Two-factor authentication (2FA) is becoming an increasingly popular replacement for traditional authentication methods based primarily on passwords. Although this second factor can take several forms, the FIDO alliance has standardized the U2F (Universal Second Factor) protocol bringing a dedicated token as a factor.
This article discusses the security of these tokens with regard to their environment of use, the limitations of the specifications as well as the state of the art of the solutions provided by open source and the industry. A PoC implementing security enhancements, useful in sensitive contexts, is detailed. It is based on the open source and open hardware WooKey platform providing defense in depth against various attacker models.
Learn more about SSTIC website.
