> A Man-in-the-Middle attack is possible, however. Which is exactly what I'm talking about. > a device that is entirely separate from your computer I'm speak

> A Man-in-the-Middle attack is possible, however. Which is exactly what I'm talking about. > a device that is entirely separate from your computer I'm speaking about the first authenticator type in the spec, which are embedded authenticators. As we've been talking, I didn't realize (until now) that the U2F you were talking about was a physical device (rather than just a standard). The kind of computer lay people we're trying to protect won't actually carry these things around (think back to RSA - most of my programmer peers were reluctant o deal with one of these things). My understanding is that this will be primarily used as an embedded service. > I don't think you understand what a challenge even is, if you think "listening" to it helps at all. My mistake. I assumed this was similar to the password protecting my private key. If private keys (in the embedded authenticator) are not password protected, then we've just introduce yet another security flaw.