- Two-factor authentication.
You've seen the aggressive prompts
and apps everywhere asking you
to enable two-factor authentication for your accounts.
It's one of those painful aspects of security
that we're all familiar with,
but no one wants to deal with.
Some of us use 2FA religiously,
others ignore it because it's such a hassle.
But what if I told you
that two-factor authentication codes are not the most secure
and you should stop using it altogether.
This video is sponsored by 1Password, more on that later.
Now, having multiple ways to verify your identity
when logging into apps or sites is always a good idea.
And two-factor authentication is a decent way
of accomplishing this.
After all, you enter your username and password
and then there's a randomly generated code
that's constantly changing
that you have to enter to prove you are who you say you are.
Even if someone did guess your username and password,
they still can't log into your account without the code.
But have you been overlooking some major security concerns
with two-factor authentication methods?
Take those text codes for example.
You know, when you log into your bank account
and get texted a code you have to enter to log in.
First of all, SMS messages aren't even encrypted.
The SMS protocol is old and outdated,
and it's not a good way
to send sensitive information.
Weaknesses in the dated cell phone infrastructure
allow for attacks such as SIM jacking.
This is where a hacker convinces your wireless carrier
to switch your phone number over to a SIM card
that they possess.
Meaning all your text messages start going
to one of their phones instead of yours.
Okay, so SMS two-factor codes are a bad idea.
But what about those apps like Google Authenticator
or Authy, those have gotta be a lot more secure, right?
These apps generate two-factor authentication codes
on your device, instead of texting them to you.
When your website prompts you for a code, you open the app,
and you copy the code that's been generated.
This ensures that the code is never sent
over a wireless network to get to your device.
But these apps either sync
your two-factor authentication codes to a server,
in the case of Authy,
this ensures that your two-factor authentication codes
can be accessed from any of your devices,
or they store the codes completely offline,
in the case of Google Authenticator.
This means that the codes are usually stored
on one device like your cell phone,
and if you ever lost your cell phone
or your phone got stolen, you're out of luck.
You have no access to your two-factor codes anymore,
and you're probably gonna be locked out of several accounts.
Cloud syncing a two-factor authentication vault leads
to security concerns,
but so does storing that vault offline on a single device.
Imagine if a hacker was able to gain access to your phone
and start controlling it remotely.
Even if your vault is stored offline on your cell phone,
if they can see your screen, they can launch the app,
copy the codes, and log into your accounts
on their own device.
So what's the ultimate fix?
The solution is using a two-factor authentication
method that is air gapped.
What does this mean?
Well, the concept of air gapping
is basically taking two physical devices
that are separated from each other.
And both devices have to come together
for something to work, or make a connection.
You have one piece of the puzzle
that's disconnected from the network,
so that if someone were to hijack your computer or device,
they still can't do anything without
that other physical piece coming together
and being attached to the computer.
And that's exactly what a physical security key is.
It's a USB device
where after you enter your username and password,
you plug the device into your phone or computer
and tap a contact point on it,
and boom, you're logged into your computer.
It stores encrypted keys on it
so you don't have to deal with those randomly generated
two-factor keys.
Just plug in your security key, tap it,
and boom, you're logged in.
This simple device solves so many flaws
of two-factor authentication codes.
First, it's all offline, like actually offline.
Even if your physical security keep was plugged
into your computer when a hacker hijacked it,
they still can't log into your accounts
without someone being there in front of your computer.
This is because of that physical contact point.
It's not enough for the security key
to just be plugged into your device,
someone has to actually tap that contact point for it
to send the encrypted key through to the website
to authenticate you.
Second, you can have multiple security keys for redundancy.
Unlike cloud syncing a two-factor authentication vault
which leads to security concerns,
security keys are all offline,
and you can have two or three of them.
You can have one on your key chain,
and one in a drawer somewhere, and one at grandma's house.
And if you were to ever get one stolen or lost, you can log
into your account using one of your backup keys
and remove the lost or stolen security key
from your account, so nobody can use it to log in.
And third, security keys don't reveal
which accounts are associated with them.
Let's say that someone pickpocketed you
and they got a hold of your security key.
Unless they know exactly who you are
and what accounts you have,
that security key is useless to them.
As long as you're using randomly generated passwords
and a password manager, the likelihood of someone
gaining access to your account
with just a security key is extremely low.
If you don't have a password manager, you need one.
I use 1Password to secure my data,
and 1Password was awesome enough
to sponsor today's video.
You can't just rely on two-factor authentication
to keep you secure.
Strong security starts with strong passwords,
and 1Password is better than the password manager
built into your browser.
1Password lets you automatically sign into apps
and websites using strong, randomly generated passwords
on any device.
You can also store important information
like credit cards, medical records, and notes
both online and offline.
1Password is the safest way
to share logins with the people who matter most.
All while keeping your personal information secure.
