employee with access to sensitive data who gets fooled by an
email to cause a bad breach.

One company, however, seems to have solved the phishing problem:
Google. And it’s all because of a
$20 gadget called a security key, which Google requires its
employees to use.

None of Google’s 85,000 employees have been successfully phished
on their work accounts since it started requiring security keys
to log in, the company said.

“We have had no reported or confirmed account takeovers since
implementing security keys at Google,” Google told Business
Insider.

Google started requiring employees to use physical security keys
in early 2017,
according to Brian Krebs, the security journalist who first
reported Google’s success against phishing attempts.

YubiKey

Your company may already require you to have two-factor
authentication turned on, meaning that when you log in with a
username and password, you have to enter a second code, usually
texted to you or delivered through an app.

Google took this one step further and required all employees to
start using security keys, according to Krebs. Instead of getting
a text after entering your password, you merely plug the security
key into a USB port on your computer and press a button.

That’s a pretty big success for such a large company. Google has
a lot of sensitive user data, so it’s very encouraging to know
its employees aren’t getting phished.

You can use a security key with your own Gmail account. YubiKey models compatible with USB,
USB-C, and mobile devices are available from Yubico.

In October, Google
launched an advanced-protection program involving security
keys for people at the highest risk of being phished, including
journalists, business leaders, and activists. Google has also
worked with various industry groups, such as the FIDO Alliance, to
develop security-key technology called U2F.

A 2016
Google study found that text-message or app-based two-factor
authentication, sometimes called “one-time password,” had an
average failure rate of 3%, while the U2F or security-key
approach had a 0% failure rate.

There are more details about how Google’s approach to
authentication and login security is starting to pay off at

Krebs on Security.

Do you have a story to share? Email the author at
[email protected].

Read More: