U2F is touted as a new 2 factor authentication standard that has built in defense against phishing attacks. As I understand it, this works by registering the device with each service, thereby creating a unique keypair. If a phishing site pretends to be someone, they will fail that cryptographic check and the key fob won't activate

But as I understand it, the phishing site may still be able to steal the user password. Nothing prevents the user from inadvertently entering their password on a malicious site (even though the single password is not enough to crack the account). Is that correct?

  • 1
    There is a difference between preventing phishing and preventing gathering passwords. – schroeder Nov 15 '18 at 21:52

No, and they are not saying that they can prevent the phishing of passwords. They are saying that phishing the password alone will not give the attacker access to your account.

You can enter your Gmail password in your question above and U2F will not prevent that. In the same way, a phishing site can gather credentials and U2F is not involved at any point.

The goal is that to successfully get into the account, one needs the password and the U2F device. The password is still compromised, but the account is protected against anyone who doesn't also have the physical key fob.


No, U2F does not at all prevent phishing of any kind (password or otherwise). Resilience to phishing and U2F are 2 entirely separate concerns.

The first is human (learning how to identify and avoid being phished) and the second is technical (making a product that's more hardened in cases of password compromise).

Essentially, U2F gives you an added layer of security if you are successfully phished. In that scenario, having a second method of authentication that cannot be digitally shared makes it so that, if you are phished and your username/password/etc. are fully compromised, the attacker still cannot access the protected resource. So in that sense, it certainly is intended to give resilience against the effects of successful phishing.

However, phishing is a social engineering attack. The only way to prevent it is to strengthen your human ('administrative') controls, so that people are able to avoid giving information to untrusted sources. U2F has no impact here (other than perhaps getting humans to give more thought to security).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.