ProtonBlog

Protect your Proton Account with YubiKey and other security keys

Condividi questa pagina

You keep important moments of your life in your Proton Account. Whether it’s bank statements you receive in Proton Mail, photos you store in Proton Drive, or events you set up in Proton Calendar, your data deserves to be protected. 

Today, we’re happy to introduce the simplest and most secure way of keeping your account safe: security keys, also known as hardware keys or two-factor authentication keys (2FA keys). You can now sign in to your Proton Account on the web using a hardware key, such as a YubiKey, as long as it adheres to the U2F or FIDO2 standard.

Set up a security key 

What are security keys

Have you ever signed in to an online account and been asked to verify your identity with a six-digit code sent to your mobile device? That’s two-factor authentication (2FA). Enabling 2FA is critical to securing your Proton Account — with 2FA, even if an attacker gets a hold of your password, they cannot sign in to your account without access to your mobile device.

Security keys are another form of 2FA. They help you prove your identity when you’re logging in to an account, app, or device. If you choose to use a 2FA key, you’ll be asked to plug in your key every time you sign in to your Proton Account.

Why you should use a security key

At Proton, we support 2FA using time-sensitive verification codes (TOTP) generated by an authenticator app installed on your mobile device. We use TOTP as it is more secure than 2FA using text messages, which are vulnerable to SIM-swapping attacks.

However, using TOTP can be inconvenient as it involves entering a code in a short period of time. Having a hardware key removes this hassle. Hardware keys are also a “possession factor”, which proves you physically own the key used to authenticate your account. Due to their physical nature, hardware keys are one of the most secure forms of 2FA. 

They are also convenient and easy to use — all you need to do is to plug your key into your computer when asked to verify your identity. Depending on your device, you may even use its built-in security key to verify your identity with biometrics such as Apple’s Touch ID or Windows Hello.

Learn how to set up a security key with your Proton Account

As we continue to expand our private-by-default ecosystem, we’ll be adding support for security keys across all Proton platforms, including our desktop and mobile apps. 

Thank you for your support, and we look forward to introducing even more privacy-first features in the upcoming months.

Proteggi la tua privacy con Proton
Crea un account gratuito

Condividi questa pagina

Lydia Pang

Lydia is a lifelong book-lover and her professional experience spans several industries, including higher education and editorial writing. She's excited to write for Proton and champion privacy as a fundamental right for everyone.

Articoli correlati

en
At Proton, we’re always working on new and innovative ways to protect the privacy and data of the Proton community. Sometimes that means developing entirely new services, like our Proton Sentinel program, which combines AI and human security analysts
How to unsend an email in Gmail, Outlook, Proton Mail, and Apple Mail
en
“Undo Send” gives you a chance to stop an erroneous message you’ve just sent. We’ve all done it. You hit Send on an email only to spot you’ve misspelled someone’s name, forgotten an attachment, or accidentally sent a cringing joke to half your conta
en
Google has already taken privacy washing to the extreme by trying to brand itself as “privacy focused”, even though its business model is based on surveillance.  Lately, the company’s marketing strategy has turned toward outright Orwellian doublespe
en
Last week, the UK government made a statement in the House of Lords acknowledging that portions of the controversial Online Safety Bill might not even be technically enforceable without breaking end-to-end encryption. This rightly received a lot of a
What is email spoofing?
en
Email spoofing is a technique attackers use to make a message appear to be from a legitimate sender — a common trick in phishing and spam emails. Learn how spoofing works, how to identify spoofed messages, and how to protect yourself from spoofing a
en
Google Chrome is the world’s most popular web browser by far, with over 3 billion users. Its built-in password manager, Google Password Manager, is its default software to create and store passwords for websites and services. Although convenient for