21–30 of 113 posts
hmm. I assumed U2F does not protect you from phishing. It just adds a second layer of protection to your account. Protecting you from credential theft. U2F antiphishing stuff implemented by chrome is just a neat little extra. Is this behaviour of checking the origin in the spec?
Earlier quoted context omitted.
Or just don't click "Connect" on the USB access permissions prompt when it pops up. Unfortunately though, as with any phishing attack, this flaw is most likely to be effective against uninformed users, and those users are the least likely to take proactive measures to protect themselves beforehand. Fortunately: > "We will have a short term mitigation in place in the upcoming version of Chrome, and we're working close…
What kind of uniformed user uses a YubiKey? I supposed you could trick them by saying that the login process has changed and they need to enable WebUSB to let their YubiKey work
https://www.yubico.com/about/reference-customers/department-...
This is the attack: > If a victim logs into a fake Google site, the phishing site passes on their username and password to the real Google login page. Then the spoofed site passes back Google's request for the user's U2F token and collects the Yubikey's unique answer, all via WebUSB. When that answer is then presented to the real Google site, the attackers gain access to the victim's account. So basically they are so…
> - Don't use U2F because FireFox doesn't support it It does! Open about:config and switch security.webauth.u2f to true. It'll Just Work. I've in the recent past modified a barebones Perl webapp to try and understand U2F better, see https://u2fdemo.darkpan.com/ I've been able to log in / use U2F from: * FF on Windows and OSX * Chrome on Windows, OSX * Chrome on Android using either a OTG cable for a U2F USB key, a Bl…
Earlier quoted context omitted.
> - Don't use U2F because FireFox doesn't support it It does! Open about:config and switch security.webauth.u2f to true. It'll Just Work. I've in the recent past modified a barebones Perl webapp to try and understand U2F better, see https://u2fdemo.darkpan.com/ I've been able to log in / use U2F from: * FF on Windows and OSX * Chrome on Windows, OSX * Chrome on Android using either a OTG cable for a U2F USB key, a Bl…
ok scratch that, use firefox then but still hardly anything supports U2f :-(
This is the attack: > If a victim logs into a fake Google site, the phishing site passes on their username and password to the real Google login page. Then the spoofed site passes back Google's request for the user's U2F token and collects the Yubikey's unique answer, all via WebUSB. When that answer is then presented to the real Google site, the attackers gain access to the victim's account. So basically they are so…
So don't do that. It would be nice to know exactly what this dialog looks like, but it seems low risk?
This is the attack: > If a victim logs into a fake Google site, the phishing site passes on their username and password to the real Google login page. Then the spoofed site passes back Google's request for the user's U2F token and collects the Yubikey's unique answer, all via WebUSB. When that answer is then presented to the real Google site, the attackers gain access to the victim's account. So basically they are so…
This is the attack: > If a victim logs into a fake Google site, the phishing site passes on their username and password to the real Google login page. Then the spoofed site passes back Google's request for the user's U2F token and collects the Yubikey's unique answer, all via WebUSB. When that answer is then presented to the real Google site, the attackers gain access to the victim's account. So basically they are so…
So does Chrome ask for permission to allow USB access? Or maybe there's something about this I'm not getting.
This is the attack: > If a victim logs into a fake Google site, the phishing site passes on their username and password to the real Google login page. Then the spoofed site passes back Google's request for the user's U2F token and collects the Yubikey's unique answer, all via WebUSB. When that answer is then presented to the real Google site, the attackers gain access to the victim's account. So basically they are so…
I didn't even realize web USB was a thing now. I remember it being talked about, but I must have missed the HN conversation when Chrome implemented it. So does Chrome ask for permission to allow USB access? Or maybe there's something about this I'm not getting.
This is the attack: > If a victim logs into a fake Google site, the phishing site passes on their username and password to the real Google login page. Then the spoofed site passes back Google's request for the user's U2F token and collects the Yubikey's unique answer, all via WebUSB. When that answer is then presented to the real Google site, the attackers gain access to the victim's account. So basically they are so…
More importantly: "the phishing site would also have to ask the user's permission to enable WebUSB access to their Yubikey, and then tap the physical button on the key." So don't do that. It would be nice to know exactly what this dialog looks like, but it seems low risk?