Re:YubiKey comes to the iPhone with Mobile SDK for iOS and L...
by watersb on Tuesday May 22, 2018 @07:16PM
(#17130265)
> The scariest threat model is phishing, and the disadvantage of a TOTP app on your phone is that you type in the one-time code by hand. Anything you type in by hand can be phished.
I can be fooled into reading a 6-digit PIN to Evil Mallory, a MITM attack.
I can be fooled into tapping my NFC auth token on Mallory's Evil Website, and the auth handshake would fail. Or not. It depends on the protocol, I suppose.
I can be fooled into reading a 6-digit PIN to Evil Mallory, a MITM attack.
I can be fooled into tapping my NFC auth token on Mallory's Evil Website, and the auth handshake would fail. Or not. It depends on the protocol, I suppose.
Is that what you mean?