|
|
|
|
|
|
by nickik
3470 days ago
|
|
|
Thata the clever bit about FIDO. Part of what unlocks the private key for signing the challenge is somehing called AppId. AppId is automatically captured by your webbrowser (weborigin standard) and passed along. So the authenticator only unlooks if you are on the correct website. A further feature is that you can make the ssl tunnel id part of this as well, that makes it even better. This is how both UAF and U2F work. |
|
|