Security keys: the sign-in method phishing cannot fool

What a security key is

A security key is a small device, usually the size of a USB drive, that proves it is you when you sign in. You plug it into a computer or tap it on a phone, and often touch a button on it.

Why it stops phishing

Most sign-in codes can be stolen. A fake login page can ask for your password and then your code, and pass both to the real site in seconds. Approval prompts can be tapped by mistake.

A security key works differently. When you sign in, it checks the address of the website it is talking to. If that address is not the real site it was registered with, it simply does not respond. You cannot hand it to a fake site even if you are fooled.

That is why security keys, along with passkeys that work the same way, are called phishing-resistant.

Who should consider them

• Administrators and anyone with access to change settings for the whole company.
• People who handle money, such as finance and payroll.
• Executives and others who are likely targets.
• Anyone who travels a lot or works in places where phones are unreliable.

Practical tips

• Register two keys and keep the spare somewhere safe, in case one is lost.
• Treat it like a house key. On its own it is not enough to sign in, but it should not be left lying around.