Browse Definitions :
Definition

Universal 2nd Factor (U2F)

Universal 2nd Factor (U2F) is a type of physical authentication device that uses encryption and private keys to protect and unlock supported accounts. Typically seen as a USB, Near-Field Communication (NFC), or Bluetooth device, two-factor authentication is simplified and strengthened with the use of smart chip technology.

Two-factor authentication (2FA) is used as a basic way to protect sensitive information and relies on an internal and external factor. The internal factor is a basic password or PIN, something that is entered on the platform. The second, and external, factor can be receiving an SMS message or phone call with a temporary code or relying on connected authenticator applications. However, depending on cellular devices for authentication creates a large amount of risk and no two account verifications are alike. Therefore, Universal 2nd Factor is a universal standard created by Google and Yubico for streamlining two-factor authentication with any service or account.

U2F devices are connected to a computer via a USB port or smartphone and can be turned on with certain applications or websites. After the initial password to an account is entered, the device communicates to the host computer via the HID protocol, or the standard that simplifies the transmission of external devices to the computer. Once the line of communication is initiated, a challenge-response authentication mechanism (CRAM) sends the private key on the device to the public key on the computer to unlock it. If the U2F key is not present, access will not be granted. In addition, the information stored on the key is encrypted, diminishing the risk of keylogger, phishing, man-in-the-middle (MitM), malware and session hijacking attacks.

The U2F standard is supported by the  FIDO Alliance, with includes compatibility with major companies. Chrome, Firefox and Opera have already supported U2F within their browsers along with major applications such as Facebook, Github and Dropbox. Large banking corporations like PayPal, MasterCard, American Express, VISA and Bank of America have also begun offering U2F security solutions.

Advantages of Universal 2nd Factor

  • Stronger security: U2F devices use encryption to ensure the website is real and send information directly to the website, cutting down the risk of attacks such as phishing and man-in-the-middle.
  • Simplicity: U2F is already incorporated into popular platforms and browsers, making installation easy.
  • Consumer choice: Since U2F is a standard of authentication, it can be found in a range of device types and communication methods, allowing the user to choose the best fit.
  • Low-cost solution: Keys and drivers with U2F technology are relatively inexpensive and Yubico provides a free, open source server software for back-end integration.
  • Private identity: Users are able to control their online identity and customize it to their needs or privacy level.
This was last updated in September 2018

Continue Reading About Universal 2nd Factor (U2F)

Join the conversation

1 comment

Send me notifications when other members comment.

Please create a username to comment.

How likely or unlikely are you to invest in a U2F device?
Cancel

-ADS BY GOOGLE

File Extensions and File Formats

Powered by:

SearchCompliance

  • risk management

    Risk management is the process of identifying, assessing and controlling threats to an organization's capital and earnings.

  • compliance as a service (CaaS)

    Compliance as a Service (CaaS) is a cloud service service level agreement (SLA) that specified how a managed service provider (...

  • data protection impact assessment (DPIA)

    A data protection impact assessment (DPIA) is a process designed to help organizations determine how data processing systems, ...

SearchSecurity

  • cybersecurity insurance (cybersecurity liability insurance)

    Cybersecurity insurance, also called cyber liability insurance or cyber insurance, is a contract that an entity can purchase to ...

  • phishing

    Phishing is a form of fraud in which an attacker masquerades as a reputable entity or person in email or other communication ...

  • cybercrime

    Cybercrime is any criminal activity that involves a computer, networked device or a network.

SearchHealthIT

SearchDisasterRecovery

  • business continuity plan (BCP)

    A business continuity plan (BCP) is a document that consists of the critical information an organization needs to continue ...

  • disaster recovery team

    A disaster recovery team is a group of individuals focused on planning, implementing, maintaining, auditing and testing an ...

  • cloud insurance

    Cloud insurance is any type of financial or data protection obtained by a cloud service provider. 

SearchStorage

  • NVMe over Fabrics (NVMe-oF)

    NVMe over Fabrics, also known as NVMe-oF and non-volatile memory express over fabrics, is a protocol specification designed to ...

  • logical unit number (LUN)

    A logical unit number (LUN) is a unique identifier for designating an individual or collection of physical or virtual storage ...

  • CIFS (Common Internet File System)

    CIFS (Common Internet File System) is a protocol that gained popularity around the year 2000, as vendors worked to establish an ...

Close