8 ms·
The web session is untrusted, and they have a trusted connection to the OS known to belong you. Don’t know how it is implemented exactly, but on the OS level t
by krisoft 4y ago
The web session is untrusted, and they have a trusted connection to the OS known to belong you.
Don’t know how it is implemented exactly, but on the OS level they can do a lot of clever tricks. From their servers they can literally send a challenge-response protocol to the secure enclave of your computer, thus verifying that on the other end of the encrypted connection they are trully talking with a computer manufactured by them, and that computer is the one which is registered to your account.
If they implement this correctly they can make an attack against this chain of trust very costly.
On the other hand on the web they get a http querry with some cookie attached. Maybe. Lot harder to gain the same level of assurances there. And a simple cross site scripting attack, or a compromised browser extension can steal said cookie.
- majormajor 4y ago> The web session is untrusted, and they have a trusted connection to the OS known to belong you. Known to belong to me, yes. Known to be in my possession, no. You'd still need one further thing to go on as far as I can figure - I'd need the password to type into my browser first - but treating "browser session" and "machine the browser is running on" as separate levels of trust seems naive in terms of what someone who steals the machine can do.
- deleted 4y ago[deleted]
- bryan_w 4y agoI don't know the exact workings, but usually the authentication popup should popup with at least 1 other factor to challenge(e.g. touchid or password) if it hasn't asked recently. That way it uses 1) something you are (touchID) and something you have (Validation from a known good device) as the 2 factors.