Hacker News Reader

well code which U2f token generate with the help of Google authenticator has ONLY 6 digits. 6 digits that's not extremely hard to brute force is that right ?

If you are using additional backup u2f token (2 tokens in total) hacker has chance 1:500 000 to find out correct PIN is my assumption right ?

View on HN

You seem confused. I think you're describing TOTP, but this whole thread is about FIDO.

WebAuthn, U2F and similar FIDO based schemes are sending some public key signed blobs over the network. A PIN is purely a local protection, it's not sent over the wire. So a hacker can't just try guessing the PIN. First they need to steal your physical token, only then could they start guessing PINs for the stolen token.

And even then, the token would lock itself down after too many incorrect PIN attemtpts.

Reply on news.ycombinator.com