Re: Man-in-the-middle attack against WebAuthn by a powerful attacker

This attack would imply at least partial control of networking
infrastructure (client routing or RP DNS) and of a legitimate CA, meaning
it is either an enterprise policy, an attack based on enterprise policy, or
state actor attack.

Typically I would expect this to be solved by some form of certificate
transparency or certificate pinning:
- `HPKP` was a previous solution for this, but was unfortunately abusable
and will never see wide adoption
- Certificate Transparency (and the `Expect-CT` header) allow a site to opt
into certificate transparency for browsers that support it
- Including the TLS thumbprint of the TLS Certificate in `clientDataJSON`
(when token binding is not supported) would allow the RP infrastructure to
validate against a whitelist of TLS certificates.

On Thu, Feb 21, 2019 at 2:29 PM Mart Sõmermaa <mart.somermaa@gmail.com>
wrote:

> Hello!
>
> Have you considered that origin validation is not a sufficient
> countermeasure against man-in-the-middle attacks in case of a powerful
> attacker who controls responses to user's DNS requests and has a valid
> certificate that is trusted by the user's browser for the target host?
>
> Full details of the attack here:
>
> https://gitlab.com/mrts/webauthn-additions/wikis/Man-in-the-middle-attack-against-WebAuthn-by-a-powerful-attacker
>
> I have a proposal how to mitigate this, but I would like to hear
> your thoughts regarding this first.
>
> Thanks in advance for looking into this,
> Mart Sõmermaa
>


-- 
<https://www.pingidentity.com>[image: Ping Identity]
<https://www.pingidentity.com>
David Waite
Principal Technical Architect, CTO Office
dwaite@pingidentity.com
w: 303 468 2855
Connect with us: [image: Glassdoor logo]
<https://www.glassdoor.com/Overview/Working-at-Ping-Identity-EI_IE380907.11,24.htm>
[image:
LinkedIn logo] <https://www.linkedin.com/company/21870> [image: twitter
logo] <https://twitter.com/pingidentity> [image: facebook logo]
<https://www.facebook.com/pingidentitypage> [image: youtube logo]
<https://www.youtube.com/user/PingIdentityTV> [image: Google+ logo]
<https://plus.google.com/u/0/114266977739397708540> [image: Blog logo]
<https://www.pingidentity.com/en/blog.html>
<https://4.pingidentity.com/WB-2019.2.27apiinnovators_lpWebinarRegistration..html?utm_medium=webinar&utm_source=Direct%20to%20Website&utm_campaign=WB-2019.2.27apiinnovators-WEB>

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._