2 ms·
If I show you an impostor website purporting to be Gmail, and get you to type in your password plus authenticator code / SMS code / app notification code, I can
by idlewords 8y ago
If I show you an impostor website purporting to be Gmail, and get you to type in your password plus authenticator code / SMS code / app notification code, I can get into your email account.
If I do the same and your second factor is a security key, I get a useless binary blob that I can't turn around and hand to Google.
The U2F key gets the actual URL of the page you are on from the browser, so it can't be fooled by impostor websites, however clever. That's the difference, and the reason that Google moved their employees onto security keys. Too many people were getting phished otherwise.
- craftyguy 8y ago> so it can't be fooled by impostor websites, however clever Can't this be defeated by DNS poisoning? TLS/HSTS would help, but that assume folks are verifying that the hostname matches the cert... (big assumption) In any case, I see your point, thank you for explaining it.
- tptacek 8y agoYou don't have to verify that your hostname matches the cert. The browser does that for you. That's part of the point.
- craftyguy 8y agoNot all browsers do that, and many major ones display a warning that users have been trained to click through because of at least a decade of similar browser warnings.
- mcpherrinm 8y agoWhat browsers do not?
- idlewords 8y agoI believe there's an additional moving part in the U2F standard (channel ID) that is supposed to mitigate even if someone with a valid cert hijacks the session. But I don't believe it's implemented, and I defer to greater nerds to describe it.