4 ms·
Why not just generate random passwords for each site and store those? That approach is susceptible to a man-in-the-middle attack. FIDO isn't.
by sowbug 3y ago
Why not just generate random passwords for each site and store those?
That approach is susceptible to a man-in-the-middle attack. FIDO isn't.
- supriyo-biswas 3y agoIf you’re using a password manager, it would fill in the password only for the target website.
- acdha 3y agoThe problem is that sites are sloppy about this and many password managers allow you to fill in passwords even from other domains. WebAuthn makes that impossible even in the face of good social engineering.
- sowbug 3y agoThat's the intent of password managers, but there are all sorts of attacks/bugs/footguns that could still let the wrong thing happen. You could imagine scenarios where you don't have time to investigate why your @#$(#! password manager isn't autofilling today, and you do it manually. The confused deputy problem is real. Contrast FIDO's design, in which it's actually not catastrophic to give the secret to the phishing site, because they can't do anything useful with it. There simply isn't a "hunter2" for them to obtain, even if the confused deputy wanted to give them one. (If you believe you personally are impervious to social engineering, imagine how many other people would respond in this situation: https://www.mercurynews.com/2023/04/27/larry-magid-how-i-nearly-fell-for-a-frightening-virtual-kidnapping-scam/ https://www.mercurynews.com/2023/04/27/larry-magid-how-i-nea....)