2 ms·
All these claims about how FIDO prevents phishing seem very suspect to me. AFAICT the phishing protection is specific to U2F, which is only one of many interrel
by notacoward 4y ago
All these claims about how FIDO prevents phishing seem very suspect to me. AFAICT the phishing protection is specific to U2F, which is only one of many interrelated (and IMO very poorly described) FIDO specs. Absent U2F, it seems like most forms of phishing are still entirely possible. Am I missing something? Is the operative definition of "phishing" much more limited than how a normal person would interpret it?
- tialaramex 4y agoI mean, FIDO itself doesn't care about the web, and so doesn't care about phishing. But, in the context of the web you'd use WebAuthn, which replaced U2F (because it's an actual W3C standard with multiple implementations) and yes that's protected from phishing. Specifically, FIDO binds credentials to a "Relying Party ID". For WebAuthn that's effectively the DNS name of your server, which is why it's protected from phishing. The W3C publishes the entire WebAuthn spec. so if you care you can read it and see how it works. If you're using FIDO in some other context (e.g. smartphone apps can do this via Android or iOS APIs) your RPID is based on that context, so e.g. the real Hacker News Android phone app (if such a thing existed) can't be impersonated by a dozen third party knock-off "Hack-a-News" and "News for Hackers" apps.