On an infinite timeline of the internet, your email and password will eventually fall into the hands of a unknown party. In January alone, 773 Million emails and password combinations were distributed as ‘Collection #1‘. You can see if your email was included at Have I Been Pwned. Having a strong password isn’t enough, that’s why today we’ll look at Nitrokey’s FIDO U2F as a physical device as a second layer of protection.
The Nitrokey U2F is the entry level of their USB dongles. The U2F means Universal 2nd Factor authentication which requires you, or any user, to press the physical key after using the password for logging in. Facebook, Google, and Microsoft have all adopted the standard. You can use it on your account today. Google even boasts their employees haven’t been phished since deploying their own physical keys.
Nitrokey is a Berlin startup founded in 2008. Originally called Crypto Stick, the founders Jan Suhr and Rudolf Böddeker, aimed to create an open source hardware that encrypted communications. It a philosophical difference that makes them stand out from other companies in the field.
There is a guilty ease-of-use to the Nitrokey U2F. Within seconds I attached it to several logins. No drivers needed. No software required. Smooth as silk. Most of all, no more 2FA text messages on our phones. You know, the text based codes that have you searching the room for your phone before the login window closes.
The German engineered Nitrokey is built to last. The USB connector is full instead of a half-connector like several competitors. The monochrome light is also downplayed vs other keys that blind you at late night writing (like now) or hackathons. So you don’t have to worry about the choice of unplugging the key or a green glow filling a darkened room.
There is an upgrade path. The first Nitrokeys were released in 2015, and the second generation came out in October 2018. The Nitrokey U2F’s bigger brothers come with a slew of features that include OpenPGP/GnuPG email encryption, Password Managers, Encrpyted Storage, and plausible deniability in Hidden Volumes.
Lastly, no security is perfect. However, adding a U2F layer of login security will give you a greater amount of safety online. That means your email, communication, banking, and more isn’t solely compromised by a database leak.
Pros
- A Security Standard – Nitrokey’s customers include Adobe, BBC, Bosch, Mozilla, Redhat, and others.
- Ease of Use – Plug and forget.
- Open Source – FIDO Universal 2nd Factor (U2F) is well documented and deployed.
- German Engineered – Nitrokey has 10 years of development under their belt.
Cons
- Large logo – Makes them a target for social engineers.
- One Feature – but the price is right.
- No USB-C version.