Origin binding

As explained in Software Security for Developers

Domain binding is an authentication control that associates a credential or authentication operation with a specific web origin or domain.

Origin binding associates a hardware-key authentication operation with the website where the key was registered. The key signs requests for that domain, but refuses an identical-looking phishing site, so attackers cannot reuse the credential there. section 15.2

Real site versus phishing site

A key registered with https://securebank.com signs authentication requests for securebank.com. If https://fakebank.com presents a matching login page, the key will not sign its request. Verification also checks the challenge and origin before accepting authentication. section 15.2 section 15.4

Figure 15.3 The authentication process using a hardware key. The app generates a random value and asks the key to sign it with its private key. The app verifies the signature using its public key. The public key from the pair must already be configured at the app level. This configuration happens during the registration step.

Follow the challenge-response flow from server-generated challenge through private-key signing and public-key verification. section 15.2

How Software Security for Developers covers it

How deep it goes

Explains domain restriction and challenge-origin verification, but does not descend into protocol internals.

Examples

Uses securebank.com and fakebank.com to demonstrate why a registered key rejects a phishing origin.

What it assumes

Assumes basic login concepts while introducing hardware keys, origins, challenges, and public-key verification.

What you can do after

Evaluate WebAuthn authentication by checking both the server challenge and the requesting origin.

How it connects

Connects hardware security keys with WebAuthn, phishing attacks, challenge-response authentication, and public-key cryptography.

liveBookmanning.com

Read Software Security for Developers on liveBook Get the book at manning.com

Related concepts

• phishingaddresses · Phishing is a social-engineering attack that uses deceptive communications or content to impersonate a trusted source and induce disclosure of information or another unsafe action.

This explainer was generated by Manning's knowledge graph from the text of Software Security for Developers. The section links point to the parts of the book it draws on.