English
Menu

Cyber Attacks and Defense in Practice

Which of the following is the correct reason why authentication with FIDO2 (WebAuthn) passkeys is considered more resistant to phishing than one-time passwords (OTPs)?

  1. AThe private-key signature is bound to the domain being connected to, so a fake site cannot obtain a signature for the real site, and relaying it is useless
  2. BA passkey is a six-digit number, which has fewer digits than an OTP, so the time until a user enters it on a fake site is also shorter
  3. CWith passkeys, the user's password is stored on the server, so even if it is entered on a fake site, the check on the server reveals the fraud
Show answer and explanation

Answer: A. The private-key signature is bound to the domain being connected to, so a fake site cannot obtain a signature for the real site, and relaying it is useless

An OTP is a value the user reads and types, so it cannot prevent attacks that get it entered on a fake site and immediately relay it to the real site (adversary-in-the-middle phishing). In FIDO2, a pair of public and private keys is created for each site and only the public key is registered with the site; at login, the authenticator signs a value sent by the site (the challenge) with the private key. Which site's key is used is decided by the actual domain being connected to as verified by the browser, and the signed information also includes that origin, so a fake site cannot obtain a signature for the real site. And since the server stores only the public key, a leak from the server cannot be used for impersonation.

  • A. Correct. The signature is bound to the domain being connected to, so a fake site cannot obtain a usable signature.
  • B. A passkey is not entered as a number; it is a method of signing with a private key inside the device.
  • C. With passkeys, a public key, not a password, is registered on the server.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. A web service saw a large number of login attempts from many different IP addresses, each using a different user's ID and password pair, and some succeeded. Many of the pairs tried matched ones leaked from other services. What is this attack called?
  2. At a cloud email service that uses multi-factor authentication, an employee was lured to a login screen that looked exactly like the real one and entered a password and a one-time password. The attacker used that screen as a relay to the real service, stole the session cookie issued after login and impersonated the employee. Which of the following most appropriately describes this attack and the countermeasures?
  3. Which of the following is the most appropriate idea of privileged access management (PAM) for protecting server administrator accounts?
  4. A developer accidentally committed a configuration file containing an API key for a cloud service to a public Git repository. On noticing, the developer immediately committed a change deleting the file. Which of the following is the most appropriate response after this?
  5. For four incidents at an organization, the time from occurrence to detection and the time from detection to containment were 10 hours and 4 hours for incident 1, 30 hours and 2 hours for incident 2, 2 hours and 6 hours for incident 3, and 6 hours and 4 hours for incident 4. Which of the following is the correct combination of the mean time from occurrence to detection (MTTD) and the mean time from detection to containment (MTTC)?

Comparisons in this topic