Pin Bypass in Passwordless WebAuthn on Microsoft.com and Nextcloud

#1

Post by sufficient » Wed, Aug 12, 2020, 1:28 PM UTC

Pin Bypass in Passwordless WebAuthn on Microsoft.com and Nextcloud
hwsecurity.dev

Re: Pin Bypass in Passwordless WebAuthn on Microsoft.com and Nextcloud

#2

Post by serjd » Wed, Aug 12, 2020, 2:05 PM UTC

> We reported the issue to Microsoft. They did not consider it a vulnerability, but fixed it

Seems like Microsoft doesn't like to pay for a bug bounty

Re: Pin Bypass in Passwordless WebAuthn on Microsoft.com and Nextcloud

#3

Post by sufficient » Wed, Aug 12, 2020, 3:20 PM UTC

serjd wrote: post #2

> We reported the issue to Microsoft. They did not consider it a vulnerability, but fixed it Seems like Microsoft doesn't like to pay for a bug bounty

I agree that it's weird that they fixed it and didn't consider it a security issue.

For the user it looked like it would provide two-factor authentication since the PIN is requested, while in reality it's not verified. Thus, they only provided one-factor security.

Re: Pin Bypass in Passwordless WebAuthn on Microsoft.com and Nextcloud

#4

Post by leif2 » Wed, Aug 12, 2020, 3:20 PM UTC

Looks like Microsoft doesn't understand the specification that they wrote down themselves: It is a bug if an attacker can take over my entire Microsoft account via NFC. I wonder if Microsoft can make amends for any damage it causes. Credit card companies can do this and that's why some NFC payments are only 1FA.