Hacker News new | ask | show | jobs
by seanp2k2 3470 days ago
What makes it impossible for a phishing site to mimic the challenge?
2 comments
lima 3470 days ago
The challenge-response protocol is using assymetric cryptography and is tied to the SSL session ID.

More explanations on why: https://security.stackexchange.com/questions/71316/how-secur...

And how: https://fidoalliance.org/specs/fido-u2f-v1.0-nfc-bt-amendmen...

link
nickik 3470 days ago
Thata the clever bit about FIDO. Part of what unlocks the private key for signing the challenge is somehing called AppId. AppId is automatically captured by your webbrowser (weborigin standard) and passed along. So the authenticator only unlooks if you are on the correct website.

A further feature is that you can make the ssl tunnel id part of this as well, that makes it even better.

This is how both UAF and U2F work.

link