3 ms·
U2F literally stands for “Universal 2nd Factor” so it’s not a replacement for passwords (the first factor). They are not comparable. Not using a U2F key makes
by sedatk 8y ago
U2F literally stands for “Universal 2nd Factor” so it’s not a replacement for passwords (the first factor). They are not comparable.
Not using a U2F key makes you susceptible to phishing attacks.
- snarf21 8y agoCan't you still be vulnerable to a MITM phishing attack?
- rejberg 8y agoWhat do you mean by a MITM phishing attack? U2F credentials are tied to a particular domain, and so do not rely on the user making sure they are on the correct website. As such, they are not susceptible to typical credential phishing attacks.
- snarf21 8y agoThings like this: https://security.stackexchange.com/questions/157756/mitm-attacks-on-fido-uaf-and-u2f https://security.stackexchange.com/questions/157756/mitm-att... This is assuming an owned machine. Not the easiest attack but still possible. Obviously things like Google Authenticator (while good) are even more susceptible to MITM phishing.
- scrollaway 8y agoIf the machine is owned it's trivial to dig the cookie jar once you're logged in.
- rthille 8y agoU2F is supposed to be immune to MITM because of the information sent in the protocol, protected by the encryption. I'm not familiar enough with it to know if it's really immune or not.