How to Protect your account passwords with a Hardware Security Key.

yubikey-hongkong-china

When It comes to protecting your password, SMS based or app-based two factor authentication (2FA) using your smartphone is more secure than depending on just passwords. But sometimes it can be time-consuming to set it up and run. Hardware security keys provide a fast and convenient way to use two factor authentications (2FA) without messing around with your phone. They are based on the FIDO U2F standard, a security protocol that is very difficult to intercept.

Learning how to protect your account passwords is not difficult and the purpose of this guide is to help you to know how to protect your passwords with a Hardware security key by giving you some information about the Hardware Security Key and also some guides to setup two-factor authentication (2FA) for your social media accounts.

What is a Security Key?

Security keys, also known as hardware security keys, are a method of authentication that offers an additional layer of protection. They can be used to login to desktops and be integrated into the sign-in process of many popular websites and apps.

Security keys connect to your device via USB-A, USB-C, Lightning, NFC, and Bluetooth, and they are small enough to be carried on a keychain. Most of them use an open authentication standard, called FIDO U2F (or the improved FIDO2 standard), and some even feature hardware that is designed to resist physical attacks aimed at extracting firmware and material from the key itself.

Hardware security keys are made by various manufacturers and work with the most popular web browsers, as well as hundreds of apps and online services. They can even help you log in to your workstation. Overall, they are not hard to use and are relatively inexpensive. And all other forms of two-factor authentication (SMS texts, authenticator apps, and notifications) do not offer the same security protection standards.

Why Hardware Security key?

Using the same password on multiple sites or picking simple, easily hacked passwords are two of the biggest security risk factors. As cyber thieves get better at spear phishing and social engineering, it is a good time to think about changing your digital security strategy.

Password managers and security keys are both good replacements for passwords. Software-based solutions will work on most laptops, desktops, and mobile phones. These services generate and store secure passwords and manage login credentials and syncing your data across all your devices.

If you are ready to level up your personal security even more, consider a security key. This hardware solution puts an end to phishing attacks and is much more secure than SMS-based two-factor authentication.

 

 

Why protect?

Protecting your devices and your accounts is essential for maintaining the security of your privately identifiable data and thus your financial identity. Phishing scams that lure you into offering your private data such as personal details, bank account information or credit card information can be used to access your accounts or create false ones in your name.

The more information you make public online, the more vulnerable you are to such scams, which are often crafted to look almost the same format from your bank or any other organizations. Avoid clicking on links in emails, especially unsolicited emails. And if anyone asks you for your private data online, contact that organization directly by phone to follow up.

How effective is it?

Microsoft says that users who enable multi-factor authentication (MFA) for their accounts will end up blocking 99.9% of automated attacks.

The recommendation was not only for Microsoft accounts but also for any other profile, on any other website or online service.

If an application or a website supports multi-factor authentication, Microsoft recommends using it, regardless if it is something as simple as SMS-based one-time passwords, or advanced solutions like using fingerprint recognition.

Microsoft’s boast that using MFA blocks 99.9% of automated account takeover (ATO) attacks is not the first of its kind.

Back in May, Google said that users who added a recovery phone number to their accounts and enabled SMS-based MFA were also improving their account security.

“A research shows that simply adding a recovery phone number to your Google Account can block up to 100% of automated bots, 99% of bulk phishing attacks, and 66% of targeted attacks that occurred during our investigation,” Google said at the time.

When both Google and Microsoft are recommending the same thing, it is probably a good time to start following their advice.

What other advantages are there?

Multi Factor Authentication.

Improve Security

The primary benefit of multi factor authentication is that it provides additional security by adding protection in layers. The more layers/factors in place, the lesser chance that an intruder will be able to gain access to systems that are essential, and data is will not be harm and stolen.

Achieve Compliance

A second benefit of multi factor authentication is being able to achieve the necessary security requirements standards specific to my organization which in turn mitigate any potential fines due to unprotected private data.

No need to memorize passwords

And finally, being able to remove the burden of passwords by replacing them with alternatives has the potential to increase productivity and bring a better experience due to the increased flexibility of not having to type password every time. In the right environment and situation, there could even be an opportunity for a potential reduction in operational costs in terms of support call for passwords recovery.

What accounts can be protected?

Many online accounts, apps, services, and websites support hardware security keys, including Twitter, Facebook, Google, Instagram, GitHub, Dropbox, Electronic Arts, Epic Games, Microsoft account services, Nintendo, Okta, and Reddit. Most web browsers do too, like Google Chrome.

Be sure to do your research – look into whether your most-used online accounts and even whether your devices support security keys before you invest in one. You can use hardware security keys to log into many computers and mobile devices, including Macs, Chromebooks, Windows 10 PCs, and Android and iOS devices. The FIDO2 standard on some security keys can work with Windows Hello and Microsoft’s Edge browser, too.

