5 ms·

> passkeys are resistant to online attacks like phishing, making them more secure than things like SMS one-time codes. What is the scenario in which SMS one-ti

> passkeys are resistant to online attacks like phishing, making them more secure than things like SMS one-time codes. What is the scenario in which SMS one-time codes are prone to fishing, but passkeys are not?

neilalexander 3y ago
https://en.wikipedia.org/wiki/SIM_swap_scam https://en.wikipedia.org/wiki/SIM_swap_scam
- jefftk 3y ago
  That is also an issue with 2fa sms, but it's not phishing.
  - neilalexander 3y ago
    Phishing is quite often how a SIM swap attack starts.
- red_trumpet 3y ago
  Yeah okay, but then just don't do 2fa via SMS. How are passkeys better than a 2fa app on my smartphone?
wepple 3y ago
Passkeys sign a web origin. If you try to phish one, the token you get won’t be valid for the origin you’re trying to authenticate to. Eg you’ll get: Token{domain:hax0r.net username:bob}
jefftk 3y ago
1. You're tricked into visiting evil.example and don't realize it. 2. evil.example: confirm 2fa code to log in. 3. evil.example starts logging into good.example as you, triggering good.example to send the 2fa code. 4. You see the 2fa code and enter it into evil.example. 5. evil.example has phished your 2fa code. This doesn't work with passkeys (or 2fa tokens) because those verify the domain matches.
- red_trumpet 3y ago
  Yes, I understand how phishing with 2fa works. But to me, passkeys sound like 2fa with your fingerprint/smartphone PIN? What's actually different there?
  - jefftk 3y ago
    The difference is in step 4. With SMS or one-time code 2FA (or passwords) you're just entering text into a website, and nothing verifies you're interacting with the right website. With passkeys or FIDO tokens, though, there's a cryptographic protocol that considers the domain: your fingerprint/PIN isn't sent to the website.
    - red_trumpet 3y ago
      So, evil.example tries to log in and triggers the passkey thing on my smartphone. My smartphone asks "Do you want to log in to good.example?" Because I'm currently being phished and didn't pay attention to the URL "evil.example" anyway, I will confirm this on my smartphone and evil.example is granted access to my account. I don't see how this is more phishing resistant than current 2fa. How can my smartphone know whether I'm interacting with the correct website on my laptop?
      - jefftk 3y ago
        This is maybe an oversimplification, but the token that your phone gives your laptop includes "only valid for good.example". Your browser on your laptop then knows not to send it to evil.example.
        friedhelm2000 3y ago
        [dead]
        waldemar69 3y ago
        [dead]

neilalexander 3y ago

https://en.wikipedia.org/wiki/SIM_swap_scam https://en.wikipedia.org/wiki/SIM_swap_scam

jefftk 3y ago
That is also an issue with 2fa sms, but it's not phishing.
- neilalexander 3y ago
  Phishing is quite often how a SIM swap attack starts.
red_trumpet 3y ago
Yeah okay, but then just don't do 2fa via SMS. How are passkeys better than a 2fa app on my smartphone?

wepple 3y ago

Passkeys sign a web origin. If you try to phish one, the token you get won’t be valid for the origin you’re trying to authenticate to. Eg you’ll get: Token{domain:hax0r.net username:bob}

jefftk 3y ago

1. You're tricked into visiting evil.example and don't realize it. 2. evil.example: confirm 2fa code to log in. 3. evil.example starts logging into good.example as you, triggering good.example to send the 2fa code. 4. You see the 2fa code and enter it into evil.example. 5. evil.example has phished your 2fa code. This doesn't work with passkeys (or 2fa tokens) because those verify the domain matches.

red_trumpet 3y ago
Yes, I understand how phishing with 2fa works. But to me, passkeys sound like 2fa with your fingerprint/smartphone PIN? What's actually different there?
- jefftk 3y ago
  The difference is in step 4. With SMS or one-time code 2FA (or passwords) you're just entering text into a website, and nothing verifies you're interacting with the right website. With passkeys or FIDO tokens, though, there's a cryptographic protocol that considers the domain: your fingerprint/PIN isn't sent to the website.
  - red_trumpet 3y ago
    So, evil.example tries to log in and triggers the passkey thing on my smartphone. My smartphone asks "Do you want to log in to good.example?" Because I'm currently being phished and didn't pay attention to the URL "evil.example" anyway, I will confirm this on my smartphone and evil.example is granted access to my account. I don't see how this is more phishing resistant than current 2fa. How can my smartphone know whether I'm interacting with the correct website on my laptop?
    - jefftk 3y ago
      This is maybe an oversimplification, but the token that your phone gives your laptop includes "only valid for good.example". Your browser on your laptop then knows not to send it to evil.example.
      - friedhelm2000 3y ago
        [dead]
      - waldemar69 3y ago
        [dead]