BitBoxSwiss / mcu

MCU code for the BitBox01 hardware wallet
https://shiftcrypto.ch
Other
63 stars 50 forks source link

update u2f hijack whitelist for vintage MEW and latest Chrome #264

Closed douglasbakkum closed 5 years ago

douglasbakkum commented 5 years ago

MyEtherWallet redid their website and put the old version of MEW at vintage.myetherwallet.com.

In addition, the 'hijack code' was changed from the U2F challenge parameter to the appId parameter, as the latter is a more stable representation of the website origin (for anti-phishing purposes). This was made apparent as the latest Chrome version changed how the challenge parameter was computed.