NewsUpcomingReviewsUnboxingTips & TricksAppsChromebooksChromecastGoogle AssistantAbout

Chrome Unboxed - The Latest Chrome OS News

A Space for All Things Chrome

U2F Two-factor Authentication Coming To Chromebooks

By 14 Comments

by Gabriel Brangers
Filed under:

Whether you’re a power-user or a casual web surfer, most people will agree that security is at or near the top of the list when it comes to computing. U2F or two-factor authentication is one of the ways to add another level of security to your device, applications and password-protected sites you visit.




Manufacturers like Yubico create USB devices for just this purpose. When enabled, a device or chosen login information are inaccessible without the second “layer” of protection. Other forms of this feature can include biometric verification similar to what is found on a growing number of mobile devices. A.K.A., fingerprint sensors.

With built-in U2F support, devices with fingerprint scanners can leverage biometric information to enhance security as well as offer password alternatives for your device. App makers, webmasters and even manufacturers of peripherals can then use the API of the sensor to allow users to utilize U2F options on their platform.




With fingerprint sensors and the increasing abilities of Chrome OS, it appears developers are looking to make U2F a baked-in feature for Chromebooks. Some very recent additions to the Chromium repository gives us a look at the work in progress.

Add U2F implementation

Add the common code to support FIDO U2F (Universal second factor authentication) protocol implementation


When fingerprint sensors finally make their way to Chrome OS this will allow users to access sites, devices and apps with just the swipe of a finger. It is also possible that other functions will be able to trigger two-factor verification. Possibly a keystroke combination or an extension that would perform the same function as the current, physical U2F keys.

Versatility, ease of use and enhanced security. These are all major factors in the success of an operating system and it looks like Google is working hard to make Chrome OS just that.

You can follow along with the development here at Chrome Unboxed. This is an exciting new feature and we look forward to seeing it flesh out.

Source: Chromium repository

  • Daniel

    Any idea how much time is left before fingerprint scanners are fully supported?

    • Gabriel Brangers

      At this point I would think we will see a Chromebook equipped with one before the end of the year. Peripheral fingerprint scanners may never be a thing. Developers are concerned about the security issues that may arise from third party devices.

  • John Doe

    I already have this .. It’s called Google Smart Lock.. As long as I am signed in on my phone and my phone is close by I can just click my login pic to get access to my Chromebook.

    • Daniel

      That isn’t exactly what they are talking about. 2F

      • M.R. Betz

        Smart Lock is U2F.

        Factor 1: the physical object of your smart phone.
        Factor 2: your fingerprint or passcode

        • Daniel

          Smart lock only has one factor, it deactivates the password on your laptop if your phone is unlocked. Hence the term “Smart lock.”

          • M.R. Betz

            Ah, I see what you are saying.

            However, since Chrome OS won’t deactivate the passcode without 2 factors, phone in bluetooth range and said phone also being unlocked via fingerprint or phone passcode, semantically it meets the definition of U2F.

            Don’t forget there are 3 kinds of Google “Smart Lock” (this is Google, why have only one), the Smart Lock for Chrome OS has much stricter rules than Smart Lock for Android and Smart Lock for Chrome.

          • Daniel

            What are the other two kinds of smart lock (I know there’s one for detecting location).

          • M.R. Betz

            Smart Lock for Android and Smart Lock for Chrome (browser).

            The Android one is one that can unlock your phone by location, or via smartwatches and other devices. Not terribly secure, but quite convenient (much like Android itself).

            Smart Lock for Chrome (browser) was previously mostly just a password manager, but now seems to be under heavy development along with the one for Chrome OS, with lots of corporate and security functions being added. Maybe Google will merge them? Nah, that would make too much sense.

          • Daniel

            If Google didn’t make sense, then they wouldn’t be bringing Android apps over to Chrome OS 😉

  • M.R. Betz

    U2F and Yubikeys have worked on Chromebooks and Chrome OS for awhile now (from the very beginning?). I currently use either a Yubikey or Smart Lock to login into my own Chromebook and to access Google’s services, along with a few other programs, like LastPass.

    What this is is a more robust, system wide API with enterprise in mind, baking corporate U2F into the OS and GSuite itself. Probably part of Google’s ramping up of its ongoing assault against MS in the workplace.

  • Matthew Fisch

    The author of this story is confusing U2F with Biometrics. The FIDO Alliance provides no mechanism for U2F integration with biometrics, U2F is always “something you have” and per standards should be a removable and portable token (it will never be integrated in non-physical form).

    UAF also issued by FIDO allows biometrics as a method of authentication, but this has nothing to do with U2F and is not mentioned in Chromium source code anywhere. As far as I know, UAF lacks industry traction whereas U2F has a high level up uptake.

    There are U2F keys from Hypr that require a fingerprint sensor to activate the U2F token, however this is not part of the U2F standard and does not have anything to do with Google adding fingerprint sensors to their devices. The vast majority of U2F keys are fobs with physical or capacitive activation buttons (e.g., Yubikey).

    ps, Yes Google Chrome (and therefore ChromeOS) allows U2F to function (either upon login or U2F servicing website) — hopefully this commit is a signal Google is going to add local U2F authentication (allowing unlocks that require U2F). You can configure the chromebook to logout on close (requiring U2F to login) — but this then means no offline access.

    • Gabriel Brangers

      “It is also possible that other functions will be able to trigger two-factor verification. Possibly a keystroke combination or an extension that would perform the same function as the current, physical U2F keys.” Apologies if I didn’t make the point clear. I completely understand the difference. My point is that the biometric sensors may be one example of activating the U2F.

      • Gabriel Brangers

        Additionally, I may be completely wrong about the application but the U2F is still being added to CrOS.