It’s the Digital Security Training team at Freedom of the Press Foundation (FPF), with security news that keeps you, your sources, and your devices safe. If someone has shared this newsletter with you, please subscribe here.

In the news

• If you’ve ever logged into a bank account on your phone or computer, you were probably told to enter a short code into the app that was sent to your phone so that you can prove you are the rightful account holder. Congrats, you just used two-factor authentication (2FA)! 2FA is great because it helps harden your account security. But the strongest such option commonly available today depends on a piece of hardware, a security key — a little device you can plug into your USB port to help log in.
• A few days ago The New York Times’ Wirecutter shared its new recommendations on security keys. Wirecutter’s top picks included two kinds of models of Yubico’s popular YubiKey, both of which support connections to your devices through USB Type-C and wireless NFC to help log into accounts on your phone or computer. Read the recommendations here.

What you can do

If you’re a journalist or news organization, you are likely at elevated risk of targeted attacks on your professional and personal accounts. This is a great year to finally bite the bullet and try a security key as at least one of your security options. Keep in mind that while authenticating with a security key is one of the strongest options for account security available, it’s not universally supported. So we recommend journalists also enable 2FA and then opt for security keys wherever possible. Check out our guide to comparing 2FA options and how to set them up.

• Want to learn more about the physical durability of security keys? My colleague David Huerta put them through a number of tests to see how a variety of security key brands held up — including running over them with a car. Spoiler: Some lived! (Side note: We did it before Wirecutter.) Read our blog post about the durability of security keys.
  
• You can also use password-free logins with certain types of security keys, allowing you to log into your account by simply inserting your security key into your USB port and tapping the security key’s button. Read our guide to setting up passkeys.
  
• If you have extra money, consider getting a second security key as a backup in case you lose the first. If you choose not to get the second key, that’s OK too. Regardless, when setting up your two-factor authentication, you’ll need to save “backup codes” — an emergency code you can use to reenter your account in case you lose your authentication device.

Updates from my team

• Our digital security training team's fearless leader, Harlo Holmes, will be at this year's FOSDEM 2024. She’ll be at Open Source Symposium Day, where she'll be speaking about the sustainability of open source tools journalists depend on. Likewise, my colleague Saptak S will also be in attendance to give a talk on OnionShare, an open source tool for securely sharing files. We’ll share more details on their upcoming talks and the event soon. If you'll be in Brussels, Belgium, between Feb. 2-4, come say hi!

We are always ready to assist journalists with digital security concerns. Reach out here, and stay safe and secure out there.

Best,
Martin