Provos: Google cannot offer mandatory hardware security key protection to billions
Niels Provos · a16z Podcast | The State of Security · Jan 2, 2019 · at 11:08
Niels Provos, Google Distinguished Engineer, discusses the scaling constraints of enforcing physical security keys across Google's global user base.
0:00 / 0:11exact quote · 11.7s
▶ Watch the full episode on YouTube → 720p mp4 · rendered on demand · StarZero watermark
“Google rolled out this advanced protection program where you are forced to associate a security key with your account. That's the only way that you can get into your account. But that is not something that we can offer to billions of users.”
quote is from the automated transcript, cleaned for reading: filler sounds and stutters are removed, nothing is rephrased. names can be misheard (the analysis reads context, assessments check outside sources). how →
More from Niels Provos
Niels Provos: Computer security is an incentive problem, not a tech problem
“It's probably not really a technology problem, it's an incentive problem.”
Provos: Google experienced zero successful employee phishing attacks after mandating hardware keys
“We have mandated a hardware second factor for everybody at Google since 2009. You know, everybody is using a security key nowadays. We have not had a single successful phishing attack against a Google employee since then.”
Provos: Everyone will rely on managed cloud providers for security by 2028
“In 10 years, everybody is going to be on a professionally run cloud that takes care of all of your security needs.”
Niels Provos: Chromebooks with security keys create uncompromisable endpoints
“I continue to be a big proponent of something like a Chromebook with a security key, right? Essentially, you have an endpoint that cannot be compromised, even if you try. Because the weak point in all of this continues to be the human.”