4 ms·

> All subsequent visits (many more!) do identify the site, or rather they tell you that you're logging in to the same site as all those times before. I don't u

• brazzy 6y ago
  The U2F protocol (that Yubikey and others use) is based on a cryptographic challenge-response mechanisms, and it includes the domain of the service you're logging into, as supplied by the browser. The details are complicated, but basically: If you register the key at github.com and later get phished to visit githubverification.com, then the authentication will fail no matter what the phisher does.
  • tialaramex 6y ago
    Specifically, the phisherman's options for a typical Security Key (a physical authenticator device you buy and maybe plug into a USB port) are: * Spew random crap claiming it is your githubverification.com key ID, ask you to sign in with this ID. Your authenticator won't recognise this ID and it doesn't work * Proxy your real ID from github.com and present that from githubverification.com asking you to sign in. Your authenticator won't recognise this ID because it's for the wrong site, though it doesn't know that's why. It doesn't work. * Proxy the ID from github.com and insist this is github.com. Your browser says "Er, no? This isn't github.com fool" and the UX doesn't fire. Notice that the attacker not only doesn't get working credentials for signing into GitHub, they don't even get broken failed credentials that don't work, they just get a Javascript error at best.