5 ms·
This feels somewhat MitM-able. Say I want to get access to your account on site Foo. I create a web site and entice you to log in on it using Clef. However when
by yuliyp 14y ago
This feels somewhat MitM-able. Say I want to get access to your account on site Foo. I create a web site and entice you to log in on it using Clef. However when you initiate the flow I don't create a Clef code normally, but I replace it with a code for site Foo. Voila, my authentication to site Foo completes, and then given this I can pretend that you successfully authenticated to my site too (or error out and ask you to try again).
- brennenHN 14y agoGood point! There is still a phishing vector of attack that we haven't solved in this release (you call it MitM, but really it's just advanced spear-phishing). We're working on several ways to solve this problem using geolocation and on-phone-login confirmations for higher-security sites, and those will be released soon. Phishing has always been a problem with passwords, and the fact that we are still vulnerable to it is something we take very seriously. Users are, however, protected from many other forms of attack and the phishing vector is less profitable because it is so hard to do in a distributed way.