Bloomberg said Google’s “Advanced Protection Program” will be introduced later this year. It will be an alternative to traditional two-factor authentication.
The need for security
The service is aimed at Gmail users with particularly pressing security requirements. Google will market the strengthened option to corporate executives and politicians who are at increased risk of finding themselves hit by online data theft.
Members of the program will be issued a pair of physical keys to verify their identity to Google’s servers. These USB sticks will replace the SMS codes and authenticator apps normally used to enforce two-factor authentication. The presence of the physical key ensures only the account holder can access cloud files, making it less likely an external actor could break in. The only way to do so would require theft of the physical key.
Gone phishing
There’s speculation the new service is designed to combat a rise in sophisticated email phishing campaigns targeting important individuals. In 2016, the Gmail account of John Podesta, Hillary Clinton’s presidential campaign chairman, was hacked in a high-profile incident. It drew awareness to the issue of unsecured email accounts and prompted calls for change. Google’s now responding by offering politicians a way to safeguard their inbox.
READ NEXT: Oracle’s new database uses AI to keep itself secure
Enterprise
Google’s also trying to attract more enterprise clients to its G Suite business products. Modern security options built around physical keys could help it to reach new customers with complex security requirements. Companies are increasingly prepared to move their files to the cloud but need assurances that their assets will be protected.
Advanced Protection Program will prevent any unauthorised third-party programs from accessing the user’s Gmail emails or Drive documents. The service expands on Google’s previously released USB Security Key, another physical device to bolster traditional security defences.
Physical keys work by generating cryptographic verification codes, like authenticator phone apps, that can be matched by a unique signature on the server. Unlike smartphone services, software is removed from the equation, so the keys can’t be tampered with or lost if the phone gets stolen.
