3 ms·

I may be mistaken (and I'm sure someone will point out if I am) but I think most hardware U2F tokens require you to physically press something on the token to v

I may be mistaken (and I'm sure someone will point out if I am) but I think most hardware U2F tokens require you to physically press something on the token to validate that it should pass over your keys. The soft U2F solution presented here still prompts you, but it is easier to imagine the software being modified/owned on a compromised machine than then hardware token being hacked in such a way as to hand over the keys without a physical press.

mastahyeti 9y ago
From my testing of several hardware U2F implementations, the test-of-user-presence (touching the button) unlocks the device for an amount of time. During this time multiple authentication/registration will succeed without further user interaction. Even without this behavior though, hardware tokens don't indicate which site your authenticating with. Malware could just make an authentication request right as some user action triggers a legitimate authentication request.
ptoomey3 9y ago
Once you have malicious software running it is largely game over. Sure, the hardware token can require a press..but once pressed what challenge is being signed? Malware can just wait and send a challenge for Site A when you are actually trying to sign into site B. Or, the malware can just wait until you login and steal your browser cookies. Oh, also, Soft U2F can require a similar physical touch if you have a mac with Touch ID.
- tscs37 9y ago
  Atleast for my u2f token, I'm being shown the site I'm signing for on a hardware screen.
  - mastahyeti 9y ago
    Which device are you using? With U2F, the browser doesn't send the name of the site to the authenticator.
    - tscs37 9y ago
      I'm using Trezor, I believe it has been preloaded with certain websites so it knows Github and Google and the likes. It also shows parts of the public key (or so I believe, it is a unique identifier) per website.

mastahyeti 9y ago

From my testing of several hardware U2F implementations, the test-of-user-presence (touching the button) unlocks the device for an amount of time. During this time multiple authentication/registration will succeed without further user interaction. Even without this behavior though, hardware tokens don't indicate which site your authenticating with. Malware could just make an authentication request right as some user action triggers a legitimate authentication request.

ptoomey3 9y ago

Once you have malicious software running it is largely game over. Sure, the hardware token can require a press..but once pressed what challenge is being signed? Malware can just wait and send a challenge for Site A when you are actually trying to sign into site B. Or, the malware can just wait until you login and steal your browser cookies. Oh, also, Soft U2F can require a similar physical touch if you have a mac with Touch ID.

tscs37 9y ago
Atleast for my u2f token, I'm being shown the site I'm signing for on a hardware screen.
- mastahyeti 9y ago
  Which device are you using? With U2F, the browser doesn't send the name of the site to the authenticator.
  - tscs37 9y ago
    I'm using Trezor, I believe it has been preloaded with certain websites so it knows Github and Google and the likes. It also shows parts of the public key (or so I believe, it is a unique identifier) per website.