Hacker News new | past | comments | ask | show | jobs | submit login

Not as securely or cheaply: using 1Password this way either requires less secure TOTP codes (which are easily phished) or a separate token.

Having this available to every Apple user on the web is huge, especially when you look at the network benefits of the Apple feature pushing all of the slackers (hi, every large financial company!) to implement secure MFA.




How are TOTP codes more phishable? Seems like the same phishability to me


If https://fake-bank.example/ persuades you it is your real bank you can just type your TOTP code into it, and now the crooks operating it have a valid TOTP code. Nothing stops you doing this, it relies on you to know it's the wrong site to protect yourself and that's not reliable.

Machinery to take that TOTP code and immediately plug it into the real bank (since it's time sensitive) exists already.

In contrast WebAuthn credentials are tied to the domain name of the site. Your iPhone doesn't have any credentials for https://fake-bank.example/ so it won't sign you in, and even if it did have credentials for fake-bank.example they'd be completely useless on the https://real-bank.example/ web site. There is no way to give real-bank credentials to fake-bank, it just can't work because the cryptographic material used is tied to the domain name.

Google deployed an earlier iteration of this same technology and reported zero phishing for accounts protected this way because it isn't possible to see how to phish it without some grave security bug somewhere. This is the penicillin of web user security, it's a night-and-day difference over what we had before.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: