{"id":173153,"date":"2022-12-31T05:07:01","date_gmt":"2022-12-31T05:07:01","guid":{"rendered":"https:\/\/harchi90.com\/the-password-isnt-dead-yet-you-need-a-hardware-key-2\/"},"modified":"2022-12-31T05:07:01","modified_gmt":"2022-12-31T05:07:01","slug":"the-password-isnt-dead-yet-you-need-a-hardware-key-2","status":"publish","type":"post","link":"https:\/\/harchi90.com\/the-password-isnt-dead-yet-you-need-a-hardware-key-2\/","title":{"rendered":"The Password Isn’t Dead Yet. You Need a Hardware Key"},"content":{"rendered":"
\n

In August, the<\/span> internet infrastructure company Cloudflare was one of hundreds of targets in a massive criminal phishing spree that succeeded in breaching numerous tech companies. While some Cloudflare employees were tricked by the phishing messages, the attackers couldn’t burrow deeper into the company’s systems. That’s because, as part of Cloudflare’s security controls, every employee must use a physical security key to prove their identity while logging into all applications. Weeks later, the company announced a collaboration with the hardware authentication token-maker Yubikey to offer discounted keys to Cloudflare customers. <\/p>\n

Cloudflare wasn’t the only company high on the security protection of hardware tokens, though. Earlier this month, Apple announced hardware key support for Apple IDs, seven years after first rolling out two-factor authentication on user accounts. And two weeks ago, the Vivaldi browser announced hardware key support for Android.<\/p>\n

The protection isn’t new, and many major platforms and companies have for years supported hardware key adoption and required that employees use them as Cloudflare did. But this latest surge in interest and implementation comes in response to an array of escalating digital threats.<\/p>\n

\u201cPhysical authentication keys are some of the most effective methods today for protecting against account takeovers and phishing,\u201d says Crane Hassold, director of threat intelligence at Abnormal Security and a former digital behavior analyst for the FBI. \u201cIf you think about it as a hierarchy, physical tokens are more effective than authentication apps, which are better than SMS verification, which is more effective than email verification.\u201d <\/p>\n

Hardware authentication is very secure, because you need to physically possess the key and produce it. This means that a phisher online can’t simply trick someone into handing over their password, or even a password plus a second-factor code, to break into a digital account. You already know this intuitively, because this is the whole premise of door keys. Someone would need your key to unlock your front door\u2014and if you lose your key, it’s usually not the end of the world, because someone who finds it won’t know which door it unlocks. For digital accounts, there are different types of hardware keys that are built on standards from a tech industry association known as the FIDO Alliance, including smart cards that have a little circuit chip on them, tap cards or fobs that use near-field communication, or things like Yubikeys that plug into a port on your device.<\/p>\n

You likely have dozens or even hundreds of digital accounts, and even if they all supported hardware tokens it would be difficult to manage physical keys for all of them. But for your most valuable accounts and those that are a fallback for other logins\u2014namely, your email\u2014the security and phishing resistance of hardware keys can mean significant peace of mind.<\/p>\n

Meanwhile, after years of work, the tech industry finally took major steps in 2022 toward a long-promised passwordless future. The move is riding on the back of a technology called \u201cpasskeys\u201d that are also built on FIDO standards. Operating systems from Apple, Google, and Microsoft now support the technology, and many other platforms, browsers, and services have adopted it or are in the process of doing so. The goal is to make it easier for users to manage their digital account authentication so they don’t use insecure workarounds like weak passwords. As much as you might wish it, though, passwords aren’t going to disappear anytime soon, thanks to their sheer ubiquity. And amid all the buzz about passkeys, hardware tokens are still an important protection option.<\/p>\n

\u201cFIDO has been positioning passkeys somewhere between passwords and hardware-based FIDO authenticators, and I think that’s a fair characterization,\u201d says Jim Fenton, an independent identity privacy and security consultant. \u201cWhile passkeys will probably be the right answer for many consumer applications, I think hardware-based authenticators will continue to have a role for higher-security applications, like for staff at financial institutions. And more security-focused consumers should also have the option to use hardware-based authenticators, particularly if their data has previously been breached, if they have a high net worth, or if they are just concerned about security.\u201d<\/p>\n

