11 ms·
well code which U2f token generate with the help of Google authenticator has ONLY 6 digits. 6 digits that's not extremely hard to brute force is that right ? I
by martinwww 8y ago
well code which U2f token generate with the help of Google authenticator has ONLY 6 digits. 6 digits that's not extremely hard to brute force is that right ?
If you are using additional backup u2f token (2 tokens in total) hacker has chance 1:500 000 to find out correct PIN is my assumption right ?
- tialaramex 8y agoYou seem confused. I think you're describing TOTP, but this whole thread is about FIDO. WebAuthn, U2F and similar FIDO based schemes are sending some public key signed blobs over the network. A PIN is purely a local protection, it's not sent over the wire. So a hacker can't just try guessing the PIN. First they need to steal your physical token, only then could they start guessing PINs for the stolen token.
- emlun 8y agoAnd even then, the token would lock itself down after too many incorrect PIN attemtpts.