4 ms·
how does authn happen here? RP sends ID and I respond with the secret code? that's subject to replay attacks.
by wepple 3y ago
how does authn happen here?
RP sends ID and I respond with the secret code? that's subject to replay attacks.
- kj4ips 3y agoIt's a challenge-response with nonces. There is also the browser's role to ensure that a given RP's requests are marked with the origin (domain) they came from, so auth.example.com and auth.example.evil don't overlap. (U2F is mostly concerned about malicious sites, and less about malicious browsers and other nastyware)