Comments (9)
The LNURL-auth specification has protection against this. A unique key is derived for each domain you authenticate with. So the key is not shared between domains, therefore phishing is not really possible.
from luds.
1,fake site get k1 and lnurl from site on server and show lnurl to user.
2,user login with lnurl.
3,fake site refresh on server and get user credentials
fake site domain is very similar to site.
from luds.
That would just authenticate with the fake website, not the real one. A unique key being used for authentication is derived from the domain you're talking with.
See here:
Lines 8 to 11 in 0318227
from luds.
no,
my site is example.com, I can login with api.example.com.
fake site also can login with api.example.com.
from luds.
@hsjoberg I think @pynixwang is saying that the middleman would retrieve the challenge from the real site and provide that to the user out of band, and then receive the auth response from the user, allowing the middleman to apply it themselves to open a session with the real site.
from luds.
The wallet will generate a different keypair for each domain it connects to. The protection is not at the k1
level, it is at the domain name level.
The attacker can only do two things:
- Display a QR code containing the attacker domain: in this case the wallet will generate a special key for the attacker domain and that will not allow the attacker to log in at the original domain.
- Display a QR code containing the original domain: in this case the wallet will send the signature to the original domain and the attacker will not receive anything.
from luds.
the middleman would retrieve the challenge from the real site and provide that to the user out of band, and then receive the auth response from the user, allowing the middleman to apply it themselves to open a session with the real site.
@BitcoinErrorLog What do you mean by out-of-band specifically? If it's a fake website then the user would authenticate using a unique key for that domain and not the same key as they would use for the real website.
The authentication is over URL after all, and so the domain will always matter.
I suppose the man-in-the-middle attack does work if the user has only ever interacted with the fake website. But it would never work if the user already has an account on the real one.
from luds.
no,
my site is example.com, I can login with api.example.com.fake site also can login with api.example.com.
@pynixwang Yes the fake site can login to api.example.com, but it would not be the same key being used thus not the same account on the site.
from luds.
@hsjoberg but key is generated for api.example.com, not fake site
from luds.
Related Issues (20)
- Use lightning address to initiate a lnurl-auth login? HOT 4
- Support of tags in LUD-16 static identifiers HOT 3
- PIN support for withdrawRequest
- Proposal for LUD-03 spec addition: wallet must nod send an invoice with tag `h` in callback HOT 9
- Misleading "supported" table for LUD-01 in README (fallback support) HOT 2
- Unspecified response status codes HOT 1
- about README.md
- HODL invoice support HOT 3
- LUDS-06 what is the definition of number? HOT 2
- LUD-04 Spec Addition: k1 value should be optional and trigger a negotiation step like LUD-06.
- LUD-03: Provide recommendation for zero balance withdrawal response HOT 1
- Cite LNURL
- Jızık HOT 1
- Volkan ural HOT 1
- Right now it gets a new api token each time it's launched. Would be better to persist / cache it somewhere .
- "image/png;base64" not marked as mandatory nor optional HOT 2
- LUD-01: Recommendation to add CORS headers for all server responses HOT 1
- LUD-04 seems incomplete
- LUD-06 - What is "pr" HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from luds.