We are pleased to announce that 2FA via Security Keys is now available as a 2-Step Verification method on Web browsers. Security keys are some of the most secure second-factor methods. To start using Security Keys, you’ll need to enable Authenticator 2FA.
This feature adds an additional layer of protection to your account which will better protect it from unauthorized access even when someone knows your password. When you attempt to log in, you’ll have the option to verify your login via a physical security key or any FIDO2-compliant method (like FaceID or fingerprint scanners).
What are Security Keys?
A Security Key is any authentication device that implements the FIDO2 standard. This can be a physical, USB-based key such as a YubiKey or a system managed by your device hardware like biometric authentication. The types of security keys available to you will depend on your Web browser and operating system.
Why do I need to enable Authenticator to use Security Keys?
Security keys are currently only supported on Web browsers. Additionally, the type of Security Key that you choose to set up on one device or browser may not be supported on every device that you try to log in with. Because of this, security keys are presented as a secondary method so that you always have the ability to pass 2FA on a broader set of platforms.
When will Security Keys be available on all platforms?
We plan to provide support for all platforms aside from Xbox during 2023. Xbox will not directly support Security Keys, but you will be able to use Cross-Device Login to access your account from Xbox if the 2-Step Verification is required.
I was about to bump an old topic on this, and to my absolute surprise it turned out this post has been published just minutes ago. Thank you for giving us another layer of security, really looking forward to this!
I’m not sure of the details security wise how this compares to authenticator, as I’m able to use my phone as a built-in security key, like if this is specifically not tied to my phone number so sim swapping isn’t likely an issue? Tried it, it works nicely (no more numbers each time!) and I can use my authenticator as a side option too which is nice in the event I have issues with this.
Your phone’s security key shouldn’t be associated with your phone’s SIM. However, I do suggest you look up how your phone works with the Webauthn standard.
I absolutely love this, it’s something should have been here ages ago but I’m glad it here now. If you have the ability to use it, you absolutely should.
However I do have some concerns over wording:
Classifying both auth app and U2F as “very secure” doesn’t feel like the right wording. They are both secure but U2F is an entirely different level of security. Defining email as secure is also very interesting.
It is good that ROBLOX is taking developer security more seriously, an excellent addition which will prevent a much wider range of attacks that covers regular app 2FA’s shortfalls. Thanks ROBLOX!
Awesome update, by a security one of the very secure, like Authenticator those are new security keys and other things devices as such will be great update of layer security.
I know that a few developers have been asking for this for some time and I’ve been wanting to try it out as well. I didn’t really understand how a hardware key could work but it sounds more simple and convenient than I thought, plus I’m really liking the sound of it being more secure than current options. Just better hope that I don’t damage that key and keep it real safe…
