OpenAI Dumps Passwords for Hack-Proof Keys

OpenAI has launched an "Advanced Account Security" mode for ChatGPT and Codex users, moving away from traditional password-based logins. This new opt-in feature enhances account protection by requiring hardware security keys or software-based passkeys for access. It is specifically designed for individuals, such as government officials and activists, who face a heightened risk of sophisticated cyberattacks.

The advanced security mode effectively thwarts phishing attempts, password guessing, and SIM swap attacks by disabling conventional email and password logins. Instead, users must authenticate using physical security keys or passkeys stored on their devices, which are far more resistant to remote digital hacking.

This initiative draws parallels with Google's Advanced Protection Program, emphasizing a proactive stance against evolving cyber threats. OpenAI states this is not a reaction to a specific breach but a preemptive measure to safeguard sensitive user data, including personal chats and confidential work projects.

Enrollment in Advanced Account Security mandates the use of at least two security factors for account recovery, typically two hardware keys or a combination of a hardware key and a passkey. Users also receive backup recovery keys, which are crucial for regaining access if primary authentication methods are lost. Sign-in sessions are also shortened to minimize exposure risks, requiring more frequent logins.