39 ms·
Or by using a U2F device, which is designed to prevent spoofing.
by coder543 6y ago
Or by using a U2F device, which is designed to prevent spoofing.
- frei 6y agoU2F doesn't protect you from an untrusted machine, it protects you from untrusted websites. https://security.stackexchange.com/questions/157756/mitm-attacks-on-fido-uaf-and-u2f https://security.stackexchange.com/questions/157756/mitm-att... The security model relies on the browser validating the origin.
- CodesInChaos 6y agoI don't think there is a way around "displaying that purpose on the trusted 2FA device." if you want to protect against a compromised computer. Domain binding protects you from fishing, but still relies on the user's computer, including the browser, being secure. So it doesn't help here.