Universal 2nd Factor (U2F)
Universal 2nd Factor (U2F) is a type of physical authentication device that uses encryption and private keys to protect and unlock supported accounts. Typically seen as a USB, Near-Field Communication (NFC), or Bluetooth device, two-factor authentication is simplified and strengthened with the use of smart chip technology.
Two-factor authentication (2FA) is used as a basic way to protect sensitive information and relies on an internal and external factor. The internal factor is a basic password or PIN, something that is entered on the platform. The second, and external, factor can be receiving an SMS message or phone call with a temporary code or relying on connected authenticator applications. However, depending on cellular devices for authentication creates a large amount of risk and no two account verifications are alike. Therefore, Universal 2nd Factor is a universal standard created by Google and Yubico for streamlining two-factor authentication with any service or account.
U2F devices are connected to a computer via a USB port or smartphone and can be turned on with certain applications or websites. After the initial password to an account is entered, the device communicates to the host computer via the HID protocol, or the standard that simplifies the transmission of external devices to the computer. Once the line of communication is initiated, a challenge-response authentication mechanism (CRAM) sends the private key on the device to the public key on the computer to unlock it. If the U2F key is not present, access will not be granted. In addition, the information stored on the key is encrypted, diminishing the risk of keylogger, phishing, man-in-the-middle (MitM), malware and session hijacking attacks.
The U2F standard is supported by the FIDO Alliance, with includes compatibility with major companies. Chrome, Firefox and Opera have already supported U2F within their browsers along with major applications such as Facebook, Github and Dropbox. Large banking corporations like PayPal, MasterCard, American Express, VISA and Bank of America have also begun offering U2F security solutions.
Advantages of Universal 2nd Factor
- Stronger security: U2F devices use encryption to ensure the website is real and send information directly to the website, cutting down the risk of attacks such as phishing and man-in-the-middle.
- Simplicity: U2F is already incorporated into popular platforms and browsers, making installation easy.
- Consumer choice: Since U2F is a standard of authentication, it can be found in a range of device types and communication methods, allowing the user to choose the best fit.
- Low-cost solution: Keys and drivers with U2F technology are relatively inexpensive and Yubico provides a free, open source server software for back-end integration.
- Private identity: Users are able to control their online identity and customize it to their needs or privacy level.