3 ms·
OTPs are terrible and can be MITMed. Meanwhile the non-OTP part of Yubikeys is exactly what the article is talking about.
by JustFinishedBSG 4y ago
OTPs are terrible and can be MITMed. Meanwhile the non-OTP part of Yubikeys is exactly what the article is talking about.
- sph 4y agoHow do you MITM an OTP code? I haven't been talking about SMS 2FA.
- tzs 4y agoThe same way you MITM a user name or a password. You come to my phishing site thinking you are going to your bank site. You enter account and password. I enter that on the bank site. The bank site asks for your OTP code. My site then asks for your OTP code, which you enter because you think you are talking to the bank site. My site enters the OTP code on the bank site.
- sph 4y agoHow is that an OTP flaw? You've just described phishing, which 1FA, 2FA, OTP or even FIDO/Yubikey can't directly protect you from.
- saltcured 4y agoThe authentication process effectively salts the response with both the web origin and the anti-replay counter. The result is then different for every web origin and so the phishing site would get a different authentication response that is incorrect/useless for the real site. This protection is only for the classic phishing scenario where the user-agent is showing a different origin that is masquerading as the user's desired site. AFAIK, this won't solve the problem of Trojan apps where the authenticated user-agent itself can be subverted into making inappropriate requests. In such malware scenarios, you could also just hijack the other temporary session cookie/token secrets after the login step.