3 ms·
Security engineers aren't infallible. This is a really clever channel confusion attack that presumably just nobody considered. It happens, unfortunately.
by lxgr 2y ago
Security engineers aren't infallible. This is a really clever channel confusion attack that presumably just nobody considered. It happens, unfortunately.
- bflesch 2y agoClever attack indeed - wouldn't have expected for this to be possible. I trusted the claims of Webauthn / Passkey being "phishing proof" without much consideration, because these claims came from highly respected companies. Unfortunately this is yet another example for "trust, but verify".
- sunshowers 2y agoI'm curious if folks tried to use a model checker. Seems like a model checker might be able to identify cases in the spec where invariants are violated.
- lxgr 2y agoI don't think that that would have helped here: The invariant ("URLs purportedly resulting from a QR code scan must only result from an actual QR code scan") essentially follows directly from a specific threat scenario that was missed.
- sunshowers 2y agoYeah, you're right, that does seem to be very specific.
- 3np 2y agoAny professional should know this. Claiming any credential scheme is unphishable is not honest. Leading wider marketing with "phishing-resistant" is not far from that, knowing that the subtlety is lost on the public.