News for hackers. Stuff that matters.

A comment on YubiKey 5 Series with New NFC and FIDO2 Passwordless Features. Parent comment

Re:YubiKey 5 Series with New NFC and FIDO2 Passwordless Feat... by digianarchist on Monday September 24, 2018 @10:18AM (#18057845)
> And the U2F/FIDO part is very interesting as it eliminates phishing as a risk.

How does that work? Can't the challenge response be MITM?

[ Parent | on HN ]
Re:YubiKey 5 Series with New NFC and FIDO2 Passwordless Feat... by r3dey3 on Monday September 24, 2018 @11:00AM (#18058234)
The browser sends the domain as part of the request to the U2F key; so a MITM would need to be a true network-level MITM and not just a fake website MITM. The user would then have to ignore the cert error as well.

I'm not saying it's not impossible, but the it's not the primary attack U2F is designed to prevent.

[ Parent | on HN ]