3 ms·

This is true, but it does prevent replay. So you are vulnerable to an active MITM, but they don't actually acquire any private secrets to be used to create the

This is true, but it does prevent replay. So you are vulnerable to an active MITM, but they don't actually acquire any private secrets to be used to create their own sessions. MITM with passwords OTOH, gives the attacker your password.

amluto 6y ago
That depends on how the site works. On most sites, when I authenticate with WebAuthn (or by any other means), I get a bearer token good for several weeks. So a single spoofed WebAuthn session gets the attacker access for quite a while.