News for hackers. Stuff that matters.

A comment on The closest I've ever come to falling for a Gmail phishing attack. Parent comment

Re:The closest I've ever come to falling for a Gmail phishin... by Niten on Wednesday January 11, 2017 @01:11PM (#13376024)
U2F would prevent this from being exploitable, but one-time password schemes like TOTP would not.
[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by RedPanda250 on Wednesday January 11, 2017 @01:27PM (#13376190)
Why would TOTP not suffice to prevent this exploit ?
[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by extrapickles on Wednesday January 11, 2017 @01:50PM (#13376402)
They can use the TOTP token to auth themselves where as U2F will not work if you are the middle-man.

U2F basically[0] signs the current URI and HTTPS key and sends it back. If there is a man-in-middle then the signatures will not match and the auth will fail.

[0]: https://developers.yubico.com/U2F/Protocol_details/Overview....

[ Parent | on HN ]