3 ms·
Could you walk through that threat model? I don't quite get it. In what scenario is an antagonist in control of my (untrusted) browser but not also in control o
by hmahncke 9y ago
Could you walk through that threat model? I don't quite get it. In what scenario is an antagonist in control of my (untrusted) browser but not also in control of my (trusted) laptop? Put another way, doesn't that antagonist always see the 2fa code, and then enter it?
- pfranz 9y agoYour browser doesn't know the laptop is trusted. I'm not aware of any standard API that a browser would use to confirm they're running on a trusted laptop (they'd have to implement an OS specific call for an OS specific feature...which doesn't often happen). In theory Safari could support it (I don't know if it does or doesn't). Apple could push for either a standards body or just Chrome/Firefox to implement macOS APIs--but I don't see any reason those browsers would make the effort.