Do they just fit in your USB drive because they don't look like they are USB?

I'm confused. I just searched for "U2F" and that hasn't helped much.

Does any step in this process require the use of a USB flash drive / memory stick?

Aren't ALL current USB flash drives now inherently insecure AND non-patchable?

[pcworld.com ]

In the blogspot article linked to above, in the second paragraph...

Today we're adding even stronger protection for particularly security-sensitive individuals. Security Key [support.google.com] is a physical USB second factor that only works after verifying the login site is truly a Google website, not a fake site pretending to be Google. Rather than typing a code, just insert Security Key into your computer's USB port and tap it when prompted in Chrome. When you sign into your Google Account using Chrome and Security Key, you can be sure that the cryptographic signature cannot be phished.

...the phrase "security key" links to this Google Support article...

Using Security Key for 2-Step Verification
https://support.google.com/accounts/answer/6103523 [support.google.com]

Down at the bottom of the Support page, in the last paragraph, there's a link to an Amazon page that sells the keys...

How do I get a Security Key?
You can use any device compliant with the open standard called "FIDO Universal 2nd Factor (U2F)". Look for this logo *fido*.

You can find Security Key (FIDO U2F) devices available for sale here.

"available for sale here" links to an Amazon page currently offering four choices, ranging in price from $5.99 to $60.00. Not sure why there's such a difference in price. Maybe the cheap ones fail more often. The devices (two of which are described as "FIDO U2F Security Key") appear to be smaller and more easily lost than a standard USB stick, but not (yet) the kind of thing like an iPhone that someone would rob you for. ;)

Currently don't have time to check out the standard. I gather that if you're not on a mobile phone and are running Chrome, these sticks might be good choices.

I know that with safe-deposit box keys, I always like to have two keys. Not sure in this case that you can get duplicates. I suspect they're secure because they're not rewritable.

Interesting YubiKey has had this for years. I wonder why they didn't just use that as it has a long and AFAIK good security history.

For people saying "BadUSB" the Yubikey at least is a piece of embedded software that locks down what the key can do. You can't put a file on a Yubikey. I assume this is the same.

The Achilles heel in these solutions for me is that with the poor cell phone reception in my area (and thus the inability to receive text messages with verification codes) and the lack of a USB slot on cell phones and tablets, I am always worried about getting locked out of those devices.

Yubikey has a key that works wirelessly but only with a tiny number of phones that support the standard.

That's my big obstacle to 2-factor authentication

ogletree - you have to fold it to make it the right form factor

[sk.plug-up.com...]

...you have to fold it to make it the right form factor

[sk.plug-up.com...]

(Solid, rugged construction of the Key guarantees secure and trouble-free access
to your valuable data for the life of your online accounts.)