SpaceX's Starlink Is Using Hardware Security Keys to Fend Off Hacks

To fend off hacking attempts, Starlink says it’s been protecting internal access to the satellite internet system with hardware-based security keys , a stronger alternative to passwords and standard multi-factor authentication.

SpaceX mentioned security keys on a new Starlink web page that offers a glimpse into the satellite internet system's security practices. The keys use a USB device to store a private authentication key to complete the login process, thereby ditching digital-only passwords or passcodes that a hacker can steal. It’s why security keys are recommended as the strongest method to protect your online accounts, since they can resist phishing attacks via emails, text messages, or fake websites designed to steal your login credentials.

In SpaceX’s case, the company wrote: “Starlink follows a least-privilege model with role-based access controls (RBAC) and separation of duties. Access to Starlink systems requires multi-factor authentication , including hardware security keys. All access is regularly reviewed and revoked when no longer needed.”

The company appears to have published the page to reassure enterprise customers Starlink’s security and reliability, according to Tim Belfall, director at UK-based Starlink installer Westend WiFi, who noticed that SpaceX published enterprise-focused web pages .

“The Starlink network will be under constant attack and probing, so Starlink's Security Operation Centre (SOC) will be particularly active,” Belfall wrote on . In particular, both Russia and Iran have repeatedly flagged Starlink as a major threat since it's been aiding Ukraine and helping local Iranians bypass internet censorship.

SpaceX didn’t immediately respond to a request for . But a company job posting for an information security analyst position mentions needing to support and maintain YubiKeys , a popular brand of security keys. The security stance isn't surprising given that SpaceX also contracts with the US government and military. Other major companies, including Google, have also been giving security keys to their employees to prevent hackers from successfully phishing them. T-Mobile bought over 200,000 security keys.

In 2022, internet infrastructure provider Cloudflare also said that the use of security keys had foiled a phishing attempt that tricked a few employees into entering their passwords into a fake login form. “While the attacker attempted to log in to our systems with the compromised username and password credentials, they could not get past the hard key requirement,” Cloudflare said at the time.

The new web page includes an “overview of the standards, frameworks, and regulatory requirements Starlink has adopted to meet Enterprise expectations for cybersecurity and data protection.” Consumers can also buy security keys, which start at around $30, to protect their online accounts. But another free alternative is to use passkeys , a similar technology that's also resistant to phishing attacks.