Your company may already require you to have two-factor authentication turned on, meaning that when you log in with a username and password, you have to enter a second code, usually texted to you or delivered through an app. Google started requiring employees to use physical security keys in early 2017, according to Brian Krebs, the security journalist who first reported Google's success against phishing attempts. 'We have had no reported or confirmed account takeovers since implementing security keys at Google,' Google told Business Insider. None of Google's 85,000 employees had been their work accounts compromised since it started requiring security keys to log in, the company said. And it's all because of a $20 gadget called a security key, which Google requires its employees to use. One company, however, seems to have neutralized the credential phishing problem: Google. You can make sure your computers are as secure as possible, but all it takes is one employee with access to sensitive data who gets fooled by an email to cause a bad breach.

Spearphishing was one of the main ways Russian spies were able to break into the Democratic National Committee's network before the 2016 US election, the Justice Department says. Now there's a good chance that account will be hacked. The victim plugs in their username and password, unwittingly giving it to the attacker. Unsuspecting people click on the link in the phishing email, leading them to a site designed to look legitimate. One of the most common ways that people get hacked is called phishing or spearphishing.īasically, attackers craft an email that looks just like something you'd normally click on, like a bill or an email telling you to change your password.

Google attributes its success to products called security keys, or USB devices that you need in addition to a password to log in to a protected account.

Having credentials stolen from phishing attacks, which use misleading emails to steal passwords, is one of the most common ways people get hacked.

Google told Business Insider that it hasn't had any account takeovers since it started requiring its employees to use security keys to log in.

Account icon An icon in the shape of a person's head and shoulders.

Yubikey for gmail