4 ms·
If the computer is compromised you're screwed either way. Even though WebAuthN can't be easily MITM'd like TOTP codes, someone compromising your computer could
by jabbany 4y ago
If the computer is compromised you're screwed either way. Even though WebAuthN can't be easily MITM'd like TOTP codes, someone compromising your computer could just use the UI to lie to you.
I think the main reduction in security is just that the virtual 2FA device is "cloneable" vs a hardware FIDO2 token where IIRC you can't extract the internal secret. So you're getting TOTP levels of 2FA (which also uses a cloneable initialization secret) thru a FIDO2-ish UX which seems like a reasonable thing to want.
- mjg59 4y agoThey could, but it's still limiting - the maximum number of challenges the attacker is able to satisfy is the number of times you touch the token before you realise that something's up.
- jabbany 4y agoBased on a certain recent high profile hack, getting just one 2FA auth this way could already be enough ;-) I doubt most people would be suspicious if their system prompted them to touch their key, they touched it, the software kept waiting, so they touch it again and it works this time.
- xani_ 4y agoIf someone uses my computer to lie to me about bank transaction, SMS 2FA still shows amount and type of transaction. That's kinda a problem with few of the 2FAs, there is no context attached to code