4 ms·
Once you have malicious software running it is largely game over. Sure, the hardware token can require a press..but once pressed what challenge is being signed?
by ptoomey3 9y ago
Once you have malicious software running it is largely game over. Sure, the hardware token can require a press..but once pressed what challenge is being signed? Malware can just wait and send a challenge for Site A when you are actually trying to sign into site B. Or, the malware can just wait until you login and steal your browser cookies. Oh, also, Soft U2F can require a similar physical touch if you have a mac with Touch ID.
- tscs37 9y agoAtleast for my u2f token, I'm being shown the site I'm signing for on a hardware screen.
- mastahyeti 9y agoWhich device are you using? With U2F, the browser doesn't send the name of the site to the authenticator.
- tscs37 9y agoI'm using Trezor, I believe it has been preloaded with certain websites so it knows Github and Google and the likes. It also shows parts of the public key (or so I believe, it is a unique identifier) per website.