5 ms·
Declaring U2F "phish-proof" seems premature at best. It is certainly much better than other existing options, but I wouldn't suspect it to stand up very long at
by Phlarp 8y ago
Declaring U2F "phish-proof" seems premature at best. It is certainly much better than other existing options, but I wouldn't suspect it to stand up very long at all against a nation state adversary. Feels very much like "air-gapped networks can't be actively infiltrated" before Stuxnet.
- my_first_acct 8y agoYou are right, of course. I have corrected the parent comment.
- Phlarp 8y agoA commenter above even provides a source for a novel U2F phishing attack, although it appears to rely exclusively on bugs in the chrome webUSB feature and is likely already patched. This argument does quickly devolve though; if an advanced persistent threat is taking an active interest in you the only technique that is even close to effective is to cut out as much technology as possible; Bin Laden or Unabomber style