Joanna Rutkowska @rootkovska
A well known attack via proxying of the token. Applies as well to computer tokens. There are only(?) two solutions AFAIK: 1. Fit a button on the token (e.g. Yubikey), 2. Introduce _latency_ limitation for the challenge-response (I heard car manufactures actually use this, no?) https://t.co/tIiSydPLD — PolitiTweet.org
Dan Kaminsky @dakami
Nobody could have possibly seen this coming https://t.co/XJuuY0JTe0