Google offers what it calls the Advanced Protection Program for folks who need very tight security and controlled access to their account. People like executives, movie stars, politicians and the like. It uses security keys to validate who you are as a two-factor method. Advanced Protection is probably too much hassle for most of us, but a security key is an awesome little tool. It can do to help secure your Google account, and is also a cover-your-butt backup in case you lose your phone — and the authenticator app you installed on it. They're relatively cheap, easy to set up and can get you into your Google account from any computer anywhere.

We've gone over why using two-factor authentication on your online accounts is a good idea, and showed you how to set it up for your Google account as well as how to get started with Authy if you use more than one phone or computer. But we're not done yet!

What are you talking about? Why do I want one of these things?

A security key is a small plastic key-shaped device you can plug into a USB port on a Computer or use wirelessly. Some of them light up, some have a small touch-sensitive button, and some have both. But they don't really do anything, you just plug them in. At least it looks like they don't do anything.

What you can't see is the tiny chip inside the plastic. When it's powered up by putting it in a USB port or pressing the button to connect wirelessly, a secure token can be read. Software on a computer can get this token and compare it against what it expects and see if the two match. That software can use this result to do "stuff." When you go to log onto your Google account from a computer, the web page code can read one of these keys. If everything matches, you get a green light and can get into your account. If things don't match, you get an error. Everything is encrypted, everything is safe, and no two keys are the same.

A USB key is like plug-and-play account recovery.

It's a "thing you have" that can be used to authenticate who you are. When used in tandem with your username and password, it makes things very difficult for someone pretending to be you on the internet. It makes for a great piece of a 2FA scheme, but it's best to add it as a third authentication method along with the authenticator app on your phone. It's even a good idea to use more than one of them.

Let's say you get on a plane and head out somewhere nice for a week or so. During the commotion at the baggage carousel or the rental car desk, you lose (or someone steals) your carry-on. Inside were your smartphone and your laptop. If you have 2FA set up on your Google account and don't have another computer or phone that's already logged in you have three options.

Find those backup codes Google told you were important to print out and keep safe.

Call Google and work your way through their account recovery process and hope for the best. Also, hope that the information you have on file with Google is correct and you can remember it.

Scream and shout because you now need to make a new account and will lose everything you had before.

The first option is the best one. Those recovery codes are an easy way in, and Google even tells you how important it is to keep track of them. Mine are ... somewhere. The second option can be a crapshoot, and frankly, shouldn't even exist. Google should never give you access to a 2FA protected account if you can't provide both methods of authentication. Knowing your mother's maiden name or the name of your first pet is a ridiculous security challenge, and if I had my phone to take a call and get a code I wouldn't be asking in the first place. And the third option, well, that would suck. None of us want to think about the third option.

If you had a security key (or two) set up on your account you would have a fourth — log in at any computer, and plug your key in when asked. I have two of them — one on my keychain, and one at my house that I won't lose.

How to set up a security key