News for hackers. Stuff that matters.

A comment on Pin Bypass in Passwordless WebAuthn on Microsoft.com and Nextcloud.

Re:Pin Bypass in Passwordless WebAuthn on Microsoft.com and ... by serjd on Wednesday August 12, 2020 @10:05AM (#24132170)
> We reported the issue to Microsoft. They did not consider it a vulnerability, but fixed it

Seems like Microsoft doesn't like to pay for a bug bounty

[ Parent | on HN ]
Re:Pin Bypass in Passwordless WebAuthn on Microsoft.com and ... by sufficient on Wednesday August 12, 2020 @11:20AM (#24132918)
I agree that it's weird that they fixed it and didn't consider it a security issue.

For the user it looked like it would provide two-factor authentication since the PIN is requested, while in reality it's not verified. Thus, they only provided one-factor security.

[ Parent | on HN ]