5 ms·
right the point of u2f is the physical token
by jethro_tell 9y ago
right the point of u2f is the physical token
- albertgoeswoof 9y agoSort of - the point of u2f is challenge-response on the key, which is tied to the URI or https session, which makes it impossible to phish without a browser exploit
- vertex-four 9y agoThe "point" of U2F instead of HOTP/TOTP is that the code you send to evilhacker.com can't be used on google.com - so getting a usable token by phishing is impossible. HOTP/TOTP are flawed in that you can send the generated code to evilhacker.com and they can use it to log in to google.com with you being none the wiser.