Is a hardware based 2FA more resistant to phishing than SMS or TOTP?

Question

As I understand, modern phishing is kind of like a man-in-the-middle attack. Let's say, for example that User u has an account in Domain d where he has an SMS based 2FA enabled. This is what the phishing mechanism is like:

1. Attacker presents a login page on a domain d' which looks similar to the login page of the domain d.
2. User u does not recognize this and he enters his credentials to this page on d'.
3. Attacker turns around and uses these credentials to login into Domain d.
4. Domain d sends u an OTP on his phone.
5. Attacker presents u an OTP verification page on domain d'.
6. User u enters this OTP on d'.
7. Attacker turns around and uses this OTP to authenticate himself on Domain d.

Now, if the user u had a hardware key, the last few steps would be very similar.

4. Domain d sends attacker a challenge.
5. Attacker reelays the challenge to the fake page on domain d'.
6. User uses his hardware key to sign the challenge.
7. Attacker turns around and submits the signed challenge to domain d, pretending to be u.

So, in what way is a hardware based authentication mechanism like yubikey better than SMS based OTP, or TOTP codes?

Answer 1

Let me start with a basic summary of some types of protection:

1. SMS. Sent via text message to mobile phone. Vulnerable to interception/spoofing, since SMS is not a secure channel.
2. TOTP Generated via TOTP device (smart phone app, key fob, etc.). TOTP codes are generated offline, so no vulnerability to interception/spoofing of the TOTP code itself. Provides no protection against phishing.
3. Security key (e.g., U2F). Generated via key fob and similar. Protects against phishing, since the challenge-response step uses a signed challenge; the phishing site won't have the key, so the response step will fail. According to google, security keys are highly effective at thwarting phishing attacks, including targeted phishing attacks.

Note that Yubikey sells both TOTP and U2F devices.

What U2F hardware accomplishes:

Where a U2F hardware beats out TOTP is when someone tries to perform a phishing attack during steps 4-7 from OP. The U2F key is bound to the origin's domain (and the authentication requires TLS), so a phishing domain cannot receive the key. SMS and TOTP are vulnerable to phishing via look-a-like domains (or inattentive users), whereas U2F will only send the response if the challenge is from the right domain.

U2F does fail if the attacker is able to acquire a valid certificate for the origin's domain. However, at that point the attacker can man-in-the-middle the post-authenticated connection and steal the user's authentication cookie, so protecting the authentication channel from such attacks provides little value regardless.

Obligatory pedantic note: Technically, U2F can use token binding to block authentication even if the attacker has a valid certificate for the origin. However, the browsers have explicitly decided it's not worth bothering to support that, probably because protecting the authentication step itself is kind of useless if the communication channel itself is compromised.

Answer 2

Your described phishing mechanism is a very specific workflow; phishing attempts are not limited to it, alone! If you think outside of this single scenario, you will be able to recognize the benefits.

With software based TOPT 2FA, the secret is not protected by a hardware layer. This means the user has (or at least had) access to the seed, making it easy to copy the entire authentication factor. In addition to malware based attacks, someone could phish this information or, e.g., take a picture of a QR code used to deliver it, as the QR code is not disposable, but has all the information required to generate the TOPT codes forever.

This QR code simply has the URL otpauth://totp/example?secret=correcthorsebatterystaple&algorithm=SHA512&digits=6&period=30

For example, Google Authenticator allows Transferring codes to new phone by revealing the secrets via QR codes. An unsuspecting user may be enticed to use this feature and pass on the QR codes.

With a hardware based TOPT the secret is stored separately, so no malware can access it directly. Also, because users do not have access to the seed, they could only give away the current TOPT code, narrowing the time window an attacker has.

Answer 3

With regard to phishing the exploited weak link is the user so very little difference in the kind of MFA used.

But there are plenty of scenarios where a user password is compromised through no fault of his/her own, and then there is a big difference between e.g. a SMS based OTP that is vulnerable to SIM swapping, and a YubiKey/SecureID that actually needs to be stolen.