2 ms·
In general you are right about U2F, it's really much better than e.g. TOTP. But even U2F can be phished: https://www.wired.com/story/chrome-yubikey-phishing-web
by est31 8y ago
In general you are right about U2F, it's really much better than e.g. TOTP. But even U2F can be phished: https://www.wired.com/story/chrome-yubikey-phishing-webusb/ https://www.wired.com/story/chrome-yubikey-phishing-webusb/
- viraptor 8y agoI wouldn't say this is really a u2f problem. It's a "you mounted your secure lock with screws accessible from outside, so your lock security is irrelevant" situation.
- Phlarp 8y agoIf a single large vendor has ~30% market share and automatically installs locks for people with screws accessible from the outside surely it's a security issue of _some_ type for services that rely on those secure locks being installed properly. I agree it's google's problem and not FIDOs but it still affects the applied security of their devices. Any security solution is only as strong as the weakest link and needs to be evaluated on an end-to-end basis. A secure lock with properly installed screws is surely useless if installed on a screen door, or a window is habitually left open near the secure lock door, or keys to the secure lock with the address and PIN number written on them left in public places.
- Buge 8y agoThe phrase "can be phished" seems inaccurate, because that Chrome vulnerability has been fixed. https://bugs.chromium.org/p/chromium/issues/detail?id=818592 https://bugs.chromium.org/p/chromium/issues/detail?id=818592