The Strongest Protection for Your Online Accounts? This Little Key

Strong passwords are very important, but they’re not enough to protect you from cybercriminals.

Passwords can be leaked or guessed. The key to online security is protecting your account with a strong secondary measure, typically a single-use code. This is referred to as “two-factor authentication,” or 2FA, as the nerds know it.

I’ve written about all the different types of 2FA, such as getting those codes sent via text message or generated in an authenticator app. Having any kind of second factor is better than none at all, but physical security keys—little dongles that you plug into a USB port or tap on your phone during account logins—offer the highest level of protection.

Security keys have been around for over a decade, but now they’re in the spotlight: Apple recently introduced support for them as an optional, added protection for Apple ID accounts. Last month, Twitter removed text-message-based authentication as an option for nonpaying users, recommending instead an authenticator app or security key.

Some people are hesitant to use security keys because carrying around a physical object seems burdensome and they come with a $30-and-up added cost. Plus, what happens if they get lost?

I’ve used security keys since 2016 and think they are actually easier to manage than codes—especially with accounts that don’t require frequent logins. They’re not only convenient, but they can’t be copied or faked by hackers, so they’re safer, too.

Here’s how to weigh the benefits and common concerns of adding one or two of these to your keychain.

Which security key should I use?

Many internet services support the use of security keys, and you can use the same security key to unlock accounts on many different services. I recommend two from industry leader Yubico:

YubiKey 5C NFC ($US55) if you have a USB-C laptop or tablet
YubiKey 5 NFC ($US50) for devices with older USB ports

Other options include Google’s Titan security keys ($30 and up). In addition to working with laptops and tablets with USB ports, these keys are compatible with smartphones that have NFC wireless. Most smartphones these days have that, since it’s the technology behind wireless payments such as Apple Pay.

Adam Marrè, chief information security officer at cybersecurity firm Arctic Wolf, recommends that your chosen key is certified by the FIDO Alliance, which governs the standards of these devices.

How do security keys work?

To add a key, look in the security settings of your major accounts (Facebook, Twitter, Google, etc.). During setup, it will prompt you to insert the key into your laptop or tablet’s port or hold the key close to your phone for wireless contact.

Apple requires you to add two security keys to your Apple ID account, in case you lose one.

Typically, when you log in, you just go to the app or website where you’ve set up a key, enter your username and password as usual, then once again insert the key into the device or hold it close. (Some keys have a metal tab you have to press to activate.) At that point, the service should let you right in.

Why are they so secure?

Getting those two-factor login codes via text message is convenient, but if you are someone criminals are targeting, you could be the victim of SIM swapping. That’s where thieves convince carriers to port your number to a new phone in their possession, and they use it along with your stolen password to hack your accounts.

Even if they don’t go to all that trouble, criminals might try to trick you to hand them your codes, by calling you or spoofing a website you typically visit. At that point they can use the code for about 60 seconds to try to break in, said Ryan Noon, chief executive at security firm Material Security.

Security keys protect you in two ways: First, there’s no code to steal, and second, they use a security protocol to verify the website’s domain during login, so they won’t work on fake sites.

You can also add an authenticator app such as Authy to your most important accounts, to use only as a backup. But once you add these secure methods, you should consider removing the text-message code option.

In the rare case that someone snoops your passcode then steals your iPhone, beware: The perpetrator could still make Apple ID account changes using only the passcode, and even remove security keys from your account.

What happens if you lose your key?

The most important rule of security keys is to buy an extra one (or two).

“Think of your security key as you would a house or car key,” said Derek Hanson, Yubico’s vice president of solutions architecture. “It’s always recommended that you have a spare.”

If you lose a security key, remove it from your accounts immediately. You should have already registered your spare or an authenticator app as a backup to use in the meantime.

Where can you use a security key?

Start with your most valuable accounts: Google, Apple, Microsoft, your password manager, your social–media accounts and your government accounts.

When it comes to financial institutions, many banks don’t offer security-key protection as an option, though most leading crypto exchanges do.

What comes after security keys?

Security professionals and tech companies widely agree that passkeys are the future. They’re a new type of software option that combines the high security of a physical key with the convenience of biometrics such as your face or fingerprints. Passkeys are supported across the Android, iOS, Mac and Windows platforms, and some of your favourite sites already let you use them.

You can create a passkey on Facebook in security settings by following the app’s instructions under the security-key option. Dropbox has a similar passkey setup. Once you’re done, you’ll use your face or fingerprint as a second factor, instead of a code or key.

Eventually, physical security keys could be what we keep safe in strong boxes, as backups for our biometric-enabled passkeys. Even then, you’re probably going to want to have spares.

Administrative cowardice. Rampant cheating. The soaking and scamming of undergrads and grad students. Performative wokeism. Intensifying competition for international tuition dollars from an expansive China.

These are either the latest dire headlines about American higher ed or the myriad subplots of “Lords of Serendipity,” an ambitious new novel by Randy Boyagoda. Unlike most campus fiction, its scope extends well beyond the cloister of the liberal arts classroom to whammy the entire university system, from its financial model to its function within a globalized economy. Along the way, it skewers its lightning-rod targets with a precision too sharp to be considered entirely fictional.

That its author is not only well-versed in satire, having written four other novels in the genre, but is also a professor of English at the University of Toronto and an experienced college administrator, further blurs the lines between comic fiction and brutal fact. It’s the kind of no-holds-barred book only a consummate insider would know to write—but only one who is also conveniently outside the American university system could get away with writing.

“This is someone who’s got the inside dope on what can go on at universities, especially with international students, and what kind of con games are going on,” said Margaret Atwood, a friend and fellow Torontonian.