While it may feel daunting at first to add one more best practice to your digital security to-do list, hardware tokens are actually easy to set up. And you’ll get plenty of mileage from just using them on a couple of, ahem, key<\/em> accounts.<\/p>\n<\/div>\n

.<\/p>\n","protected":false},"excerpt":{"rendered":"

In August, the internet infrastructure company Cloudflare was one of hundreds of targets in a massive criminal phishing spree that succeeded in breaching numerous tech companies. While some Cloudflare employees were tricked by the phishing messages, the attackers couldn’t burrow deeper into the company’s systems. That’s because, as part of Cloudflare’s security controls, every employee …<\/p>\n

The Password Isn’t Dead Yet. You Need a Hardware Key<\/span> Read More »<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"default","ast-global-header-display":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true},"categories":[4],"tags":[24295,4642,16784,16783],"jetpack_publicize_connections":[],"yoast_head":"\nThe Password Isn't Dead Yet. You Need a Hardware Key - harchi90<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/news.google.com\/__i\/rss\/rd\/articles\/CBMiRWh0dHBzOi8vd3d3LndpcmVkLmNvbS9zdG9yeS9oYXJkd2FyZS1zZWN1cml0eS1rZXktcGFzc3dvcmRzLXBhc3NrZXlzL9IBAA?oc=5\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The Password Isn't Dead Yet. You Need a Hardware Key - harchi90\" \/>\n<meta property=\"og:description\" content=\"In August, the internet infrastructure company Cloudflare was one of hundreds of targets in a massive criminal phishing spree that succeeded in breaching numerous tech companies. While some Cloudflare employees were tricked by the phishing messages, the attackers couldn’t burrow deeper into the company’s systems. That’s because, as part of Cloudflare’s security controls, every employee … The Password Isn’t Dead Yet. You Need a Hardware Key Read More »\" \/>\n<meta property=\"og:url\" content=\"https:\/\/news.google.com\/__i\/rss\/rd\/articles\/CBMiRWh0dHBzOi8vd3d3LndpcmVkLmNvbS9zdG9yeS9oYXJkd2FyZS1zZWN1cml0eS1rZXktcGFzc3dvcmRzLXBhc3NrZXlzL9IBAA?oc=5\" \/>\n<meta property=\"og:site_name\" content=\"harchi90\" \/>\n<meta property=\"article:published_time\" content=\"2022-12-31T05:07:01+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/media.wired.com\/photos\/639b782520642730f95ffa01\/191:100\/w_1280,c_limit\/YearEndReview_YubiKey.jpg\" \/>\n<meta name=\"author\" content=\"islamlacoste58\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/media.wired.com\/photos\/639b782520642730f95ffa01\/191:100\/w_1280,c_limit\/YearEndReview_YubiKey.jpg\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"islamlacoste58\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/harchi90.com\/the-password-isnt-dead-yet-you-need-a-hardware-key-2\/\",\"url\":\"https:\/\/news.google.com\/__i\/rss\/rd\/articles\/CBMiRWh0dHBzOi8vd3d3LndpcmVkLmNvbS9zdG9yeS9oYXJkd2FyZS1zZWN1cml0eS1rZXktcGFzc3dvcmRzLXBhc3NrZXlzL9IBAA?oc=5\",\"name\":\"The Password Isn't Dead Yet. You Need a Hardware Key - harchi90\",\"isPartOf\":{\"@id\":\"https:\/\/harchi90.com\/#website\"},\"datePublished\":\"2022-12-31T05:07:01+00:00\",\"dateModified\":\"2022-12-31T05:07:01+00:00\",\"author\":{\"@id\":\"https:\/\/harchi90.com\/#\/schema\/person\/0689156e87fbe869f0e5efdeef200d5b\"},\"breadcrumb\":{\"@id\":\"https:\/\/news.google.com\/__i\/rss\/rd\/articles\/CBMiRWh0dHBzOi8vd3d3LndpcmVkLmNvbS9zdG9yeS9oYXJkd2FyZS1zZWN1cml0eS1rZXktcGFzc3dvcmRzLXBhc3NrZXlzL9IBAA?oc=5#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/news.google.com\/__i\/rss\/rd\/articles\/CBMiRWh0dHBzOi8vd3d3LndpcmVkLmNvbS9zdG9yeS9oYXJkd2FyZS1zZWN1cml0eS1rZXktcGFzc3dvcmRzLXBhc3NrZXlzL9IBAA?oc=5\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/news.google.com\/__i\/rss\/rd\/articles\/CBMiRWh0dHBzOi8vd3d3LndpcmVkLmNvbS9zdG9yeS9oYXJkd2FyZS1zZWN1cml0eS1rZXktcGFzc3dvcmRzLXBhc3NrZXlzL9IBAA?oc=5#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/harchi90.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The Password Isn’t Dead Yet. You Need a Hardware Key\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/harchi90.com\/#website\",\"url\":\"https:\/\/harchi90.com\/\",\"name\":\"harchi90\",\"description\":\"Just another WordPress site\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/harchi90.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/harchi90.com\/#\/schema\/person\/0689156e87fbe869f0e5efdeef200d5b\",\"name\":\"islamlacoste58\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/harchi90.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/5bf7491076e3822b8e0de7b1f9364d75?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/5bf7491076e3822b8e0de7b1f9364d75?s=96&d=mm&r=g\",\"caption\":\"islamlacoste58\"},\"sameAs\":[\"http:\/\/harchi90.com\"],\"url\":\"https:\/\/harchi90.com\/author\/islamlacoste58\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"The Password Isn't Dead Yet. You Need a Hardware Key - harchi90","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/news.google.com\/__i\/rss\/rd\/articles\/CBMiRWh0dHBzOi8vd3d3LndpcmVkLmNvbS9zdG9yeS9oYXJkd2FyZS1zZWN1cml0eS1rZXktcGFzc3dvcmRzLXBhc3NrZXlzL9IBAA?oc=5","og_locale":"en_US","og_type":"article","og_title":"The Password Isn't Dead Yet. You Need a Hardware Key - harchi90","og_description":"In August, the internet infrastructure company Cloudflare was one of hundreds of targets in a massive criminal phishing spree that succeeded in breaching numerous tech companies. While some Cloudflare employees were tricked by the phishing messages, the attackers couldn’t burrow deeper into the company’s systems. That’s because, as part of Cloudflare’s security controls, every employee … The Password Isn’t Dead Yet. You Need a Hardware Key Read More »","og_url":"https:\/\/news.google.com\/__i\/rss\/rd\/articles\/CBMiRWh0dHBzOi8vd3d3LndpcmVkLmNvbS9zdG9yeS9oYXJkd2FyZS1zZWN1cml0eS1rZXktcGFzc3dvcmRzLXBhc3NrZXlzL9IBAA?oc=5","og_site_name":"harchi90","article_published_time":"2022-12-31T05:07:01+00:00","og_image":[{"url":"https:\/\/media.wired.com\/photos\/639b782520642730f95ffa01\/191:100\/w_1280,c_limit\/YearEndReview_YubiKey.jpg"}],"author":"islamlacoste58","twitter_card":"summary_large_image","twitter_image":"https:\/\/media.wired.com\/photos\/639b782520642730f95ffa01\/191:100\/w_1280,c_limit\/YearEndReview_YubiKey.jpg","twitter_misc":{"Written by":"islamlacoste58","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/harchi90.com\/the-password-isnt-dead-yet-you-need-a-hardware-key-2\/","url":"https:\/\/news.google.com\/__i\/rss\/rd\/articles\/CBMiRWh0dHBzOi8vd3d3LndpcmVkLmNvbS9zdG9yeS9oYXJkd2FyZS1zZWN1cml0eS1rZXktcGFzc3dvcmRzLXBhc3NrZXlzL9IBAA?oc=5","name":"The Password Isn't Dead Yet. You Need a Hardware Key - harchi90","isPartOf":{"@id":"https:\/\/harchi90.com\/#website"},"datePublished":"2022-12-31T05:07:01+00:00","dateModified":"2022-12-31T05:07:01+00:00","author":{"@id":"https:\/\/harchi90.com\/#\/schema\/person\/0689156e87fbe869f0e5efdeef200d5b"},"breadcrumb":{"@id":"https:\/\/news.google.com\/__i\/rss\/rd\/articles\/CBMiRWh0dHBzOi8vd3d3LndpcmVkLmNvbS9zdG9yeS9oYXJkd2FyZS1zZWN1cml0eS1rZXktcGFzc3dvcmRzLXBhc3NrZXlzL9IBAA?oc=5#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/news.google.com\/__i\/rss\/rd\/articles\/CBMiRWh0dHBzOi8vd3d3LndpcmVkLmNvbS9zdG9yeS9oYXJkd2FyZS1zZWN1cml0eS1rZXktcGFzc3dvcmRzLXBhc3NrZXlzL9IBAA?oc=5"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/news.google.com\/__i\/rss\/rd\/articles\/CBMiRWh0dHBzOi8vd3d3LndpcmVkLmNvbS9zdG9yeS9oYXJkd2FyZS1zZWN1cml0eS1rZXktcGFzc3dvcmRzLXBhc3NrZXlzL9IBAA?oc=5#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/harchi90.com\/"},{"@type":"ListItem","position":2,"name":"The Password Isn’t Dead Yet. You Need a Hardware Key"}]},{"@type":"WebSite","@id":"https:\/\/harchi90.com\/#website","url":"https:\/\/harchi90.com\/","name":"harchi90","description":"Just another WordPress site","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/harchi90.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/harchi90.com\/#\/schema\/person\/0689156e87fbe869f0e5efdeef200d5b","name":"islamlacoste58","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/harchi90.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/5bf7491076e3822b8e0de7b1f9364d75?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/5bf7491076e3822b8e0de7b1f9364d75?s=96&d=mm&r=g","caption":"islamlacoste58"},"sameAs":["http:\/\/harchi90.com"],"url":"https:\/\/harchi90.com\/author\/islamlacoste58\/"}]}},"jetpack_featured_media_url":"","jetpack-related-posts":[{"id":172882,"url":"https:\/\/harchi90.com\/the-password-isnt-dead-yet-you-need-a-hardware-key\/","url_meta":{"origin":173153,"position":0},"title":"The Password Isn’t Dead Yet. You Need a Hardware Key","date":"December 30, 2022","format":false,"excerpt":"In August, the internet infrastructure company Cloudflare was one of hundreds of targets in a massive criminal phishing spree that succeeded in breaching numerous tech companies. While some Cloudflare employees were tricked by the phishing messages, the attackers couldn't burrow deeper into the company's systems. That's because, as part of\u2026","rel":"","context":"In "Technology"","img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":131765,"url":"https:\/\/harchi90.com\/its-a-puny-world-after-all-krebs-on-security\/","url_meta":{"origin":173153,"position":1},"title":"It’s a Puny World After All \u2013 Krebs on Security","date":"November 18, 2022","format":false,"excerpt":"A financial cybercrime group calling itself the Disneyland Team has been making liberal use of visually confusing phishing domains that spoof popular bank brands using Punycode, an Internet standard that allows web browsers to render domain names with non-Latin alphabets like Cyrillic. The Disneyland Team's Web interface, which allows them\u2026","rel":"","context":"In "Technology"","img":{"alt_text":"","src":"https:\/\/i0.wp.com\/krebsonsecurity.com\/wp-content\/uploads\/2022\/11\/disneylandteampanel.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":116392,"url":"https:\/\/harchi90.com\/malicious-app-developer-remains-on-google-play\/","url_meta":{"origin":173153,"position":2},"title":"Malicious App Developer Remains on Google Play","date":"November 3, 2022","format":false,"excerpt":"Google has been routinely notified about malware-containing apps listed on Play Store, but it has routinely failed at catching already-identified malware code.photo: eastern pop (Shutterstock)Google is still failing to catch malicious apps from being listed on its app store, but it seems that some developers that have been cited aren't\u2026","rel":"","context":"In "Technology"","img":{"alt_text":"Canadian Down & Feather Company","src":"https:\/\/i0.wp.com\/i.kinja-img.com\/gawker-media\/image\/upload\/c_fill,fl_progressive,g_center,h_180,q_80,w_320\/6b8bf2579c7a444181389c099e631aa6.