News for hackers. Stuff that matters.

A comment on Passwordless authentication with FIDO2–beyond just the web. Parent comment

Re:Passwordless authentication with FIDO2–beyond just the web by throw0101c on Wednesday February 22, 2023 @09:36AM (#34896186)
> Not just phishing, server side attacks can hoover up passwords all day long.

Just to note that there are password-based login systems that solve this problem:

* https://en.wikipedia.org/wiki/Salted_Challenge_Response_Auth...

* https://en.wikipedia.org/wiki/Password-authenticated_key_agr...

[ Parent | on HN ]
Re:Passwordless authentication with FIDO2–beyond just the web by e12e on Wednesday February 22, 2023 @10:09AM (#34896738)
Doesn't solve keyloggers?
[ Parent | on HN ]
Re:Passwordless authentication with FIDO2–beyond just the web by px43 on Friday March 03, 2023 @09:32AM (#35010083)
The attacker controls the login form. They could use javascript to just scrape it out of the password field if they wanted to. Those solutions might get in the way of existing tools for logging password forms, but there are trivial workarounds.
[ Parent | on HN ]