4 ms·
The prime thing U2F mitigates is phishing attacks. You literally cannot be phished with U2F, you try to auth against the wrong domain and you get a different se
by AdamGibbins 8y ago
The prime thing U2F mitigates is phishing attacks. You literally cannot be phished with U2F, you try to auth against the wrong domain and you get a different secret - so they can't then pass that on the backend (i.e. the real site) and login as you.
Sure your TOTP might remain, but you're not using it, so it's not liable to be taken.
- regecks 8y agoConstruct a phishing site that gives some vague error message about being unable to connect to your device, and offer the TOTP fallback. How many people will fall for it? "Literally cannot get phished" is woefully far away, because the phishing-resistant property of U2F has a giant hole in the side of it (fallback factors) and therefore still relies on human vigilance. I do use U2F though, because it is pretty convenient.