4 ms·
First of all, if two people log in at once, the system knows something's wrong. Second, how is your attack more likely to succeed from the passive attack? In yo
by ikeboy 11y ago
First of all, if two people log in at once, the system knows something's wrong. Second, how is your attack more likely to succeed from the passive attack? In yours, I know you're connecting to Facebook, I log in and use your sound. Without a broadcast sound, you're not connecting to Facebook at all, I'm just next to you. It seems to me that you'd need strictly more things to go right in the broadcast sound attack.
Whatever you have then, you can use to succeed in the regular attack. Where is the narrowing of the threat model?
The only thing I can think of is that the actual information of a log in is leaked, without it being exploitable because they don't have your password. This doesn't seem very useful by itself especially considering that they won't know which site you're logging into.
- slg 11y agoThink of it like a traditional two factor authentication except instead of the key being sent discreetly to your phone it is broadcast to everyone around you. They now all have the chance to use that broadcast code in an attempt to login before you. I don't think it's a problem for the average user in the average login scenario. However, it still doesn't mean it isn't a security concern.
- ikeboy 11y ago>They now all have the chance to use that broadcast code in an attempt to login before you. As I said above, by that time, it's too late, because the server should detect multiple logins and disable the code (and hopefully alert you that someone has your password).