3 ms·

ELI5 why these are unphishable?

Tomte 9y ago
In phishing, bad guys lure users to site B while users believe they are at site A. Users enter their credentials and game over. The important point is that users are deceived, but not the web browser. The browser knows perfectly well, that the URL is amazon.com.something.com, the problem is that it has no expectation which URL is the one the user has in mind. With a U2F key it's the same scenario. But the browser tells the key "this is for amazon.com.something.com" the key incorporates that into it's cryptographic input, so it's "bound" to that URL. Later the bad guy presents the key's output to amazon.com, and now the server has an expectation that's not fulfilled: "I'm sorry, that's not for me".
- pmoriarty 9y ago
  What happens if the attacker spoofs DNS? Also, the scheme you describe requires the user to trust the web browser. But, if the web browser is, say, on a public computer, it can't necessarily be trusted.
  - Tomte 9y ago
    a) Please describe in more detail. As long as the initial setup was with the true web site I don't see how DNS spoofing might play into it. b) Right. Perfect is the enemy of good.
  - pfg 9y ago
    > What happens if the attacker spoofs DNS? They would also have to get a publicly-trusted TLS certificate for that domain. U2F is HTTPS-only, at least on Chrome. If the attacker can do that, you have bigger problems. > Also, the scheme you describe requires the user to trust the web browser. But, if the web browser is, say, on a public computer, it can't necessarily be trusted. No one has really solved secure authentication on a compromised system. I dare say it's not a problem that can be solved.
    - StavrosK 9y ago
      Can you reuse tokens, or use previous ones? It seems that, even if the browser were compromised, the key should still be safe, as the user has to use one response to log in. If the response can't be reused, and the challenge can't be reused to generate a new response, the user should be safe, no? Basically, if the site sends a random nonce to sign, I don't see how you can reuse things. The most you can do is have the browser sneakily and remotely authenticate you on your computer (if you're the attacker), but the user still needs to press the button.
      - pfg 9y ago
        I think you're making this too complicated, unless I'm missing something. If your system is compromised, the attacker can steal your session key (from your cookies or whatever else the site uses). That's just about as good as your U2F key, with some defense-in-depth exceptions that I mentioned here[1]. [1]: https://news.ycombinator.com/item?id=15044826 https://news.ycombinator.com/item?id=15044826
        StavrosK 9y ago
        It is, but it doesn't mean the U2F key is compromised, that's what I was wondering.
        pfg 9y ago
        Ah, yes. The key would not be compromised and U2F is safe against replay attacks.
toast0 9y ago
Interactions with the device include the site domain (as determined by the browser). If you're browsing google.com.totallynotaphishingsite.example.org, the device won't use your Google.com enrolled key to auth, because the domain doesn't match. It's not impossible to get a phishing site on the same domain as the real site, but that requires a site security error, or active mitm with a improper cert. A much higher bar than simply tricking users.

In phishing, bad guys lure users to site B while users believe they are at site A. Users enter their credentials and game over. The important point is that users are deceived, but not the web browser. The browser knows perfectly well, that the URL is amazon.com.something.com, the problem is that it has no expectation which URL is the one the user has in mind. With a U2F key it's the same scenario. But the browser tells the key "this is for amazon.com.something.com" the key incorporates that into it's cryptographic input, so it's "bound" to that URL. Later the bad guy presents the key's output to amazon.com, and now the server has an expectation that's not fulfilled: "I'm sorry, that's not for me".

pmoriarty 9y ago
What happens if the attacker spoofs DNS? Also, the scheme you describe requires the user to trust the web browser. But, if the web browser is, say, on a public computer, it can't necessarily be trusted.
- Tomte 9y ago
  a) Please describe in more detail. As long as the initial setup was with the true web site I don't see how DNS spoofing might play into it. b) Right. Perfect is the enemy of good.
- pfg 9y ago
  > What happens if the attacker spoofs DNS? They would also have to get a publicly-trusted TLS certificate for that domain. U2F is HTTPS-only, at least on Chrome. If the attacker can do that, you have bigger problems. > Also, the scheme you describe requires the user to trust the web browser. But, if the web browser is, say, on a public computer, it can't necessarily be trusted. No one has really solved secure authentication on a compromised system. I dare say it's not a problem that can be solved.
  - StavrosK 9y ago
    Can you reuse tokens, or use previous ones? It seems that, even if the browser were compromised, the key should still be safe, as the user has to use one response to log in. If the response can't be reused, and the challenge can't be reused to generate a new response, the user should be safe, no? Basically, if the site sends a random nonce to sign, I don't see how you can reuse things. The most you can do is have the browser sneakily and remotely authenticate you on your computer (if you're the attacker), but the user still needs to press the button.
    - pfg 9y ago
      I think you're making this too complicated, unless I'm missing something. If your system is compromised, the attacker can steal your session key (from your cookies or whatever else the site uses). That's just about as good as your U2F key, with some defense-in-depth exceptions that I mentioned here[1]. [1]: https://news.ycombinator.com/item?id=15044826 https://news.ycombinator.com/item?id=15044826
      - StavrosK 9y ago
        It is, but it doesn't mean the U2F key is compromised, that's what I was wondering.
        pfg 9y ago
        Ah, yes. The key would not be compromised and U2F is safe against replay attacks.

toast0 9y ago

Interactions with the device include the site domain (as determined by the browser). If you're browsing google.com.totallynotaphishingsite.example.org, the device won't use your Google.com enrolled key to auth, because the domain doesn't match. It's not impossible to get a phishing site on the same domain as the real site, but that requires a site security error, or active mitm with a improper cert. A much higher bar than simply tricking users.