 I usually carry mine on a key chain. So, I hope you guys notice this resource in your participant kit. And this key is essentially a security key that can be used to log into your computer to any website. It is a fairly versatile key. It does a lot of things. And it is mostly used for two factor auth. So, if you are used to factor auth you know what I am talking about. If you are a serious user of two factor auth like me, you will have a lot of things registered on your phone. These things are first of all a pain to find. You know I have so many services registered that I have to look around and see which one do I want to use right now. And one of the major disadvantages of two factor keys is they are vulnerable to phishing attacks. When you type in a two factor code, how do you know you are typing it into the website where it belongs? If it is in the browser you can see the URL. If it is an embedded app, can you see the URL? You can't. And this key was specifically designed to get around the problem because this is the key that only works if your browser supports it. At the moment only browser that supports it is Chrome. Others are getting support soon. So, just to make sure I have pages loaded. I just loaded all of them before it getting on stage here. This is the product website for the Ubiqui thing. It is designed by something called the Fido Alliance. Fido makes multiple standards for security. The specific standard we are looking at is called the U2F standard. Now the Ubiqui itself predates Fido. So, it has got a lot more functionality than what Fido demands. You get this app called the Ubiqui Manager which shows you what functionality this device is capable of. Sorry it is a little small there, but essentially the more it supports it has got three different features. It has got an OTP feature, a CCID feature and a U2F feature. I will show you some of these things one by one. The OTP thing is the oldest functionality. It is essentially where the company comes from. Most of you will not be using this regularly, although you can if you want to. CCID is something little more complicated. I will get to it. U2F is the standard that you need. Now, what you have got here is to start using this. If you are using Google, you can do this. Go to your account settings. If you go to my account, you get to this page. Get down into sign-in and security. It will come back. It does not like this page. Once you get into sign-in and security, two-step verification where you turn it on. Get into this area. You get either support for the authenticator app or you can use the security key. This is where you do this. You plug this in and add it as a security key. I already added mine. You can do this on GitHub as well. On the GitHub website, go to your account settings. Under settings, you will have security. Under security, you will have two-factor authentication. Once you enable this, you get to add security keys here. It is fairly simple. You plug this in, give it a name, put in the key, and you tap the button. Now, I am going to show you how it works. I have here an incognito window. I am going to try logging back into Google. What I will do is select my account, say, Next. Hopefully, the Internet works and it does. You set your password as usual. The next thing that is going to ask you is, could you please now put in your security key to confirm that this account belongs to you? Normally, you would get it two-factor authentication code pop-up out here. In this case, it does both. Just so that you can see this again, let's put this on screen. What I am going to do is plug this into my USB port. As you can see, it lights up once it happens. There is a little blinking there. I just have to tap this once. Oops, it timed out. Let's get that page back again. While it is happening, let's try GitHub. GitHub gives you the same prompt. Like everybody else, I also save my password, which makes my browser completely insecure, but because I have a key, I can do this. There you go. Two-factor auth done. No code required. Same thing here. Press this once, and it locks me in. Hopefully, this page is not timed out again. It looks like Google's timed out. This is as simple as this. You know, just plug it in, tap it once with your finger, and you're on. The part that gets interesting is the CCID mode that I just described. How many of you use GPG? What do you use GPG for? Do you sign keys? Do you sign packages when you release them? This device supports GPG. It lets you put a GPG private key on the device. Now, the one that you've got is the more advanced version. It's capable of supporting 4086 bit keys. The one that I have here is the last generation. It's only 2048 bit keys. So, to give you an example of how this works, if I do GPG2, it's going to tell me that it's got an error because you can't find a card. I just have to plug this in. Since I've already set it up, when I do this, it's going to tell me that it's found a card. It's got keys on them. These are the secret keys that are on the device. They're not on my computer. So, you steal my laptop. You're not going to get my GPG key. It's only on the device. The device is right only. You can't read a key back from it. All encryption happens on the device. So, I just made a simple file here to show you how to do this. It's just a simple text message. You want to sign this. You're going to say ASCII armor, signature, hello.txt. I'm going to get a prompt for the pin. This is the pin that you store on the device saying that this is what you're going to use as a short code for typing out stuff. And there you go. I have a signature signed by the key, not by my computer. So, obviously, I take this off. All of this stuff stops working. So, what you've got here now is something that behaves like an actual key in the sense that the computation is happening on this device. One of the common things that happens when you use USB-based security is that as some of you may know, USB is dangerously insecure because USB firmware can be overwritten on most devices. USB firmware also runs on your computer when you plug it in and it's capable of crashing your computer if you have bad firmware. There's bad USB that's well known exploit. One of the things that Ubiqui is designed to ensure this does not happen is that they are read-only. The firmware on the Ubiqui cannot be replaced. It cannot be upgraded. It is essentially just burned into the chip. The GPG part of this thing is write-only. You can write a key into it. You can't read it back from it. The security is designed to ensure that you can never get data off the device. And the Fido U2 of Standard is something that comes in from the browser. So, in fact, you can find this in the Can I Use page. It's called U2 of Standard. Right now Chrome is only one to support it. Microsoft Edge will support it in the next one or two versions. Firefox intends to support it. They have a ticket open for it. It's not clear when they will do it. Safari at the point has no plans. But Chrome has full support and Chrome for Android also is getting support. In fact, Chrome for Android also supports the wireless version of U2F. So, obviously, you don't have a USB port on a phone. But you do get the wireless standard. And this particular key happens to be the wireless key. It's got a different icon. I don't know if you can see that. Let's see if we can get it focused. You can see something that looks like the one on Wi-Fi icon. That's because this is the NFC version of the key. It can be used with the phone as well. So, you just have to type it on the back of an NFC-enabled phone and you log in. Just like you would if you're using an authenticated code. So, I hope you enjoy your devices. And I hope you enjoy better security. So, please use them. Set up all your accounts with this. Google supports it. GitHub supports it. Dropbox supports it. These are the things you most likely use. So, set them up there. Make sure your accounts are secure. Thank you.