We use 1Password here at Craylor Media
and it's super easy for me to give team members access
to specific logins, giving them exactly what they need.
1Password will even alert you
when accounts are compromised.
I like being able to access
1Password on whatever device I'm using.
You can even enable login with Face ID, Touch ID,
Windows Hello and fingerprint unlock
to conveniently access your vault.
Go to this link to get 25% off 1Password
and start securing your digital life today.
Thanks to 1Password for sponsoring today's video,
and now let's take a look at some different security keys.
So you've decided you want to try a security key.
Buying one seems like a simple task
but there's quite a few options.
The main ones come from Google and a company called Yubico.
I've been able to try several different YubiKeys
and Google Titan security keys,
and I can definitely say they're not created equal.
We'll start with Google's Titan security keys.
There's two options to pick from
and they're both very simple.
There's a USB-A key and a USB-C key.
They're both straightforward to use,
and you can use them with any platform
that supports security keys.
They also both support NFC so you can tap it to your phone
or other mobile device in order to log in on mobile.
At a price point of $30 for USB-A and $35 for USB-C,
these are among the more basic security keys you can get.
The USB-A version has a nice flat profile
that fits great on any key ring.
I especially like it
because it fits the shape of all my other keys,
so it fits perfectly on my key organizer.
The problem with the USB-A key is that I'm a Mac user,
so all my Macs have USB-C ports exclusively,
bringing me to the USB-C key.
It's got a heftier, thicker, metal build.
And while some users are going
to appreciate this, 'cause it does feel nice,
it feels more like a high-end flash drive,
it doesn't fit on my key organizer,
making it not a viable option for me personally.
But if you were to use the USB-C key
on a traditional key ring, I think it would fit just fine.
It's still small and compact,
and I really do like the build quality.
Overall, these Google Titan security keys
are extremely simple.
There's not a whole lot to it.
You plug them in, tap the contact point,
and log into your website.
And that brings me to YubiKeys.
I'll cut to the chase,
YubiKeys are just better in every way.
First there's the YubiKey C NFC.
For $29, it supports USB-C, NFC,
and has a nice flat profile
very similar to Google's USB-A security key.
Meaning it fits on my key organizer perfectly.
The YubiKey also has an extra trick up it's sleeve.
You can use the Yubico authenticator app
to plug in your YubiKey and set a pin number.
Then, every time you plug in your security key
for the first time, you have to enter your pin number
before it will function.
It's kind of like two-factor authentication
for your two-factor authentication.
In the event that your security key was stolen,
it would be absolutely useless
until that pin number is entered.
But the $29 YubiKey is pretty ugly.
It's bright blue and it's plastic.
I don't really mind the plastic build,
because I think it enables that nice, flat, slim profile
that works great with my key organizer,
but there's no denying that Google's Titan security key
definitely looks and feels better.
YubiKey does have an upgraded option that is black
so it doesn't stick out as much.
For $55, the YubiKey 5C NFC
supports more security standards,
so it can be used in more places.
Let me be clear here.
All the security keys featured
in this video will be compatible with 99% of websites
and apps that support security keys.
You'd be hard pressed to find a website
that doesn't support your specific security key,
if they support security keys to begin with.
But for some password managers like LastPass
and Bitwarden, you need this upgraded security key
because it supports a specific security standard
that other security keys don't.
But 1Password supports all security keys featured
in this video, just saying.
The YubiKey 5C does have one extremely neat trick
up its sleeve.
You can store two-factor authentication codes locally
on the security key.
Instead of storing these codes in the cloud
or offline on a single device,
you can actually store your app based
two-factor authentication codes
on the security key itself.
Then you can open the Yubico authenticator app
on any device, plug in your security key,
tap to authenticate, and boom,
all your two-factor authentication codes
for all your websites pop up
and it's being read from that security key.
So as soon as you pull the security key out,
your codes disappear,
plug it into a different device with the app,
all your codes come back.
This feature is exclusive to the $55 YubiKey,
so that alone might make it worth the extra $25
over the base model.
YubiKey has a ton of different security keys
including options with biometric fingerprint readers.
But these are the two I took a look at
in this video, because they're the most popular options.
There's also other brands of security keys out there,
but Yubico and Google are the main players in the space.
Overall, the YubiKey fits my lifestyle better
thanks to the thin profile
that fits great on my key organizer,
and I love the piece of mind added by the pin code.
But I gotta give it to Google
for creating a stylish, elegant USB-C security key
that still does a great job protecting your accounts.
Don't forget to go to this link to get 25% off 1Password.
Thanks again to 1Password for sponsoring today's video,
and I highly recommend it if you're looking
for an outstanding password manager
to keep your account secure.
It's great to use with your security key and VPN,
and it's another tool in your security toolbox
to keep you protected online.
Check out the description for links to all these resources,
and with that said, I'll catch you guys next time.