3 ms·
It is, but only a little. It's still vulnerable to MITM, phishing websites, and fake support calls. OTOH hardware keys are much more foolproof. It's insufficie
by pornel 5y ago
It is, but only a little. It's still vulnerable to MITM, phishing websites, and fake support calls.
OTOH hardware keys are much more foolproof. It's insufficient to merely ask victim to press a button. To bypass them you need to pwn the OS (not impossible, but harder than social engineering) or have physical access to victim's key (requires leaving mom's basement).
- lolinder 5y agoGenuinely curious: how is a hardware key invulnerable to a phishing website? Don't they just act as a keyboard to type in the OTP automatically? What stops a MITM from relaying it on?
- tgsovlerkhgsel 5y agoSome of them do, and they're obviously just as insecure. The ones implementing U2F/FIDO/WebAuthN or whatever the standard is called today will sign a cryptographic challenge, and the response includes the origin on which it was requested (i.e. the legit website will reject the response because the origin is the phishing site).
- tialaramex 5y agoTo expand on what the other reply said about FIDO authentication/ WebAuthn Security Keys (there are a lot of names for related technologies including U2F which was the predecessor technology), WebAuthn recruits the web browser to solve the phishing problem. The web browser definitely knows which DNS name this site has, because it's mechanically necessary in order to fetch web pages from it. So while the user may be confused and believe this is their bank, the browser is quite clear this is fakebank.phishing.example. Then WebAuthn has the browser tell the hardware token which site we're authenticating against, and the authentication credentials are distinct for every possible site. There are a few more wrinkles to make even it even better, but this is already enough that it's utterly pointless to try to phish Security Keys.