Re:What I Wish I Knew About U2F and Other Hardware MFA Proto...
by Arainach on Friday April 16, 2021 @08:48PM
(#26840668)
> Generally, FIDO standards push too much logic into hardware, when it could be handled in software instead.
This is a feature, not a bug. It's one of the core points: Everything is in hardware, so software can't attack it. In theory, a bug in Android/iOS could expose my authenticator app secrets, but even a full root compromise of the host operating system can't extract the secrets or trigger a signing from a U2F key without me physically touching it.
This is a feature, not a bug. It's one of the core points: Everything is in hardware, so software can't attack it. In theory, a bug in Android/iOS could expose my authenticator app secrets, but even a full root compromise of the host operating system can't extract the secrets or trigger a signing from a U2F key without me physically touching it.