Google made the Titan Key to toughen up your online security
Google made the Titan Key to toughen up your online security
Major key alert: It's another line of defense against hackers and thieves.
BY ALFRED NG JULY 25, 2018 10:42 AM PDT
Google is releasing its own security key, called the Titan Security Key. It'll be available by the end of the summer in Google's online store. Sarah Tew/CNET
When Google boasted that none of its 85,000-plus employees had their accounts hacked since early 2017, it was all thanks to an early version of a security key the company was testing.
And now the latest version of that security key will be available for the world to use.
In an exclusive hands-on, CNET was able to test the Titan Security Key, Google's own key, which uses multifactor authentication to protect people against phishing attacks. Security keys come in many forms, whether it's a USB stick or a Bluetooth fob, used to connect to your device when you try logging in.
The point is to provide a second layer of security through multifactor authentication -- that is, more than one method of proving you're the person who's authorized to log in. Hackers may be able to steal your password online, but they often have a much harder time stealing a physical security key that's with you.
Google has been advocating for security keys for a while, making them a requirement for its Advanced Protection Program, and touting them as the "strongest, most phishing-resistant authentication factor."
The Titan Security Key, which comes in both USB and Bluetooth versions, will be available for sale in Google's online store within the next few months, said Christiaan Brand, a Google product manager for identity and security.
It'll come in a bundle with both the USB and Bluetooth versions for $50, or you can buy one or the other for about $20 to $25 each, Brand said. The set of security keys should work on any device with a USB port or a Bluetooth connection.
The software on the security keys is developed by Google's engineers, and the company has been testing it internally since early 2017. Though the Titan security key shares a name with Google's security chip, it'll be using a different set of chips.
"We're very sure of the quality of the security," Brand said." We're very sure of how we store secrets and how hard it would be for an attacker to come in and blow the security up."
Phishing is one of the most common ways for hackers to get your password. It was how Russian hackers infiltrated the Democratic National Committee -- using sophisticated attacks to target people and trick them into giving up their passwords. But these attacks aren't just reserved for politicians.
They can pop up during tax season and disasters, in coordinated attempts to get everyday people to type in their passwords on an imposter website. Security keys add an extra level of protection because even if hackers were successful in stealing your password through phishing, they wouldn't be able to grab your security key. Security keys would also be able to warn you if you were visiting a phishing website.
They're great for security, but sometimes the keys do their job a little too well -- as when the Titan temporarily locked me out of my own account when I didn't have access to the key. More on that below.
Functionally, the Google key should work exactly the same as popular keys already on the market, like YubiCo's Yubikey, which Google recommended in the past. Sam Srinivas, a product management director for information security at Google, said the company's not trying to compete with other security keys, but rather expand how many options are available.
"The most important thing is for everyone to use a security key," said Srinivas. "The Titan Key is specifically for customers who want security keys and trust Google."
In a response posted after the announcement, Yubico CEO Stina Ehrensvard said the company wouldn't be following Google's lead with a Bluetooth version.
"While Yubico previously initiated development of a [Bluetooth] security key, and contributed to the [Bluetooth Universal 2nd Factor authentication] standards work, we decided not to launch the product as it does not meet our standards for security, usability and durability," Ehrensvard wrote. Bluetooth "does not provide the security assurance levels of NFC and USB, and requires batteries and pairing that offer a poor user experience."
Google declined to comment on Yubico's remarks about Bluetooth security.
The hope is now that Google is creating and selling its own security key, it can bring the price down if the device gets popular enough, which is the company's goal.
"We're not quite happy where these devices are out of reach for customers who can't afford it," Brand said. "We're thinking that hopefully at some point in time, these keys can be in the sub-$10 range."
But before prices can drop, Google is going to have to convince people they actually need a security key.
In January, a Google engineer said that less than 10 percent of Gmail users have two-factor authentication enabled on their accounts.
Google is aware of the lack of interest in multifactor authentication, and it's hoping the Titan key can change that.
There are plenty of reasons why people might not be interested in security keys. It's another item to carry around. They already have two-factor authentication set up with their phones. They might believe their passwords are already strong enough.
All of these are obstacles Google will have to get around to get more people using security keys.
One of the most popular forms of two-factor authentication is to have the service send a PIN via text message to your phone, which you then type in. It helps, but it's not foolproof, Srinivas said. Google found that a targeted attack would be able to trick people into giving up that PIN code, too.
In a Twitter thread, Shane Huntley, director of Google's Threat Analysis Group, explained how someone could still phish a victim through text messages, even with two-factor authentication. Basically, the attacker could send the victim a bogus request for the PIN.
· 21 Jul
Replying to @ShaneHuntley
2FA will protect you against you against other important attacks such as password being stolen from one site and used on another, or passwords databases being compromised. But any 2FA system that involves the user entering a code is phishable.
1. User enters password into attackers site
2. Attacker attempts to log in immediately and SMS code sent to user
3. Attacker sees code is required then returns page asking for code to user
4. User enters code
5. Attacker wins
9:34 PM - Jul 21, 2018
Huntley then recommended using a security key to prevent that from happening.
A security key has other advantages over codes sent to a phone. Though a phone is convenient, Srinivas said, a security key is easier to use and keep track of. You don't need a network to use it, which is helpful when people are in different countries and can't receive text messages. You also don't need power for it, a good thing if your phone battery dies. The Bluetooth version of the Titan key can last for up to six months on a single charge.
"The fundamental thing is that we've got to make this easier for real people to use," Srinivas said.
Google will run awareness campaigns about its new security key, but they'll be targeted to the people it thinks need them the most: potential targets that hackers are after, like politicians, business executives and journalists.
Those people will be more heavily targeted because their email accounts, and the contents within them, are much more valuable for thieves. Phishing a politician can lead to political turmoil like that tied to the 2016 Democratic National Convention, while a pair of attacks on a bank let thieves steal $2.4 million in eight months.
"Even though carrying this key all the time might not be for the billions, if your account really matters, it's valuable enough that you should be carrying it," Srinivas said.
I had a chance to try out the Titan Key myself.
Setting up my security keys was a fairly standard experience. I went to my security settings for Google, and looked for the 2-Step Verification section. From there, I clicked on Add Security Key and was prompted to stick the USB key in and tap the button on it.
I went through the same process for the Bluetooth version, and also set it up for my Facebook account. Now even if someone gained access to my Gmail password, they wouldn't be able to log in unless they also stole the security key from my pocket.
I did run into a few hiccups without my security key over the weekend -- I left it in the office and was asked to enter it to log in to my account from home. Luckily I also set up a backup verification through a Google prompt, which sends an alert to my email on a trusted device, instead of a text message.
But it's hiccups like that that often push people away from using security keys. If I didn't have that backup measure, I'd have been locked out of my account until I got access to the key again.
Google's goal, though, is to get rid of these slip-ups by making security keys second nature, in the same way that people leave their homes every day with a set of house or car keys.
"We want people to understand that this is almost a necessary thing that they should use," Srinivas said.
Phish out of water
Before Google started testing the Titan Key internally, it found that its own employees were susceptible to phishing attacks.
Google's Red Team, a group within the company dedicated to testing employees' security, made multiple successful phishing efforts against Google's own staffers. It exposed a weakness within Google: If an attack was sophisticated enough, it could gain access to the company.
But once Google's employees started using security keys, Srinivas said, that essentially stopped.
"They've pretty much given up on phishing as a primary vector in our own attacks," he said.