Thread by @dcuthbert

Sometimes you come across research that just blows you off your feet. This is that type of research

ninjalab.io/a-side-journey…

Simply put, Victor and Thomas performed a side-channel attack that targeted the Google Titan Security Key’s secure element (the NXP A700X chip)

Ok sure, side-channels are all the rage but they achieved this by observing local electromagnetic radiations made during ECDSA signatures (the core cryptographic operation of the FIDO U2F protocol)

Sounds super fancy but so what?

Well, an attacker can create a clone of a legitimate Google Titan Security Key.

now this doesn’t mean U2F is broken, anything but, but the research is truly wow factor.

Kudos @victorlomne and Thomas!!

The fact remains that using physical tokens such as Titan and others will put you above most when it comes to security. Use them when you can, they really do make a difference.