evilgophish VS webusb

https://github.com/fin3ss3g0d/evilgophish comes shipped with SMS phishing capabilities, and is a combination of gophish and evilginx2 with Apache2 proxy in front

As part of this process, I started looking at the various avenues of attack that could bypass FIDO/FIDO2/U2F MFA style authentication. Previously I would use something like EvilGoPhish to phish employees/customers and steal their session cookies to bypass MFA but this does not work with U2F.

All evilginx2 fans checkout this project that provides campaign statistics for evilginx2 campaigns in the GoPhish dashboard and a real-time end-to-end encrypted feed https://github.com/fin3ss3g0d/evilgophish

> WebUSB is actually a W3C open standard.

This is misleading at best. Here’s what the actual spec says <https://wicg.github.io/webusb/>:

> This specification was published by the Web Platform Incubator Community Group. It is not a W3C Standard nor is it on the W3C Standards Track.

It’s an experimental spec by Google (observe the affiliation of the three editors: all Google); Mozilla has adopted a negative position on it <https://mozilla.github.io/standards-positions/#webusb>; WebKit has not remarked upon it.

This is such a lame argument. You want it to be true but have no evidence that it actually is true.

A lot of the Chrome team's "standards" have problems with accessibility, workability on mobile, security[0], privacy[1], or just battery life. Some are neat experiments that are or only will be used in the wild by advertisers to track and identify users.

Because the Safari/WebKit team doesn't have to chase users for revenue like Mozilla does they can afford to be more conservative with what Google "standards" they support. Being able to offer a tighter privacy posture or efficiency is part of the iOS/macOS sales pitch.

[0] https://github.com/WICG/webusb/issues/50

[1] https://www.theverge.com/2021/4/16/22387492/google-floc-ad-t...

Limiting it to installed apps still has the problem of users blindly agreeing to something that is fundamentally super dangerous. I don’t believe installing PWAs currently exposes any new security surface, so this would be a significant change, and worse still a persistent hazard with probably no indication of what’s going on when it’s in use. I think there’s still potential in the general concept, but it’d take work and is certainly not ready yet in any browser.

Yes, certain classes are restricted from access via WebUSB for security, https://wicg.github.io/webusb/#protected-interface-classes. But as the note says, it’s about balance: that list is necessary for security, but not sufficient.