News for hackers. Stuff that matters.

A comment on Getting Started with Security Keys. Parent comment

Re:Getting Started with Security Keys by blintz on Thursday October 31, 2019 @12:07AM (#21405670)
Even if the malware hijacks your session tokens, using something like WebAuthn prevents silent theft of a password, which is much more powerful (allows creation of new sessions).
[ Parent | on HN ]
Re:Getting Started with Security Keys by burner589432 on Thursday October 31, 2019 @12:12AM (#21405691)
If your host is infected with malware but it can't steal your passwords due to hardware boundaries, it still has access to your host at a pretty reasonable permission level.

In most corporate environments that's far more damaging than getting persistence in a handful of webapps.

Also, 2FA solves this exact issue.

[ Parent | on HN ]