News for hackers. Stuff that matters.

A comment on YubiKey – Making secure login easy. Parent comment

Re:YubiKey – Making secure login easy by danieldk on Thursday June 18, 2015 @02:00AM (#9737053)
Because U2F is much safer than TOTP. TOTP is still sensitive to phishing: the MITM could just ask for the TOTP code and forward it. This is not possible with U2F, since only the original site has the key handle that is necessary to initiate the challenge-response.

https://developers.yubico.com/U2F/Protocol_details/Overview....

[ Parent | on HN ]
Re:YubiKey – Making secure login easy by homakov on Thursday June 25, 2015 @10:57PM (#9782242)
Can you elaborate with attack scenarios how U2F mitm is different? There's no display on youbiky, which means it's the same thing
[ Parent | on HN ]