Pierluigi Paganini
October 18, 2017
The Advanced Protection feature was designed to improve the security of users, who are at high risk of targeted attacks.
“We took this unusual step because there is an overlooked minority of our users that are at particularly high risk of targeted online attacks. For example, these might be campaign staffers preparing for an upcoming election, journalists who need to protect the confidentiality of their sources, or people in abusive relationships seeking safety.” reads the blog post published by Google.
“Sometimes even the most careful and security-minded users are successfully attacked through phishing scams, especially if those phishing scams were individually targeted at the user in question.”
Even if the threat actor obtains the victim’s credentials via spear phishing messages, advanced or using a malware he will not be able to access the Google account.
Users that want to enable the Google’s Advanced Protection feature need two physical security keys that work with FIDO Universal 2nd Factor (U2F).
U2F is an open authentication standard that allows users to securely access many online services, with one single device with no drivers, or client software needed.
This hardware-based two-factor authentication does not require secret codes via SMS, apps or emails.
According to Google, the new feature implements the best protection against:
“They [security devices] use public-key cryptography and digital signatures to prove to Google that it’s really you,” the post reads. “An attacker who does not have your Security Key is automatically blocked, even if they have your password.” continues Google.Advanced Protection offer three features to keep your account safe:
The Google Advanced Protection program implements the following features:
Advanced Protection feature is not designed for everyone, but only for people, like journalists, government officials and activists, who are at a higher risk of being targeted by government or sophisticated hackers and ready to sacrifice some convenience for substantially increased e-mail protection.
Currently, Google users can enroll in the Advanced Protection Program using Google Chrome that already supports the U2F standard for Security Keys, other browsers are expected to support the same technology.
Users that want to use the Advanced Protection have to sign up at the following address:
https://landing.google.com/advancedprotection/
Google also announced the partnership with security firm ESET for malware detection in the Chrome browser through the Chrome Cleanup feature.
Chrome Cleanup now leverages the malware detection engine from ESET.
“Under the hood, we upgraded the technology we use in Chrome Cleanup to detect and remove unwanted software. We worked with IT security company ESET to combine their detection engine with Chrome’s sandbox technology.” Google announced in a blog post. “We can now detect and remove more unwanted software than ever before, meaning more people can benefit from Chrome Cleanup. Note this new sandboxed engine is not a general-purpose antivirus—it only removes software that doesn’t comply with our unwanted software policy.”
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – Google Advanced Protection, authentication)
[adrotate banner=”5″]
[adrotate banner=”13″]
