Along with the newest privacy tools, Facebook also made a very useful update: support for physical security keys.
This means you can now use any USB key that supports the global 2factor authentication (U2F) standard to log in to your Facebook account, confirming your identity simply by tapping the key.
What does this mean?
You can now use a physical key to log in to your Facebook account like you would use a key to start a car. You'll still need to use the key in conjunction with password (so that if someone steals it, they won't be able to log in). You can even use a key to log in to Facebook through Chrome for Android, provided that both your phone and key have NFC wireless technology.
“Using your phone for two-factor authentication is convenient and much more secure than a password alone,” Facebook said on its Facebook Security page. “But Security Keys offer some benefits, and we wanted to give people that option.”
What is a security key?
A security key is a USB stick that acts as the second “factor” in two-factor authentication. Once you’re signed in to a service that supports the key, all you need to do is insert the key into a port and tap it to complete your login – no SMS or Google Authenticator code required. The keys typically support a variety of security features and standards, including one-time passwords, public key encryption and authentication, and 2 Factor Authentication (U2F).
In case you're not familiar: two-factor authentication is a method that verifies a user's identity using two different components. Two different pieces of information are used. Something you know, like a password, and something you have, like a physical key. A simple example is ATMs. To withdraw money, you need something you have, your bank card, and something you know, a PIN number. This protects you in cases where either your PIN or your card is stolen.
Why do I need one?
While 2-factor authentication via SMS is gaining popularity, many experts prefer security keys specifically for desktop and laptop computers, which most people use in their workplace.
Compared to other forms of identity, security keys are faster, can be used across a range of different services like Facebook, Google and Dropbox, and are virtually immune to phishing and man-in-the-middle attacks. The keys currently only work for the latest versions of Chrome and Opera, which support U2F.
Another benefit of physical security is that it lays the foundation for eliminating passwords. In addition to the security key, companies like Google have previously experimented with other forms of physical security, including the use of a ring.
In a statement to the Wall Street Journal last year, President Obama encouraged Americans to “go beyond passwords” and add an extra layer of security to their accounts. Particularly in recent years, the theft of passwords from major organizations such as Target, Time Warner and several banks has put hundreds of millions of accounts at risk. While multiple authentication criteria have been in place for many years to protect against password theft, in the form of security questions, PINs and more, the methods vary greatly in quality and some of them can be compromised by social engineering.
The most readily available security key is the Yubikey from Yubico. Its simplest key costs $18.
