Hacker News Reader

Comment by nicpottier | Hacker News Reader

I may be mistaken (and I'm sure someone will point out if I am) but I think most hardware U2F tokens require you to physically press something on the token to validate that it should pass over your keys.

The soft U2F solution presented here still prompts you, but it is easier to imagine the software being modified/owned on a compromised machine than then hardware token being hacked in such a way as to hand over the keys without a physical press.

View on HN

From my testing of several hardware U2F implementations, the test-of-user-presence (touching the button) unlocks the device for an amount of time. During this time multiple authentication/registration will succeed without further user interaction. Even without this behavior though, hardware tokens don't indicate which site your authenticating with. Malware could just make an authentication request right as some user action triggers a legitimate authentication request.

Once you have malicious software running it is largely game over. Sure, the hardware token can require a press..but once pressed what challenge is being signed? Malware can just wait and send a challenge for Site A when you are actually trying to sign into site B. Or, the malware can just wait until you login and steal your browser cookies. Oh, also, Soft U2F can require a similar physical touch if you have a mac with Touch ID.

Atleast for my u2f token, I'm being shown the site I'm signing for on a hardware screen.

Which device are you using? With U2F, the browser doesn't send the name of the site to the authenticator.

I'm using Trezor, I believe it has been preloaded with certain websites so it knows Github and Google and the likes.

It also shows parts of the public key (or so I believe, it is a unique identifier) per website.

Reply on news.ycombinator.com