Unfortunately, Google inadvertently introduced a workaround WebUSB can trick the security key into skipping this process. This step is an important reason why YubiKey Neo maker Yubico calls the devices " unphishable (Opens in a new window)." But before the key does any of this, it'll use your internet browser to check that the website you're accessing is legit and not a fake page. It then signs an authentication request between the website and the YubiKey, unlocking access to your account. Normally, the security key works like this: When logging into a website, you connect the device to your PC. However, two security researchers tell (Opens in a new window) Wired that it can be used to phish a YubiKey NEO (Opens in a new window) device. The Chrome feature, WebUSB (Opens in a new window), lets a website access a USB device connected to your PC.
A Chrome feature Google introduced last year has the unintended consequence of being able to bypass one of the security key's protections.
0 kommentar(er)