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":151025,"url":"https:\/\/harchi90.com\/apple-advances-user-security-with-powerful-new-data-protections\/","url_meta":{"origin":173153,"position":3},"title":"Apple advances user security with powerful new data protections","date":"December 7, 2022","format":false,"excerpt":"December 7, 2022 UPDATE Apple advances user security with powerful new data protections iMessage Contact Key Verification, Security Keys for Apple ID, and Advanced Data Protection for iCloud provide users with important new tools to protect their most sensitive data and communications Apple today introduced three advanced security features focused\u2026","rel":"","context":"In "Technology"","img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":153457,"url":"https:\/\/harchi90.com\/apples-new-advanced-data-protection-brings-more-security-and-encryption-to-icloud\/","url_meta":{"origin":173153,"position":4},"title":"Apple’s new Advanced Data Protection brings more security and encryption to iCloud","date":"December 10, 2022","format":false,"excerpt":"Apple, the company whose CEO is fond of calling privacy a human right, has added a few new privacy features to its devices. One of them, Advanced Data Protection, is adding end-to-end encryption to almost every iCloud service out there. Which means that almost everything you upload to Apple's cloud\u2026","rel":"","context":"In "Technology"","img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":101906,"url":"https:\/\/harchi90.com\/experts-warn-of-stealthy-powershell-backdoor-disguising-as-windows-update\/","url_meta":{"origin":173153,"position":5},"title":"Experts Warn of Stealthy PowerShell Backdoor Disguising as Windows Update","date":"October 19, 2022","format":false,"excerpt":"Details have emerged about a previously undocumented and fully undetectable (FUD) PowerShell backdoor that gains its stealth by disguising itself as part of a Windows update process. \"The covert self-developed tool and the associated C2 commands seem to be the work of a sophisticated, unknown threat actor who has targeted\u2026","rel":"","context":"In "Technology"","img":{"alt_text":"","src":"https:\/\/i0.wp.com\/thehackernews.com\/new-images\/img\/b\/R29vZ2xl\/AVvXsEgvfqow2z1XORevUpzKGWWXZ2DP4dMaNi-7cycpa3J_bSZKv0tO6MP40HLl7lvVJDIswOmb6I-YoNMLJym4v9oLZQczujsMqcttB3M_Cvm6E-zLs0XrpwaTZ_SGFjckDfi3CPfijZaii8Z88_btcKeHKKfxm7cDyF3kaVvsirGpb2JWVH0Ot3xGiC2sZg\/s1600\/strike-728.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]}],"fifu_image_url":"https:\/\/media.wired.com\/photos\/639b782520642730f95ffa01\/191:100\/w_1280,c_limit\/YearEndReview_YubiKey.jpg","_links":{"self":[{"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/posts\/173153"}],"collection":[{"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/comments?post=173153"}],"version-history":[{"count":0,"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/posts\/173153\/revisions"}],"wp:attachment":[{"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/media?parent=173153"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/categories?post=173153"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/harchi90.com\/wp-json\/wp\/v2\/tags?post=173153"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}