Detalhes
Nome
Luís Esquível CostaCargo
Assistente de InvestigaçãoDesde
01 outubro 2018
Nacionalidade
PortugalCentro
Laboratório de Software ConfiávelContactos
+351253604440
luis.e.costa@inesctec.pt
2023
Autores
Barbosa, M; Cirne, A; Esquível, L;
Publicação
18TH INTERNATIONAL CONFERENCE ON AVAILABILITY, RELIABILITY & SECURITY, ARES 2023
Abstract
FIDO2 is becoming a defacto standard for passwordless authentication. Using FIDO2 and WebAuthn, web applications can enable users to associate cryptographic credentials to their profiles, and then rely on an external authenticator (e.g., a hardware token plugged into the USB port) to perform strong signature-based authentication when accessing their accounts. The security of FIDO2 has been theoretically validated, but these analyses follow the threat model adopted in the FIDO2 design and explicitly exclude some attack vectors as being out of scope. In this paper we show that two of these attacks, which appear to be folklore in the community, are actually straightforward to launch in practice (user PIN extraction, impersonation and rogue key registration). We demonstrate a deployment over vanilla Linux distributions and commercial FIDO2 authenticators. We discuss the potential impact of our results, which we believe will contribute to the improvement of future versions of the protocol.
The access to the final selection minute is only available to applicants.
Please check the confirmation e-mail of your application to obtain the access code.