So I have looked around and haven't found this anywhere. What happens when the response server is a phishing site with FIDO U2F tokens?

Basically, if login just fails, I would assume that the user would try again a couple of times, assume that something is broken and fall back to using OTP 2 factor which defeats the purpose.

The other option would be that there would be some form of notification, which would be helpful and logical, but I havent seen anything saying that this happens.

1 Answer 1


I ended up asking Yubico about this through twitter. The authentication currently just fails, but a manufacture could add a screen to a key that would give a more helpful notification.

The default user behavior will be to try again and then circumvent the security key through a one time password, which does allow man in the middle attacks. So an important side note will be to teach users to not ever use the one time password option.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .