4 ms·

Yes, I understand how phishing with 2fa works. But to me, passkeys sound like 2fa with your fingerprint/smartphone PIN? What's actually different there?

jefftk 3y ago
The difference is in step 4. With SMS or one-time code 2FA (or passwords) you're just entering text into a website, and nothing verifies you're interacting with the right website. With passkeys or FIDO tokens, though, there's a cryptographic protocol that considers the domain: your fingerprint/PIN isn't sent to the website.
- red_trumpet 3y ago
  So, evil.example tries to log in and triggers the passkey thing on my smartphone. My smartphone asks "Do you want to log in to good.example?" Because I'm currently being phished and didn't pay attention to the URL "evil.example" anyway, I will confirm this on my smartphone and evil.example is granted access to my account. I don't see how this is more phishing resistant than current 2fa. How can my smartphone know whether I'm interacting with the correct website on my laptop?
  - jefftk 3y ago
    This is maybe an oversimplification, but the token that your phone gives your laptop includes "only valid for good.example". Your browser on your laptop then knows not to send it to evil.example.
    - friedhelm2000 3y ago
      [dead]
    - waldemar69 3y ago
      [dead]
    - vorfahrt74 3y ago
      [dead]
    - canislupus 3y ago
      [dead]
  - arnarbi 3y ago
    > How can my smartphone know whether I'm interacting with the correct website on my laptop? Because when evil.example requests the passkey it has to do so through browser APIs [1], and it can't lie about its domain name. Your browser is what reaches out to your phone, which is how your phone learns what domain you are actually on. [1] https://www.w3.org/TR/webauthn-2/ https://www.w3.org/TR/webauthn-2/ In this case your phone wouldn't even show you your passkeys from good.example.

4 ms·

Yes, I understand how phishing with 2fa works. But to me, passkeys sound like 2fa with your fingerprint/smartphone PIN? What's actually different there?

by red_trumpet 3y ago

jefftk 3y ago
The difference is in step 4. With SMS or one-time code 2FA (or passwords) you're just entering text into a website, and nothing verifies you're interacting with the right website. With passkeys or FIDO tokens, though, there's a cryptographic protocol that considers the domain: your fingerprint/PIN isn't sent to the website.
- red_trumpet 3y ago
  So, evil.example tries to log in and triggers the passkey thing on my smartphone. My smartphone asks "Do you want to log in to good.example?" Because I'm currently being phished and didn't pay attention to the URL "evil.example" anyway, I will confirm this on my smartphone and evil.example is granted access to my account. I don't see how this is more phishing resistant than current 2fa. How can my smartphone know whether I'm interacting with the correct website on my laptop?
  - jefftk 3y ago
    This is maybe an oversimplification, but the token that your phone gives your laptop includes "only valid for good.example". Your browser on your laptop then knows not to send it to evil.example.
    - friedhelm2000 3y ago
      [dead]
    - waldemar69 3y ago
      [dead]
    - vorfahrt74 3y ago
      [dead]
    - canislupus 3y ago
      [dead]
  - arnarbi 3y ago
    > How can my smartphone know whether I'm interacting with the correct website on my laptop? Because when evil.example requests the passkey it has to do so through browser APIs [1], and it can't lie about its domain name. Your browser is what reaches out to your phone, which is how your phone learns what domain you are actually on. [1] https://www.w3.org/TR/webauthn-2/ https://www.w3.org/TR/webauthn-2/ In this case your phone wouldn't even show you your passkeys from good.example.