3 ms·
Yubikey offers a false sense of security in that regard, unfortunately, because if your device is thoroughly 0wned and you don't know it, the attacker "just" ha
by fragmede 9mo ago
Yubikey offers a false sense of security in that regard, unfortunately, because if your device is thoroughly 0wned and you don't know it, the attacker "just" has to wait for the victim to do something that would trigger the yubikey, and then swap in their forged request instead. Eg if the victim uses the yubikey to log into bank1 and to crypto wallet, but bank1 accounts have no money, instead of waiting for the customer to log into their crypto wallet with the yubikey, the attack software waits for the victim to log into bank1, but swaps in a request to the crypto wallet instead.
- jdmoreira 9mo agoNot sure I understand your point. Under WebAuthn / FIDO2 you can't impersonate a RP Could you explain better?
- gzread 9mo agoIf the user's computer is pwned, you can wait for the user to log in to their bank account, then blank the screen while you send yourself all their money.
- deleted 9mo ago[deleted]
- fragmede 9mo agoWebAuthn assumes the browser is secure. If the browser is compromised, then impersonation becomes possible, so the user, thinking they're authorizing adding a new ssh key on GitHub.com by touching their yubikey, gets their money stolen by the hacked web browser because it has an invisible hidden window with bank.com waiting for yubikey authentication.