The U2F key is a tool used for network authentication. So, in a nutshell, the U2F key can be called the ‘key to the Internet’.
What does U2F stand for?
U2F is an acronym for the English phrase Universal Second Factor. The name is associated with two-factor authentication, or network authentication, which uses a second component in addition to the traditional static password to increase login security.
U2F Keys and Two-Factor Authentication
Two-factor authentication or two-step verification (2FA) was created to better secure user accounts on the Internet. With 2FA, it is more difficult for cybercriminals to get into users’ private data, as they have to get through not one (password) but two firewalls (second component). There are a number of methods for two-factor authentication, although U2F key-based authentication is pointed out by authentication specialists. Cybersecurity as the most secure mechanism.
Confirmed security of U2F keys
U2F keys are described as the strongest authentication method, described by some as completely phishing-proof. The U2F keys gained their reputation among cybersecurity officials after Google Corporation rolled them out en masse to all its employees (more than 85,000 people), thereby eliminating the risks of phishing and credential theft. The keys at Google have been in use since 2017, and since then the company has not recorded a single instance of an employee’s account being taken over.
How do U2F keys work?
In addition to security, a huge advantage of U2F keys over other methods of strong authentication is their incredible ease of use. U2F keys allow users to quickly and securely access any website or online service. To authenticate, the user simply inserts the U2F key into the USB port and then presses a button on the key to confirm their identity. For smartphones or tablets, the key should be placed near the NFC antenna.
What are the advantages of U2F keys?
Strong Authentication
Strong two-factor authentication using public key cryptography that protects users from phishing, session hijacking, man-in-the-middle attacks, and malicious software.
Ease of use
The key works as soon as you register with the service, thanks to native support for operating systems and browsers, enabling instant authentication to any number of services. The key does not require memorizing, entering, or rewriting codes or installing any drivers or additional applications.
High level of privacy
The U2F key allows users to create and fully control their online identities. A user can have multiple identities on different services without any personal information associated with the identity. The U2F key generates a new key pair (private and public key) for each service, where the service stores the public key and the private key never leaves the U2F key. With this approach, the risk of stealing the authentication secret (as happens with static passwords) is eliminated.
A multitude of possibilities
Open standards provide U2F keys with flexibility and the possibility of various applications. Currently, U2F keys are mainly used to confirm identity online, but in the future, they may also be used as access keys to authenticate the opening of physical doors, as an attendance confirmation tool, a voting tool, etc.
U2F key history
The U2F keys were originally developed through the joint efforts of Google and Yubico, with input from NXP Semiconductors. The standard is now open and being expanded by the FIDO Alliance, an open association whose mission is to reduce the role of passwords and replace them with stronger authentication methods.
Is the U2F key the same as the FIDO key?
There are many other words and phrases associated with U2F keys that are often confused with each other. The following glossary is designed to help you understand key terms.
What is FIDO?
FIDO is an open standard for network authentication developed by the FIDO Alliance. FIDO authentication makes it possible to replace logins using only static passwords with secure logins using public key cryptography. The name FIDO comes from the acronym for Fast IDentity Online.
What is the Fido Alliance?
The FIDO (“Fast IDentity Online”) Alliance is an open industry association founded in February 2013, whose mission is to develop and promote authentication standards that “help reduce the over-reliance on passwords worldwide.” A group of companies, including the company Lenovo and PayPal, founded FIDO. At the end of 2016, the number of FIDO members exceeded 260 and continues to grow. Currently, the organization’s board of directors includes representatives of companies such as Alibaba Group, Amazon, American Express, Apple, Google, Intel, MasterCard, Microsoft, and Visa.
What is FIDO2?
In the simplest terms, FIDO2 is an introductory step to passwordless, or online authentication without static passwords.
Going into more detail, FIDO2 is the latest set of specifications developed by the FIDO Alliance. FIDO2 enables users to leverage the devices they use every day (such as smartphones and laptops) to easily authenticate to online services in both mobile and desktop environments. The FIDO2 specifications are the World Wide Web Consortium’s (W3C) Web Authentication (WebAuthn) specification and the FIDO Alliance’s corresponding Client-to-Authenticator Protocol (CTAP).
How does U2F relate to FIDO2?
U2F is the ancestor or prototype of authentication devices that support the FIDO standard. U2F keys make it possible to create and confirm identities on the network using public key cryptography. With the FIDO2 set of specifications, devices such as smartphones with fingerprint readers and laptops with infrared cameras can also serve as authentication devices and, like the U2F key, can create and confirm identities on the network using public key cryptography.
Where can I use the U2F keys?
The U2F keys can be used by any of us today. Many of the services we use every day already allow us to secure our data using U2F keys. The most popular social media, or the largest service providers on the Internet already enable U2F as a second login component.
How to introduce U2F in an organization?
Large organizations already secure their most critical applications or key employee accounts using U2F keys. The aforementioned Google corporation uses keys to secure all employees on all applications.
Implementing U2F keys in a business can be a complicated process or even impossible in traditional approaches to security tool implementations. However, there are ways to adopt strong authentication methods that completely eliminate programming work and allow the introduction of U2F keys without the need for application customization. The approach was developed by Secfense and is based on the implementation of security broker mechanisms, which shifts the burden of implementation from difficult programming work to simple network configuration.
To learn how U2F keys and other strong authentication methods can be implemented globally across an organization, we encourage you to visit the User Access Security Broker technology page and contact us.
