Browser
to the key over USB
https://
/login
rpId
origin
challenge
registered
this page
Inside the key
asked
stored
example.com server
✓
Challenge is the one it sent
✓
Origin is https://example.com
✓
rpIdHash is SHA-256 of example.com
✓
User-present flag is set
✓
Signature checks out with the stored public key
examp1e.com relay
example.com
Back
Real site
, example.com
Lookalike
, examp1e.com
Next
Explode
Cutaway
Drag to orbit. Scroll to explode. Pinch or ctrl-scroll to zoom. Hover a part to see its job.
Show notes