> If a victim logs into a fake Google site, the phishing site passes on their username and password to the real Google login page. Then the spoofed site passes back Google's request for the user's U2F token and collects the Yubikey's unique answer, all via WebUSB. When that answer is then presented to the real Google site, the attackers gain access to the victim's account.
So basically they are somehow able to trick the yubikey neo into accepting a challenge from a different domain, by using the webusb API.
Reading further:
> The technique would only work with U2F keys that offer protocols for connecting to a browser other than the usual way U2F tokens communicate with a computer, known as the Human Interface Device or HID, which isn't vulnerable to the attack. The Yubikey Neo, for instance, can also connect via the CCID interface used by smartcard readers
> An assumption was made by Chrome that all U2F is HID, which doesn't hold for the Neo, whereas Yubico made an assumption that USB will never be accessible by web pages directly
So:
- Don't use a Yubikey Neo anymore
- Don't use Chrome
- Don't use U2F because FireFox doesn't support it
- Never use your yubikey because hardly anything supports it
Sigh