News for hackers. Stuff that matters.

A comment on Chrome lets hackers phish even 'Unphishable' Yubikey users.

Re:Chrome lets hackers phish even 'Unphishable' Yubikey users by valkum on Friday March 02, 2018 @10:21AM (#16502093)
hmm. I assumed U2F does not protect you from phishing. It just adds a second layer of protection to your account. Protecting you from credential theft. U2F antiphishing stuff implemented by chrome is just a neat little extra. Is this behaviour of checking the origin in the spec?
[ Parent | on HN ]
Re:Chrome lets hackers phish even 'Unphishable' Yubikey users by Ajedi32 on Friday March 02, 2018 @11:22AM (#16502820)
Yes, preventing phishing by only sending credentials to the appropriate origins is a very important part of the spec: https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fid...
[ Parent | on HN ]
Re:Chrome lets hackers phish even 'Unphishable' Yubikey users by tedunangst on Friday March 02, 2018 @11:02AM (#16502583)
The supposed ability to tap the yubikey button even on phishing sites and not actually give up working credentials was like the selling point.
[ Parent | on HN ]