Assurance

[Tom Scavo <>]

On Thu, Apr 17, 2014 at 4:06 PM, David Walker 
<>
 wrote:
>
> I was just reading the FIDO Alliance's U2F overview
> (https://fidoalliance.org/specs/fido-u2f-overview-v1.0-rd-20140209.pdf),
> and I think they have a solution to this issue.  They use public key
> cryptography, though not PKI, for mutual authentication of the service
> and the token, which (I think) should defeat this kind of
> man-in-the-middle vulnerability.

Duo Push uses public key crypto as well:

https://www.duosecurity.com/blog/heartbleed-defense-in-depth-part-2

but that still doesn't prevent a MiTM (as discussed earlier in the
thread). Doesn't U2F require a button push by the user? If so, then
how does it avoid this problem?

Tom