1

enter image description here

In this question: Is FIDO2 authentication vulnerable to a social engineering replay attack?

it was answered that no, not vulnerable because "the keypair used to by the FIDO device to authenticate with the credential harvesting site would be different than the keypair used to authenticate with the legitimate site".

But what if the attacker is not a website, but rather just a man in the middle in the middle of the channel between client and server? So an attacker that justs observes the traffic and once the challenge response arrives from the client, he cuts off the client and now HE(the attacker) IS authenticated.

1 Answer 1

1

But what if the attacker is not a website, but rather just a man in the middle in the middle of the channel between client and server? So an attacker that justs observes the traffic and once the challenge response arrives from the client, he cuts off the client and now HE(the attacker) IS authenticated.

FIDO is not intended to protect against that. TLS is.

MITMing a website would require being able to provide a valid trusted certificate for that domain. FIDO relies on this fact.

As you quite correctly observe, without TLS, stealing an authenticated session is trivial if you can observe the traffic.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .