Re:Soft U2F: A software-based U2F authenticator for macOS
by subway on Tuesday July 25, 2017 @01:19AM
(#14845272)
My knee jerk reaction was 'sounds an awful lot like a cookie', but maybe that's an indicator that the problem could be slightly generalized to offering a 'secure' version of localstorage.
[ Parent
| on HN ]
Re:Soft U2F: A software-based U2F authenticator for macOS
by StavrosK on Tuesday July 25, 2017 @07:31AM
(#14846889)
It's almost like a cookie, yes, in that you could say "trust this browser". However, the problem comes when you ask for the second factor for a new computer. A TOTP approach would give the second factor to the phisher, whereas U2F does not.
Come to think of it, I'm not sure that's a problem with the cookie and not with TOTP.