3 ms·

I don't get this, what about malware pretending to be a browser? Is there a protection against this in protocol

joshzayin 12y ago
If there's malware on your computer, it could just as easily keylog your password and one-time code the next time you try to log in to google, silently drop those packets on the floor (so you think there was just a connection issue), and then use your credentials to get access to your account. If there's malware on your computer running as you, with access to things like USB devices, it becomes significantly harder (if not impossible) to do anything security critical on it.
dragonwriter 12y ago
That's not what this is intended to protect against. If your local machine is compromised, you are screwed, and 2FA no matter what the form isn't going to help you. At a minimum, for that, you need out-of-band confirmation of critical actions (e.g., a message to a different pre-registered device to confirm financial transactions before they are executed.)
wmf 12y ago
Yes, I think the protocol protects against MITM and replay attacks. http://fidoalliance.org/specs/fido-security-ref-v1.0-rd-20140209.pdf http://fidoalliance.org/specs/fido-security-ref-v1.0-rd-2014...
- yanonymator 12y ago
  No, not really - if you're a MITM, you control what the user sees, as well as what gets sent to the device, and nothing prevents those 2 things being different. You might SEE that you're sending $100 to Grandma, but when you tap the key, you're authenticating your entire bank balance to some place in the Bahamas.
tiziano88 12y ago
At the very minimum, this requires physically interacting with the security key (by touching it), which prevents software from silently using the key to authenticate in the background. Then again, if your entire machine is compromised you basically have a MITM attack so close to your side of the channel that it is virtually impossible to do anything about it.

If there's malware on your computer, it could just as easily keylog your password and one-time code the next time you try to log in to google, silently drop those packets on the floor (so you think there was just a connection issue), and then use your credentials to get access to your account. If there's malware on your computer running as you, with access to things like USB devices, it becomes significantly harder (if not impossible) to do anything security critical on it.

dragonwriter 12y ago

That's not what this is intended to protect against. If your local machine is compromised, you are screwed, and 2FA no matter what the form isn't going to help you. At a minimum, for that, you need out-of-band confirmation of critical actions (e.g., a message to a different pre-registered device to confirm financial transactions before they are executed.)

wmf 12y ago

Yes, I think the protocol protects against MITM and replay attacks. http://fidoalliance.org/specs/fido-security-ref-v1.0-rd-20140209.pdf http://fidoalliance.org/specs/fido-security-ref-v1.0-rd-2014...

yanonymator 12y ago
No, not really - if you're a MITM, you control what the user sees, as well as what gets sent to the device, and nothing prevents those 2 things being different. You might SEE that you're sending $100 to Grandma, but when you tap the key, you're authenticating your entire bank balance to some place in the Bahamas.

tiziano88 12y ago

At the very minimum, this requires physically interacting with the security key (by touching it), which prevents software from silently using the key to authenticate in the background. Then again, if your entire machine is compromised you basically have a MITM attack so close to your side of the channel that it is virtually impossible to do anything about it.