 

How to Protect your account passwords with a Hardware Security Key:

All hardware security keys tend to work the same, as we have detailed above, but setting them up varies by app and device. To give you an idea of how to protect your account passwords with Hardware Security Key, we have detailed the exact steps for pairing a security key with Facebook and Google

Using a hardware security key with Facebook

Protect your account passwords

  1. Log into your Facebook account.
  2. Click on the drop-down menu icon in the corner and select Settings.
  3. Now you are at General Account Settings.
  4. Select the Security and Login” link from the left sidebar.
  5. Scroll down until you see the section called Two-Factor Authentication.
  6. Click Edit on the Use two-factor authentication option.
  7. Click on Get Started to set up a text message or an authentication app.
  8. Go back to Two-Factor Authentication and scroll down to Add a Backup.
  9. Select Setup for the Security Key option.
  10. Enter your Facebook password and click Submit.
  11. Connect your security key (usually by inserting it in the USB port).
  12. Tap the key’s button.
  13. You should get a confirmation pop-up.

 

PAIRING A KEY TO YOUR GOOGLE ACCOUNT

Protect your account passwords

In order to use a security key with your Google account (or any account), you need to already have two-factor authentication set up.

  1. Log in to your Google account, and click on your profile icon on the upper right-hand corner. Select “Google Account.”
  2. On the left-hand menu, click on “Security.” Scroll down until you see “Signing into Google.” Click on the “two-step verification” link. At this point, you may need to sign into your account again.
  3. Scroll down until you see “Set up alternative second step.” Look for the “Security Key” option and click on “Add Security Key.”
  4. You will get a box telling you to make sure the key is nearby but not plugged in. Click “Next.”
  5. Insert your key into your computer port. Tap the button on the key, then click “Allow” once you see the Chrome pop-up asking to read the brand and model of your key.
  6. Give your key a name.
  7. Now you have completed! You can come back to your Google account’s two factor authentication page to rename, add, or remove additional keys.

Conclusion

If you are really looking into adding an extra layers of security protection to your electronic devices, Hardware Security Key is definitely a must have item. Most website or applications that have enabled two-factor authentication (2FA) have guides to show you how to set up the Security key to their applications or websites. It is not very difficult to setup and having a FIDO-powered security keys will allow you to go password-less and you no longer have to memorize your passwords.

Hackers are getting better at stealing accounts by phishing and social engineering. All it takes is just a click away for them. All your private data will be stolen and will be forever be with them.

They have not been able to breach any accounts that is appropriately protected by a good and robust security key. Imagine all the trouble and stress you have to go through to recover your account if a hacker gets control of it. Would the cost of a Security justify the amount of inconvenience?

Let us improve our current security standards by switching over to a Hardware Security Key.

 

To find out more additional information about YubiKey, please go to our Website at https://dtasiagroup.com.hk/yubikeys/ or if you have any enquire about Yubikey, please contact us and visit our DT Asia HK Facebook at https://www.facebook.com/dtahongkong/ to find out more.

 

 



Related Articles

7 Benefit of Using Password Manager

A password vault stores your passwords securely, allowing you to save the information in the cloud or on your personal computer. This allows you to use truly random combinations in all your passwords, making them much harder for malicious users or bots to crack. Password managers also protect you from giving away private information by mistakes. In fact, there are multiple reasons why you should be using a password manager right now.

Tips to Stay Safe in the Digital World

The best way to stay safe in the digital world, is to get a hardware security key and enable multi-factor authentication for any logins that support using 2FA. A very useful feature of using hardware security key is that if you fall victim of a data breach and your sensitive data is stolen, malicious hackers will not be able to get into your private account without your physical Yubikey. That is why there are zero Google credentials ever been stolen before after using YubiKey.

5 Most Popular Uses of YubiKey

The YubiKey—like other, similar devices—is a small metal and plastic key about the size of a USB stick. They plug into your computer, and some also connect to your phone. You can use them in either place, along with your password, to authenticate web logins. Think of it as a physical key that, instead of unlocking a door, unlocks your online life

What is FIDO U2F?

U2F is an open authentication standard that enables keychain devices, mobile phones and other devices to securely access any number of web-based services — instantly and with no drivers or software needed. U2F was created by Google and Yubico, with contribution from NXP, and is today hosted by the open-authentication industry alliance FIDO. Having a FIDO U2F Security Key will ensure that your account will be fool proof and safe from hackers.

Best YubiKey for you

Choosing the best YubiKey for yourself could be difficult sometimes since there are technically many YubiKey to choose from. It comes in a different various size and each individual Key have their own usefulness. Having a YubiKey not only protect you from hackers, it also gives you an unprecedented security when leaving your laptop turn on while you are away.

Contact DT Asia Group Hong Kong

Address: Unit 929, Kowloon Bay Industrial Centre,
15 Wang Hoi Road, Kowloon Bay, Hong Kong
Tel: +852 58010001
Emailsales@hk.dtasiagroup.com

Like Our Facebook Page :)