The novel, like Boyagoda himself, is often very funny—even as the dilemmas its characters face read as tragedy. Its cast includes the bickering members of a Sri Lankan hotel cleaner’s family, insecure American freshmen, dead-end third-tier college professors and their highflying Ivy League counterparts and dispirited university functionaries. An old-fashioned Dickensian tale, it sweeps across continents and campuses, from a classic liberal-arts college to a stand-in for Harvard University to an urban technical school to the dilapidated buildings of a state-run university in Sri Lanka.

“I’m a joyful person,” Boyagoda said in an interview, though he prefers to see his outlook on academia as “hopeful” rather than optimistic. He smiles and laughs frequently. He bikes everywhere. He derives energy from his students and from his four daughters, ages 14 to 20. They help him and his American wife, Anna, also an educator, care for Boyagoda’s father, an immigrant from Sri Lanka who has dementia and lives with the family.

Randy Boyagoda speaks at a panel discussion. — Randy Boyagoda taking part in a panel discussion at the University of Toronto in 2024. Polina Teif/University of Toronto

The germ of the novel came to Boyagoda during the pandemic, when he was serving as a vice-dean. An urban legend was circulating about a statistics grad student selling passing grades to international students. The cheating scheme itself may well have been apocryphal, but it felt tantalizingly plausible.

“As a novelist, it stayed with me,” Boyagoda said. “Who would sell grades for a stats course? Why would someone buy grades? What’s motivating them? Why wouldn’t the university be doing something about it?” What he didn’t want to do, he explained, was write “another novel about a creative writing professor and his drama with students.”

In addition to writing novels—the first of which was a finalist for Canada’s prestigious Giller Prize; he’s written eight books in total—Boyagoda teaches literature full-time. For his students next semester, kids raised in a purportedly “post-literature era,” he’s assigning three 700-page novels, he noted mischievously, books by George Eliot, Ralph Ellison and Kiran Desai.

On RateMyProfessors, students remark on Boyagoda’s heavy assignments, tough grading and distaste for cellphones, but also hail his “comedy.” When alerted to these reviews, Boyagoda laughed. “Guilty as charged,” he said.

“Randy’s one of those people in academia who is very well educated but doesn’t have an ounce of superiority about him,” said John Irving, who frequently guest lectures in Boyagoda’s classroom. “It’s amazing to see how willing students are to talk in his classrooms, how little afraid they feel of being mocked or put down—he gets complete candor out of them.”

Negotiating competing interests seems to come naturally to him. Like many college campuses, after the Oct. 7 Hamas attack on Israel, the University of Toronto was embroiled in protests, encampments and discord; part of the school’s response was to convene a working group on civil discourse. Boyagoda was put in charge, serving for two years. It’s the kind of thankless task many professors would flee from, but Boyagoda relished the prospect and thinks the group, which is ongoing, made progress.

He has since pivoted to another formidable academic concern: the waning prestige of the humanities. In July, Boyagoda became the director of the Jackman Humanities Institute and special advisor on the humanities to the dean of arts and science. This fall, he is starting a series of gatherings he calls the Dead Book Club. (Dead writers feature heavily among his favorites: St. Augustine, Dante, William Faulkner, Evelyn Waugh, Saul Bellow.)

“The goal is to encourage students to read for its own sake and have conversation for its own sake,” Boyagoda said. “The importance of the humanities will be revealed to those who participate.”

Illustration of the book cover for "Lords of Serendipity" by Randy Boyagoda, depicting a woman wearing a hat with various buildings on top, against a blue background with a white airplane.

“Lords of Serendipity,” which publishes next week, reflects Boyagoda’s commitment to the pursuit of knowledge: “I’m supposed to say I learn more from my students than they do from me, but no,” Boyagoda said. “I enjoy sharing my excitement and joy about literature and ideas. There are these moments when you are teaching and you can see someone’s face change because they didn’t know something and then they did. That moment when you’re actually watch someone enlarge themselves is deeply satisfying.”

In literary circles, Boyagoda is often referred to as a Catholic novelist, a description he embraces. “A novelist willing to give shape and voice to contemporary religious experience is needed,” Boyagoda said. “I understand myself as a Catholic novelist, provided that I’m not only a Catholic novelist, I’m also a South Asian novelist and I’m a Canadian novelist. I don’t want to be captive to one label.”

His characters, he said, are subjected to what he calls “Graham Greene character situations.”

“They are trying to do good in a fallen world and realize the most they can do is less harm than someone else would do in that same role,” he explained. “They have to accept they are complicit in something that provides some good thing to others. It’s a very Graham Greene way of thinking about sacrifice.”

The campus green they inhabit is a febrile zone in which lofty ideals and cynicism regularly collide. It’s a place where a traditional holiday college celebration is now an occasion for political protest. Kids freely police one another inside and out of the classroom with social media their constant, ready weapon of choice. International students, knowing their family’s financial futures hinge on their degrees, operate in terror of failure and deportation.

Early readers of the book include Gary Shteyngart and Junot Diaz, both of whom have taught at universities and written comic novels. They each contacted Boyagoda midway through to say, in essence, “You nailed it.”

As biting as “Lords of Serendipity” can be, Boyagoda’s faith in higher education remains undaunted.

“It’s absurd that we live in societies that make the decision to take people between the ages of 18 and 22, when they are most physically capable of contributing to our nations and communities, and tell them, ‘Go away for four years, and read and learn and have conversations,’” he said. “I want students to be aware of what an incredible privilege that is.”

Corrections & Amplifications
Randy Boyagoda is a special advisor on the humanities to the dean of arts and science at the University of Toronto. An earlier version of this article incorrectly said he is a special adviser to the dean of humanities. (Corrected on Sept. 2)