Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t...
by madars on Friday August 20, 2021 @04:06PM
(#28250792)
Codes from those apps are typically TOTP: a deterministic output given a shared secret (e.g. from QR-code during the setup procedure) and current time interval, e.g. HMAC(shared-secret, time-interval) mod 10^6. This does not embed the domain. However, U2F is a completely different protocol that does: you'd typically insert a YubiKey in a USB port and tap a button on it when the browser sends "plz sign a request from login.bank.com" (+ other associated data) https://developers.yubico.com/U2F/Protocol_details/Overview....
(Note that most YubiKeys also support non-U2F modes, most commonly HOTP (HMAC(shared-secret, counter); counter +=1))
(Note that most YubiKeys also support non-U2F modes, most commonly HOTP (HMAC(shared-secret, counter); counter +=1))