3 ms·
But is that trade off worth it? Is the ability to work offline worth giving up a simple prevention of phishing attacks?
by Klathmon 8y ago
But is that trade off worth it? Is the ability to work offline worth giving up a simple prevention of phishing attacks?
- klodolph 8y agoFull circle here, since FIDO U2F has phishing-resistance like push notifications and lets you work offline like TOTP. "Offline" in the sense that everything besides whatever you're authenticating against can be offline.
- closeparen 8y agoPush notifications offer no phishing resistance. The attacker can present a fake login experience and conduct a real login behind the scenes at the same time. If you think you’re logging in, you’ll approve the push for them.
- deleted 8y ago[deleted]