News for hackers. Stuff that matters.

A comment on Show HN: A virtual Yubikey device for 2FA/WebAuthN. Parent comment

Re:Show HN: A virtual Yubikey device for 2FA/WebAuthN by UncleEntity on Sunday September 18, 2022 @09:22AM (#32887333)
> It seems like getting this to run on an Android would be significantly more functional (no extra device) and cheaper.

That’s basically Google Authenticator.

Didn’t RTFA as I know the algorithm is just one line of python using built-in libraries (which is how I generate passwords minus the time-based part).

[ Parent | on HN ]
Re:Show HN: A virtual Yubikey device for 2FA/WebAuthN by azornathogron on Sunday September 18, 2022 @10:42AM (#32887954)
> Didn’t RTFA as I know the algorithm is just one line of python using built-in libraries

Time-based OTP (TOTP), which is what Google Authenticator implements, is not the same as FIDO U2F. They use different underlying mechanisms and have different security properties.

TOTP relies on a shared secret key to generate a matching code on client & server. FIDO U2F uses a challenge-response protocol and incorporates the domain of the requesting website (the domain as verified by TLS certificate) into the challenge to ensure that the response is _only_ valid when it was requested directly from the correct website. This prevents phishing attacks, which TOTP does not.

[ Parent | on HN ]