What is U2F?

Strong 2nd factor authentication, using public key crypto and with native support in the browser (starting with Chrome). Protects against phishing, session hijacking, man in the middle, and malware attacks.

Works out-of-the-box, enabling instant authentication to any number of services. No codes to re-type and no drivers to install.

Allows users to choose, own and control their secure online identity. Each user can also choose to have multiple identities, including anonymous (no personal information associated with the identity). A U2F device generates a new pair of keys for every service, the public key is only stored on the specific service it connects to. With this approach no secrets are shared among service providers, and even low-cost U2F devices can support any number of services.

Designed for existing phones and computers, for many authentication modalities (keychain devices, mobile phone, fingerprint reader, etc.) and with different communication methods (USB, NFC, Bluetooth).

Open standard backed by leading Internet and financial services, including Google, Bank of America and 170 companies in the FIDO Alliance. U2F allows every service provider to be their own identity provider, or optionally let users authenticate through a federated service provider.

Yubico was the first to provide U2F devices, but users can today choose from a range of low-cost devices from multiple vendors, available at Amazon and other retail stores worldwide. Yubico offer free and open source server software for back-end integration.

Users are recommended to register at least two U2F devices with every service provider, which may optionally also provide the user with a backup code should a U2F device be misplaced.