View all newsletters
Receive our newsletter - data, insights and analysis delivered to you
  1. Technology
  2. Cybersecurity
October 12, 2021updated 07 Jul 2022 11:59am

Gmail security keys are the latest step towards a password-free future

Google is issuing 10,000 physical security keys to "high risk" Gmail users as the tech giant looks to a future beyond passwords.

By Claudia Glover

Google is sending security hardware to 10,000 Gmail customers who are at high risk of being hacked to protect them from phishing attacks, it was revealed this week. This “high-risk” cohort contains executives as well as political activists, journalists and human rights advocates. Coming hot on the heels of Microsoft’s password-free identification roll-out, Google is the latest tech giant to look beyond passwords to provide improved security for customers.

Gmail security keys

10,000 Gmail users are being issued with physical security keys. (Photo by svariophoto/Getty).

Who is receiving Gmail security keys?

Google is providing security hardware in the form of security keys to Gmail customers who it deems “high-risk” to protect them from state-sponsored attackers trying to access their systems. “It seems like the free keys are mainly for business executives, as well as human rights activists, election authorities and women at high risk of online attack such as journalists, dissidents, politicians,” says Paul Bischoff, privacy advocate at cybersecurity product comparison website Comparitech.

This is because state-sponsored groups are more likely to go after people whose data has strategic value within their organisations, explains David Emm, principal security researcher at cybersecurity company Kaspersky.

Additionally, Javvad Malik, lead security awareness advocate at security platform Knowbe4, says the common factor among those receiving a security key is their political significance. “A lot of the high-risk ones that we see in this case are mainly the type of people you would see targeted by the NSO group; politicians, activists and journalists,” he says.

What is Google’s Advanced Protection Programme?

While its secure protection package, Advanced Protection Programme (APP) has been on offer since 2017, Google took the decision to provide it for free for some users in response to a hack that affected up to 1,400 Gmail users, at the hands of Russian state-sponsored cybercrime group APT28, more commonly known as Cozy Bear.

This latest move is an indicator of a shift in the sector away from passwords, argues Bischoff. “We’re seeing the beginning of a transition away from password-based authentication to other more secure and more manageable authentication systems. Those include one-time passwords, biometric authentication, and physical keys, among others.” Passwords, or credentials, are targeted frequently by threat actors, and the Verizon 2021 data breach investigations report states that credentials are the most frequently compromised data in Europe, the Middle East and Africa at 70%, followed by internal data at 52% and personal data at 22%. “Social engineering in the form of phishing is very often the means attackers use to obtain them,” the report says.

Secure keys are built to help with this. They use public key cryptography to verify a user’s identity as well as the URL of the login page. This means they can spot an intruder even if they have obtained the correct username and password.

Content from our partners
Scan and deliver
GenAI cybersecurity: "A super-human analyst, with a brain the size of a planet."
Cloud, AI, and cyber security – highlights from DTX Manchester

Microsoft released a similar product last month, and advises its customers to try two-step authentication. “Nobody likes passwords. They’re inconvenient. They’re a prime target for attacks. Yet for years they’ve been the most important layer of security for everything in our digital lives – from email to bank accounts, shopping carts to video games,” Vasu Jakkal, VP of security, compliance and identity at Microsoft, in a blog post announcing the news. Microsoft also announced that the company has introduced the option to go passwordless in order to avoid “common attacks such as phishing, password spray and credential stuffing.”

Malik says passwords will soon be a thing of the past. “I think it’s only a matter of time before we see others also trying to at least introduce stronger forms of authentication,” he says.

Topics in this article : ,
Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how Progressive Media Investments may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.