1

I am checking out Google's Advanced Protection program. I have registered in my Google account two security keys: my phone (a Realme 6) and a yubi key. enter image description here

The advanced protection enrollment, asks me to register two keys (again). enter image description here

I can successfully add the yubi key. enter image description here

However, I have no option to use my phone. It keeps expecting a physical key to connect via USB. enter image description here

The phone's OS is Android 11, so it meets the minimum requirements. Bluetooth is on.

What am I missing?

EDIT:

Following the clue from Robert, it seems Google mentions (in English, German, Spanish, maybe more) that it needs "at least one" hardware key, but in reality needs mandatory two. In Greek version, it says that it needs mandatory two, but one of them can be your phone.

Compare versions:

0

1 Answer 1

1

Please see FAQ of Advanced Protection Program:

Do I need any special hardware or software?

You’ll need to have at least one security key with you when you enroll. You can purchase a Titan Security Key or any key that supports the FIDO® open standard. You’ll also have an opportunity to view recommended keys during enrollment.

So you can't use the FIDO platform authenticator built-in into your Android phone. Also the potential backup keys as displayed in your screenshots seems to allow only TITAN/FIDO hardware token.

Additionally the FAQ mentions:

What’s a security key and how do I get one? How many do I need?

Advanced Protection requires an external physical security key when you sign in to your account on a new device, just as you would have for your house or car. Accounts that require keys are much safer from attacks than accounts that only require a password. Without having your actual key in their possession, hackers are unable to gain access even if they know your password.
You’ll need at least one security key to enroll in Advanced Protection, and we strongly recommend adding a second key as a backup during, or very soon after enrollment.
Types of keys
There are many kinds of external keys. You might plug a USB key into your device, keep a Bluetooth key nearby, or hold an NFC key close to your phone when you sign in.
You can purchase Titan Security Key or any key that supports the FIDO® open standard. You’ll also have an opportunity to view recommended keys during enrollment.

3
  • Yes I've read that. It says "at least ONE", not two. I have one. It's the "Yubi" I mention in the post. Also the Greek version of the FAQ (landing.google.com/advancedprotection/faq/?hl=el) says "Do I need special equipment or software?" - "Yes, you must have two security keys, one of which can be your phone's integrated key."
    – pkExec
    May 27, 2022 at 17:18
  • @pkExec Seems like the Greek version is outdated. On English and German version of the FAQ only hardware keys are mentioned.
    – Robert
    May 27, 2022 at 17:25
  • indeed it seems so. Aren't the rest of the versions (English, German...Spanish seems same) also outdated, since it seems it's not optional (as the text implies) but mandatory to have two hardware security keys?
    – pkExec
    May 27, 2022 at 17:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .