3 ms·

Oops, I didn’t realise U2F was different to 2FA. I guess you would need to ring someone up pretending to be tech support and convince them to disclose the priv

• Thorrez 6y ago
  The private key is embedded in the hardware key, there's no way to extract it without an advanced attack involving tearing apart the key. But a practical attack along the lines of what you mentioned would be to ring someone up and convince them to disclose their cookie. Check out[1] in which the victim disclosed their cookie without the attacker even asking for it. [1] https://hackerone.com/reports/745324 https://hackerone.com/reports/745324