Hardware Security Keys: A Seatbelt for the Internet?—Cyber Saturday
Hardware security keys are seatbelts for the Internet, says Stina Ehrensvärd, CEO and cofounder of Yubico, a startup that makes online account-securing fobs.
Stina Ehrensvärd is creating “a seatbelt for the Internet.”
The CEO and founder of Yubico, a startup that designs online account-securing fobs, says as much as she enthusiastically slaps a package on a table at Fortune’s offices. Inside the plastic container: Her latest product. It’s the first Lightning-port compatible hardware security key. Translation: the first security fob that works with Apple’s latest iPhones, generations 5 and later.
Hardware security keys come highly recommended by security experts. They offer an additional layer of protection—a second-factor, in the parlance—over passwords alone. They’re generally more secure than sending a one-time code to your phone, or using a random number generating application to produce the codes. Services such as Twitter, Facebook, and Dropbox support the keys.
Before one dismisses the notion—why am I going to stick this dongle into my phone every time I want to log into one of my accounts?—Stina anticipates the objection. You only have to stick in the key every so often. Google lets you have a 30-day grace period. Other services give you more leniency. Besides: What’s a minor inconvenience for so much peace of mind?
In calling her invention a seatbelt, Ehrensvärd is hearkening back to decades-old innovations at Volvo. In 1959, Nils Bohlin, an engineer at the carmaker, created the three-point seatbelt, which became the standard for safety across the auto industry. Instead of filing patents and keeping the life-saving design proprietary, Volvo chose to evangelize the innovation. Ehrensvärd, who is, coincidentally, also Swedish, aims to do the same with her invention.
“Even if you don’t write about Yubico, you should promote this standard,” Ehrensvärd implores. She refers to WebAuthn, an open authentication standard that enables all this technology to work. She wants to raise awareness about the protocol so that more big tech companies roll it out. Apple only recently began adding compatibility after the World Wide Web Consortium, or W3C, an Internet standards body, gave its blessing to the tech. (You can test the keys out on the beta, or experimental, version of Apple’s web browser Safari.)
Some security keys work without physical touch—no sticking keys in any ports. Instead, they use “near-field communication” or Bluetooth, two wireless telecom standards, to exchange authentication data. But Yubico won’t touch Bluetooth, for fear of security issues, and Apple has so far refused to let outsiders tap into its NFC capability. So, no contactless YubiKeys for iPhone.
In considering this (hopefully temporary) impasse between Yubico and Apple, one might do well to remember that it wasn’t the invention of the seatbelt that saved so many lives, but the convenience of the three-point strap design that Volvo’s Bohlin pioneered. If and when Apple buckles up and lets companies like Yubico tap into NFC, as Google has long enabled on Android, we’ll see real progress.
Robert Hackett | @rhhackett | robert.hackett@fortune.com