The Strongest Protection for Your Online Accounts? This Little Key
Passwords aren’t enough to fend off hackers; these dongles are the best defense
4 min
Strong passwords are very important, but they’re not enough to protect you from cybercriminals.
Passwords can be leaked or guessed. The key to online security is protecting your account with a strong secondary measure, typically a single-use code. This is referred to as “two-factor authentication,” or 2FA, as the nerds know it.
I’ve written about all the different types of 2FA, such as getting those codes sent via text message or generated in an authenticator app. Having any kind of second factor is better than none at all, but physical security keys—little dongles that you plug into a USB port or tap on your phone during account logins—offer the highest level of protection.
Security keys have been around for over a decade, but now they’re in the spotlight: Apple recently introduced support for them as an optional, added protection for Apple ID accounts. Last month, Twitter removed text-message-based authentication as an option for nonpaying users, recommending instead an authenticator app or security key.
Some people are hesitant to use security keys because carrying around a physical object seems burdensome and they come with a $30-and-up added cost. Plus, what happens if they get lost?
I’ve used security keys since 2016 and think they are actually easier to manage than codes—especially with accounts that don’t require frequent logins. They’re not only convenient, but they can’t be copied or faked by hackers, so they’re safer, too.
Here’s how to weigh the benefits and common concerns of adding one or two of these to your keychain.
Which security key should I use?
Many internet services support the use of security keys, and you can use the same security key to unlock accounts on many different services. I recommend two from industry leader Yubico:
- YubiKey 5C NFC ($US55) if you have a USB-C laptop or tablet
- YubiKey 5 NFC ($US50) for devices with older USB ports
Other options include Google’s Titan security keys ($30 and up). In addition to working with laptops and tablets with USB ports, these keys are compatible with smartphones that have NFC wireless. Most smartphones these days have that, since it’s the technology behind wireless payments such as Apple Pay.
Adam Marrè, chief information security officer at cybersecurity firm Arctic Wolf, recommends that your chosen key is certified by the FIDO Alliance, which governs the standards of these devices.
How do security keys work?
To add a key, look in the security settings of your major accounts (Facebook, Twitter, Google, etc.). During setup, it will prompt you to insert the key into your laptop or tablet’s port or hold the key close to your phone for wireless contact.
Apple requires you to add two security keys to your Apple ID account, in case you lose one.
Typically, when you log in, you just go to the app or website where you’ve set up a key, enter your username and password as usual, then once again insert the key into the device or hold it close. (Some keys have a metal tab you have to press to activate.) At that point, the service should let you right in.
Why are they so secure?
Getting those two-factor login codes via text message is convenient, but if you are someone criminals are targeting, you could be the victim of SIM swapping. That’s where thieves convince carriers to port your number to a new phone in their possession, and they use it along with your stolen password to hack your accounts.
Even if they don’t go to all that trouble, criminals might try to trick you to hand them your codes, by calling you or spoofing a website you typically visit. At that point they can use the code for about 60 seconds to try to break in, said Ryan Noon, chief executive at security firm Material Security.
Security keys protect you in two ways: First, there’s no code to steal, and second, they use a security protocol to verify the website’s domain during login, so they won’t work on fake sites.
You can also add an authenticator app such as Authy to your most important accounts, to use only as a backup. But once you add these secure methods, you should consider removing the text-message code option.
In the rare case that someone snoops your passcode then steals your iPhone, beware: The perpetrator could still make Apple ID account changes using only the passcode, and even remove security keys from your account.
What happens if you lose your key?
The most important rule of security keys is to buy an extra one (or two).
“Think of your security key as you would a house or car key,” said Derek Hanson, Yubico’s vice president of solutions architecture. “It’s always recommended that you have a spare.”
If you lose a security key, remove it from your accounts immediately. You should have already registered your spare or an authenticator app as a backup to use in the meantime.
Where can you use a security key?
Start with your most valuable accounts: Google, Apple, Microsoft, your password manager, your social–media accounts and your government accounts.
When it comes to financial institutions, many banks don’t offer security-key protection as an option, though most leading crypto exchanges do.
What comes after security keys?
Security professionals and tech companies widely agree that passkeys are the future. They’re a new type of software option that combines the high security of a physical key with the convenience of biometrics such as your face or fingerprints. Passkeys are supported across the Android, iOS, Mac and Windows platforms, and some of your favourite sites already let you use them.
You can create a passkey on Facebook in security settings by following the app’s instructions under the security-key option. Dropbox has a similar passkey setup. Once you’re done, you’ll use your face or fingerprint as a second factor, instead of a code or key.
Eventually, physical security keys could be what we keep safe in strong boxes, as backups for our biometric-enabled passkeys. Even then, you’re probably going to want to have spares.
Copyright 2020, Dow Jones & Company, Inc. All Rights Reserved Worldwide. LEARN MORE
From making unpopular decisions to learning when to listen, leaders from five businesses reveal what nobody prepared them for — and how running a company has challenged their expectations.
Technology and semiconductor shares fell sharply as investors questioned the debt financing the AI infrastructure boom and confronted higher rates and Chinese competition.
Elon Musk is exploring a potential merger between Tesla and SpaceX, a deal that could reshape the future of AI, robotics, autonomous vehicles and space technology. With a combined valuation potentially reaching $3.5 trillion, the move could bring Musk’s vision of an interconnected technology ecosystem closer to reality, although a deal remains uncertain.
