4 ms·
Doesn't work for FIDO-based tokens, they auth the site as well, so won't send anything to phishing site.
by smw 3y ago
Doesn't work for FIDO-based tokens, they auth the site as well, so won't send anything to phishing site.
- RaisingSpear 3y agoFrom my understanding, FIDO isn't MFA though (the authenticator may present its own local challenge, but I don't think the remote party can mandate it). There's also the issue of how many sites actually use it, as well as how it handles the loss of or inability to access private keys etc. I generally see stuff like 'recovery keys' being a solution, but now you're just back to a password, just with extra steps.