Web Security & OWASP (50 Qs)•Part 3: Authentication, Authorization & Cryptographic Standards (26 - 35)
Multi-Factor Authentication (MFA): TOTP (RFC 6238) vs. FIDO2 / WebAuthn / Passkeys.
Time-Based OTP vs. Phishing-Resistant FIDO2
Not all Multi-Factor Authentication methods provide equal security. SMS and standard TOTP authenticator apps are vulnerable to real-time Adversary-in-the-Middle (AiTM) phishing proxies (e.g., Evilginx).
sql
AiTM Phishing Attack against TOTP:
[ Victim ] ---> Enters Password & TOTP Code into Phishing Site (evil-bank.com)
|
v
[ Attacker Proxy ] ---> Relays Code to Real Bank (bank.com) ---> Gets Session Cookie!
Why FIDO2 / WebAuthn / Passkeys Defeat Phishing:
The browser cryptographically binds the challenge to the ACTUAL domain in the URL bar:
Origin: "evil-bank.com"
Hardware Authenticator (YubiKey / TouchID) signs challenge for "evil-bank.com".
Attacker forwards signature to real bank.com.
Real bank.com REJECTS signature because origin does not match "bank.com"!
Technical Mechanism Comparison
| Feature | TOTP (RFC 6238) | FIDO2 / WebAuthn / Passkeys |
|---|---|---|
| Cryptography | Shared Secret Key (HMAC-SHA1). | Asymmetric Public/Private Key pair. |
| Delivery | Google Authenticator, Authy (6-digit code). | Hardware Token (YubiKey), Apple TouchID, Windows Hello. |
| Phishing Resistance | VULNERABLE to AiTM reverse proxies. | 100% PHISHING-RESISTANT (domain-bound). |
| Credential Storage | Secret key stored on server and user phone. | Private key never leaves hardware authenticator chip. |