Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome lets hackers phish even 'Unphishable' Yubikey users

wired.com

Post reply on HN
Print view View original

71–80 of 113 posts

Re: Chrome lets hackers phish even 'Unphishable' Yubikey users

#71

Post by phyzome »

superdaniel wrote: post #52
mfontani wrote: post #13

Earlier quoted context omitted.

> - Don't use U2F because FireFox doesn't support it It does! Open about:config and switch security.webauth.u2f to true. It'll Just Work. I've in the recent past modified a barebones Perl webapp to try and understand U2F better, see https://u2fdemo.darkpan.com/ I've been able to log in / use U2F from: * FF on Windows and OSX * Chrome on Windows, OSX * Chrome on Android using either a OTG cable for a U2F USB key, a Bl…

Firefox barely supports U2F. It works on Github and Dropbox, but doesn't work on sites like Vanguard and Google. Every time I do a Firefox update I do a search of the bug listing and they seem to have an incomplete implementation of the spec. They're kicking the can until they fully implement the WebAuth API and jump over dealing with whatever earlier spec they were targeting. Speaking of which, why does Vanguard for…

Does it actually not work on Vanguard... or is it that Vanguard does user-agent sniffing and says Firefox is not compatible?

Re: Chrome lets hackers phish even 'Unphishable' Yubikey users

#73

Post by makomk »

Ecco wrote: post #61
codedokode wrote: post #58

What is the usecase for WebUSB? Here [1] someone from Google suggests vendors should write device drivers in Chrome HTML and Chrome Javascript. Please don't. Or (my assuption) it might be for devices that cannot work without browser and network connection. [1] https://developers.google.com/web/updates/2016/03/access-usb...

Well, we found it really, really useful! https://www.numworks.com/blog/webusb-firmware-update/

Yeah, the great thing about WebUSB is that it can easily be used to upgrade devices to new firmware with new features. For example, suppose that some end user's USB device lacks the ability to act like a USB Rubber Ducky and inject malicious keystrokes in order to compromise their machine. WebUSB allows a clean, easy way to fix that remotely.

WebUSB terrifies me.

Re: Chrome lets hackers phish even 'Unphishable' Yubikey users

#74

Post by stevehawk »

pfg wrote: post #30
skybrian wrote: post #25

Earlier quoted context omitted.

More importantly: "the phishing site would also have to ask the user's permission to enable WebUSB access to their Yubikey, and then tap the physical button on the key." So don't do that. It would be nice to know exactly what this dialog looks like, but it seems low risk?

Convincing users to grant access to a USB device when they're attempting to log in to a service using said USB device sounds like something that would work more often than not. We wouldn't need phishing-resistant authentication methods if humans were good enough at making those kinds of decisions.

I have to admit that in all of my use of my Yubikey Neo in Chrome I don't recall ever being asked for permission to access the device. Firefox hasn't asked either.

Re: Chrome lets hackers phish even 'Unphishable' Yubikey users

#76

Post by pfg »

stevehawk wrote: post #74
pfg wrote: post #30

Earlier quoted context omitted.

Convincing users to grant access to a USB device when they're attempting to log in to a service using said USB device sounds like something that would work more often than not. We wouldn't need phishing-resistant authentication methods if humans were good enough at making those kinds of decisions.

I have to admit that in all of my use of my Yubikey Neo in Chrome I don't recall ever being asked for permission to access the device. Firefox hasn't asked either.

I'm not saying that you need to grant any kind of permission in order to use U2F tokens, but rather that a user thinking "I want to login to Google" and "I need to use that USB key thingy to do that" is quite likely to accept a prompt that requests access to the U2F device.

Re: Chrome lets hackers phish even 'Unphishable' Yubikey users

#77

Post by jperras »

Sir_Cmpwn wrote: post #46
Ajedi32 wrote: post #45

Earlier quoted context omitted.

This is about the Web USB API, not the entire web in general. Are you routinely granting web pages access to your USB devices? That's not a permission that web apps get by default (unlike with native desktop apps btw). It comes down to this: if you ever found yourself in a situation where you needed to connect a USB device to a remote service, would you prefer to download that service's unsandboxed native code to you…

>if you ever found yourself in a situation where you needed to connect a USB device to a remote service I have never found myself in that situation. That sounds like a really silly idea.

Just because you've never dreamed up a situation where it might be useful doesn't mean that they don't exist.

Re: Chrome lets hackers phish even 'Unphishable' Yubikey users

#78

Post by Sir_Cmpwn »

jperras wrote: post #77
Sir_Cmpwn wrote: post #46

Earlier quoted context omitted.

>if you ever found yourself in a situation where you needed to connect a USB device to a remote service I have never found myself in that situation. That sounds like a really silly idea.

Just because you've never dreamed up a situation where it might be useful doesn't mean that they don't exist.

Clarification: I've never wanted to do that in a web browser.

Re: Chrome lets hackers phish even 'Unphishable' Yubikey users

#79

Post by [deleted] »

crispyporkbites wrote: post #2

This is the attack: > If a victim logs into a fake Google site, the phishing site passes on their username and password to the real Google login page. Then the spoofed site passes back Google's request for the user's U2F token and collects the Yubikey's unique answer, all via WebUSB. When that answer is then presented to the real Google site, the attackers gain access to the victim's account. So basically they are so…

[deleted]
Post reply on HN