0

What are the risks of sticking a FIDO U2F USB key like Google's Titan into a computer that is hacked?

The hacking I am thinking about is unauthorized access and control over an operating system. In this case, the hacker who stealthily can control the operating system is a malicious agent that ex-filtrates information with the intent to harm those who rely on the computer.

I presume FIDO key is a hardware device that contains code that I can associate with an online user account and use to authenticate myself to the online service.

By risks, I am wondering whether the information in the key can be copied or used by malicious agents if I used it in a hacked computer. I don't know how this technology works (I've never used a FIDO key), but I am thinking about getting one. So I cannot list risks, but I would like to learn about potential negative scenarios.

u20210512
  • 159
  • 1
  • 2
  • 9

1 Answers1

1

A lot of FIDO (and hardware token in general) anti-phishing protection rests on the local client software (i.e. the web browser) accurately reporting the request origin to the device.

The FIDO hardware token will never reveal its keys to the host computer (a lot like a smartcard), but it can be sent a different authentication request than what you're seeing on the computer's screen – there's no direct coupling between the display and the token, it all rests on the OS and the local apps not lying.

For example, with an "improved" browser:

  1. You navigate to website A, attempt to log in, get a FIDO token prompt.

  2. This causes the browser to also quietly load website G, simulate a login attempt (maybe even trying the same password you just entered on A), get a FIDO token prompt without showing it on screen.

  3. You touch the FIDO token, thinking it's blinking because it received a request for website A. Instead, you're approving a request for website G.

  4. Nothing seems to happen, you think the touch didn't register because the token is still blinking (which it is because now it's handling the request for website A), you touch it again and forget about it.

grawity
  • 501,077