Facebook hacker beat my 2FA, bricked my Oculus, and hit the company credit card

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by kerng on Saturday August 21, 2021 @01:46PM (#28258952)

At high level imagine it like this:

The browser will only give access to the Yubikey token for a specific domain name - so if the attacker phishes for examle.org, rather then example.org, then there is just no tokens (signing keys) available the Yubikey could use and give to the browser.

In the early days WebUSB in Chrome had bugs that allowed to bypass that same origin check but that has been fixed 3 years ago.

[ Parent | on HN ]

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by notanzaiiswear on Sunday August 22, 2021 @03:00PM (#28268420)

I've been using the browser's password manager as protection against phishing, as the password manager won't fill in passwords on the wrong site. So I guess it works in a similar way with the Yubikey? OK.

[ Parent | on HN ]

Re:Facebook hacker beat my 2FA, bricked my Oculus, and hit t... by kerng on Sunday August 22, 2021 @03:41PM (#28268801)

At a very very high level yes - but the reason you want to use tokens is that you get a second factor and you have better entropy and created tokens are time based (password is valid forever).

[ Parent | on HN ]