News for hackers. Stuff that matters.

A comment on “Username or password is incorrect” is bullshit. Parent comment

Re:“Username or password is incorrect” is bullshit by StavrosK on Friday December 22, 2017 @08:24AM (#15987218)
U2F does that. I wonder if sites could use the U2F token as the first factor and ask you to enter a password as the second factor (along with a "remember this computer" box for the password). Would make things much more convenient (unless you were on a device that didn't support U2F, I guess).
[ Parent | on HN ]
Re:“Username or password is incorrect” is bullshit by cjwhite on Friday December 22, 2017 @10:57AM (#15988335)
It also seems that would help with not giving out passwords to spoofing sites
[ Parent | on HN ]
Re:“Username or password is incorrect” is bullshit by StavrosK on Friday December 22, 2017 @11:07AM (#15988410)
The spoofing site could just pretend your U2F was valid and get your password, although it couldn't really do anything with it anyway.
[ Parent | on HN ]
Re:“Username or password is incorrect” is bullshit by u801e on Friday December 22, 2017 @01:17PM (#15989600)
The spoofing site wouldn't/shouldn't be able to pass the browser validation of the TLS server side certificate.
[ Parent | on HN ]
Re:“Username or password is incorrect” is bullshit by StavrosK on Friday December 22, 2017 @06:55PM (#15991911)
Why not? How hard is it to get a cert for a domain that looks like paypal-businesscenter.com?
[ Parent | on HN ]
Re:“Username or password is incorrect” is bullshit by cjwhite on Saturday December 23, 2017 @12:06PM (#15995027)
Moreover, the browser could remember the expected shared secret based on its and the server's RSA exchange.
[ Parent | on HN ]