What is Universal 2nd Factor (U2F)?

How Universal 2nd Factor devices work

U2F devices are often connected to a computer using a USB port or smartphone and can be accessed by certain applications or websites. After the initial password to an account is entered, the device communicates to the host computer via the Human Interface Device protocol, or the standard that simplifies the transmission of external devices to the computer.

Once the line of communication is initiated, a challenge-response authentication mechanism authenticates the U2F device. If the U2F key is not present or is not unlocked, access is not granted. In addition, the information stored on the key is encrypted, diminishing the risk of keylogger, phishing, man-in-the-middle (MitM), malware and session hijacking attacks.

The U2F standard is supported by the FIDO Alliance, which facilitates compatibility with major companies. Chrome, Firefox and Opera have already supported U2F within their browsers, along with major applications, such as Facebook, GitHub and Dropbox. Large banking corporations, like PayPal, Mastercard, American Express, Visa and Bank of America, have also begun offering U2F security solutions.

Universal 2nd Factor advantages and disadvantages

Universal 2nd Factor devices have their pros and cons, including the following.

Advantages of Universal 2nd Factor

• Stronger security. U2F devices use encryption to ensure the website is real and send information directly to the website, cutting down the risk of attacks, such as phishing and MitM.
• Hardware-backed security. The account private key is stored on the U2F device and never leaves it, eliminating the ability for it to be used by a remote attacker.
• Simplicity. U2F is already incorporated into popular platforms and browsers, making installation easy.
• Consumer choice. Since U2F is a standard of authentication, it can be found in a range of device types and communication methods, enabling the user to choose the best fit.
• Low cost. Keys and drivers with U2F technology are relatively inexpensive, and Yubico provides a free, open source server software for back-end integration.
• Private identity. Users are able to control their online identity and customize it to their needs or privacy level.

Disadvantages of Universal 2nd Factor

• Ability to be lost. As a physical device, U2F keys can be lost or stolen. This could prevent the account from being used. It is, therefore, recommended that accounts have an alternative second factor or have two U2F keys.
• Manual enrollment. U2F keys need to be enrolled by the user and cannot be easily pre-provisioned.
• Key protectors. Some U2F keys only use a physical presence button to ensure a human is at the computer while making the request. A stolen key could be used by another person. If a personal identification number (PIN) or passphrase is required to unlock the key, this could be forgotten.

Universal 2nd Factor compared to other two-factor methods

U2F keys are some of the most secure ways to authenticate an account, but they are not the most common. Most users instead opt to use their cellphone and another type of second factor, such as the following:

• Text or email OTPs. A single-use password is sent in a text message or email. These messages can be intercepted, or the receiving account can be compromised. The receiving page could also be compromised, allowing for MitM or phishing attacks. With U2F, the entire communication chain is authenticated and encrypted between the server and the U2F device, preventing these types of attacks.
• Time-based OTPs. TOTPs rely on a shared secret between the server and client, often a quick response code or secret text, which is shared at the time of creation. If an attacker can see the communication during creation, they can recreate the TOTP. In U2F, the secret never leaves the U2F device and so cannot be stolen when it is created or used.
• Authentication apps and notifications. Many accounts now use a notification on a phone app that the user must approve to authenticate. Some attackers exploit alert fatigue to try and get a user to accept a prompt they shouldn't. In U2F, authentication prompts are less common, and users are more careful of accepting unexpected prompts.

U2F devices are less convenient to use than smartphones. It requires that the user carry the key and plug it in or connect it to log in.

Universal 2nd Factor compared to passkeys

Passkeys are a modern approach to authentication that shares much in common with U2F. Passkeys are part of the FIDO2 standard. This is a more modern standard compared to FIDO, which established U2F.

Both U2F and passkeys use a secure certificate for authentication. In U2F, the private key is saved on a small dedicated external device. A physical presence button or PIN unlocks the key.

With passkeys, the private key is saved in a secure area of another computing device, most commonly on the user's computer or smartphone. The key is unlocked by a gesture -- often, biometrics or a passphrase.

User authentication is key to securing networks. Learn about the different authentication types available, including 2FA, biometrics and certificates. Also, cybersecurity is necessary for all organizations, but some businesses don't think it applies to them. Learn about several persistent security myths and how they can leave organizations vulnerable to cyberattacks.