News for hackers. Stuff that matters.

A comment on Beyond Passwords: 2FA, U2F and Google Advanced Protection. Parent comment

Re:Beyond Passwords: 2FA, U2F and Google Advanced Protection by mimming on Thursday November 15, 2018 @06:26AM (#18458441)
Essentially it borrows the protections from TLS. Here's a link to the relevant part of the spec: https://fidoalliance.org/specs/fido-u2f-v1.2-ps-20170411/fid...

(Sorry if this comes across as RTFM, but I figured the source is better than my attempt at explaining)

[ Parent | on HN ]
Re:Beyond Passwords: 2FA, U2F and Google Advanced Protection by superzamp on Thursday November 15, 2018 @09:29AM (#18459445)
Not at all, the specification is indeed very clear. Thanks for the link!
[ Parent | on HN ]
Re:Beyond Passwords: 2FA, U2F and Google Advanced Protection by Boulth on Friday November 16, 2018 @03:22AM (#18467367)
Channel ID has been depreciated and replaced by Token Binding but I'm sure U2F sites don't use either. The real protection is quite simple: incorporating the origin (domain name) in the protocol. So phishers would get a bad response from the token.
[ Parent | on HN ]