5 min
Elon Musk has engineered ties between Tesla TSLA 3.41%increase; up pointing triangle and SpaceX SPCX 7.79%increase; up pointing triangle that are hard to break, and now he wants to fuse them together permanently.
Musk has run both Tesla and SpaceX concurrently over the past two decades, using a schedule that dictated which days he spent focused on each business.
The companies have often shared resources and personnel, signaling their close ties. Last year, SpaceX looked into creating a spacesuit for Tesla’s humanoid robot Optimus, a person familiar with the matter said. Tesla last week showed off its new Roadster, a vehicle featuring SpaceX rocket thrusters that it hopes to soon bring to market.
And in recent months, Musk has repositioned both companies by expanding beyond their core operations toward a shared mission centered on artificial intelligence.
The world’s richest man on Tuesday signaled his interest in tying up SpaceX and Tesla, marking what would be the biggest corporate merger of all time. Because he serves as chief executive of SpaceX and Tesla, Musk said committees of independent directors at both companies are evaluating a possible deal, adding that a transaction might not come to fruition.
The committees will likely evaluate, with lawyers and bankers, how each company would fare in a potential deal and how a deal might best be structured. They then present their conclusions to their respective boards, who typically vote on whether to proceed.
“It’s an odd Kabuki dance where two groups of people are talking and I can’t be in the conversation,” Musk told SpaceX investors on Tuesday in response to an analyst’s question about a potential deal.
For Musk, the merger supports his vision of a world full of autonomous cars, humanoid robots and weekly rocket launches, as well as the data centers and satellites required to keep the whole thing running.
Some investors and analysts said they expect a transaction would be structured as an all-stock deal, with SpaceX potentially paying a modest premium for Tesla shares.
SpaceX, which has a market value of about $2 trillion, said it is seeing sharp growth in revenue across its businesses, which include operating data centers, launching rockets and operating satellite networks such as the internet service Starlink. Tesla is valued at about $1.5 trillion and is expanding its operations beyond its automotive and energy business. Shares in both companies traded higher following the news Tuesday.
Musk’s substantial ownership stakes in both companies, along with voting control at SpaceX, has enabled him to set the deal in motion. Analysts and investors said the deal will probably face regulatory scrutiny internationally, though some see Musk’s close relationship with the Trump administration as an asset to getting approval.
Blurred lines
The companies haven’t said which directors are on the special committees evaluating a potential deal. Several SpaceX and Tesla board members have either personal or business ties to Musk. And like Musk, venture capitalist Ira Ehrenpreis sits on both boards.
In a filing this week, Tesla outlined millions of dollars in business agreements with SpaceX and its subsidiaries last year, including $143 million in car sales to SpaceX, $3.3 million in advertising that it bought on the social-media platform X and $430 million in revenue from the sale of Megapack batteries for SpaceX’s data centers.
The companies also split the cost of resources including the use of Musk’s SpaceX jet and the bill for his personal security, which he runs through a private company.
Employees at both companies routinely move between companies to work on special projects, and some executives have dual roles, including Charles Kuehmann, vice president of materials engineering at both SpaceX and Tesla, and Ashok Elluswamy, the vice president of AI software at Tesla who runs a joint venture with SpaceX called Digital Optimus.
Over the years, Musk has launched new startups within his empire, including brain-implant company Neuralink, underground-tunnel developer the Boring Company and xAI, the AI startup that merged with SpaceX in February.
It is that AI business that Musk thinks can serve a market worth tens of trillions of dollars, justifying the need for a merger.
The business case goes like this: Tesla is developing robotaxis and robots, which it calls “physical AI.” SpaceX is working on the back end of physical AI: the data-center capacity and internet connection required for those robotaxis and robots to operate continuously.
“I don’t see what the value of Tesla is if it’s not merged with SpaceX,” said investment adviser Ross Gerber, a former Tesla bull turned critic invested in both companies. “If they don’t merge, the brains of everything that runs Tesla is owned by another company.”
On top of it all, both companies face constraints on the supply chains they need to make this world a reality, particularly when it comes to chips. To address this, Musk earlier this year announced a joint venture between Tesla, SpaceX and Intel to design and manufacture chips in Texas. “The most epic chip-building exercise by far,” he has said.
Musk at the wheel
For Musk, a merger would also solve two problems: demands on his attention and his lack of control at Tesla.
Tesla for years was Musk’s only public company, a status that came with greater scrutiny. There, Musk reports to a public board, as well as individual investors who make up around 30% of Tesla’s voting power, according to FactSet.
The question of Musk’s attention became a particular focus for investors and the board in recent years after he acquired Twitter in 2022 and launched xAI in 2023, and again in 2025 as he spent time in Washington, D.C., running the Department of Government Efficiency in the early months of President Trump’s second term.
As Tesla’s car business suffered in 2025, Musk threatened to take his AI ambitions outside the company if he wasn’t granted 25% voting control. Last November, Tesla shareholders approved a new pay package for Musk, which created a path for him to vastly expand his stake.
As of Sept. 30, Musk owned a roughly 20% stake in Tesla, according to the company’s proxy filing.
The SpaceX IPO gave Musk a different path. When SpaceX went public in June, the deal’s structure enabled him to have more than 80% voting power at the company—so much that he can’t be fired and decisions can’t be made without his support.
If SpaceX acquires Tesla, he will likely stay in control.
As interest rates, inflation and market sentiment fluctuate, investors are being urged to focus on data, not panic.
The completed penthouse at Park Residences showcases a considered approach to luxury apartment living, combining northern light, curated interiors and the privacy of a whole-floor residence.
