Domain Matching 2FA
joskvw.com
Domain Matching 2FA
1–10 of 16 posts
Re: Domain Matching 2FA
#2This is the first blog post I've put on HN. Feedback is appreciated.
Re: Domain Matching 2FA
#3Instead of placing the numbers in the path, why not use a subdomain, e.g. 5678.example.com, and have that routed using a wildcard DNS record, then let users copy-paste the full ~~~domain name~~~ URL?
Re: Domain Matching 2FA
#4How does U2F come into this?
Re: Domain Matching 2FA
#5this is done by some darknet sites running tor hidden services on generated onion domains, for similar reasons:
https://shufflingbytes.com/posts/ripping-off-professional-cr...
Re: Domain Matching 2FA
#6How does U2F come into this?
U2F would be a much superior replacement for any idea in which the user has to enter anything at all. It’s better to have the security hardware, such as a U2F key, authenticate the authenticator using cryptography, because that process cannot be man-in-the-middle’d.
Re: Domain Matching 2FA
#7Does not 2fa mean that user will not be redirected out until verification code is entered?
I think article needs more clarification.
Can you show where phishing atack is possible in the following scenario?:
1. Open login page
2. Enter credentials (step 1)
3. Enter verification code (step 2)
4. Authenticate, redirect.
Re: Domain Matching 2FA
#8I don't understand what attack this is supposed to mitigate. The idea is that you're getting a number from the device you're trying to sign in to, and entering it on an already-verified device that can "vouch" for the other one.
What good does it do to put the number in the URL rather than the body? Even if someone is trying to phish you, they'd just put the number in their URL instead. Is it just to make you look closer to the domain name?
Re: Domain Matching 2FA
#9This is the first blog post I've put on HN. Feedback is appreciated.
Not quite readable on mobile.
Re: Domain Matching 2FA
#10I don't understand what attack this is supposed to mitigate. The idea is that you're getting a number from the device you're trying to sign in to, and entering it on an already-verified device that can "vouch" for the other one. What good does it do to put the number in the URL rather than the body? Even if someone is trying to phish you, they'd just put the number in their URL instead. Is it just to make you look cl…
Yes, it is. This system is primarily meant to counter phishing attacks that use similar domains. I should have clarified that in the post.