Disabling Google 2FA doesn't need 2FA if you're already logged in

Re:Disabling Google 2FA doesn't need 2FA if you're already l... by coder543 on Friday July 10, 2020 @12:21PM (#23793113)

Or by using a U2F device, which is designed to prevent spoofing.

[ Parent | on HN ]

Re:Disabling Google 2FA doesn't need 2FA if you're already l... by frei on Friday July 10, 2020 @12:43PM (#23793372)

U2F doesn't protect you from an untrusted machine, it protects you from untrusted websites.

The security model relies on the browser validating the origin.

[ Parent | on HN ]

Re:Disabling Google 2FA doesn't need 2FA if you're already l... by CodesInChaos on Friday July 10, 2020 @12:51PM (#23793478)

I don't think there is a way around "displaying that purpose on the trusted 2FA device." if you want to protect against a compromised computer.

Domain binding protects you from fishing, but still relies on the user's computer, including the browser, being secure. So it doesn't help here.

[ Parent | on HN ]