Google: Security Keys Neutralized Employee Phishing
Summary: Google says none of its 85,000+ employees have been successfully phished on work-related accounts since early 2017, when it began requiring physical Security Keys in place of passwords and one-time codes. The USB-based keys use the Universal 2nd Factor (U2F) standard, and a Google spokesperson said there have been no reported or confirmed account takeovers since the keys were implemented.
Key Takeaway: Google's prior setup relied on one-time codes from Google Authenticator, which can be phished when a user types the code in; with a Security Key the user never sees a code to hand over, and the article notes SMS and phone-call codes are weaker still because thieves can intercept them through SIM swapping or number porting.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026