タグ

ブックマーク / joskvw.com (1)

  • Domain Matching 2FA

    While more secure than ordinary push 2fa, users that don't read the hostname could still be phished. Domain matching 2FA solves this problem by replacing the number with a domain. Let's take a look at this in action. Here are a couple of notes: Domains should vary: using 1 domain may cause users to simply remember and re-enter that domain (it is possible to implement a similar approach with 1 doma

    sora_h
    sora_h 2023/06/12
    悪手だと思う(Passkeyで良いと思う)、けどPush MFAに数字確認はphishing resistantのための手で多少マシにはなるが完璧ではない(どのみちphishingできる)。数字の確認だけでは本人とは担保できないんですよ…。
  • 1