4 ms·

The bad side of U2F is that it looks like yet another push of treacherous computing acceptance. It has attestation certificates that end-user (both legal and ph

The bad side of U2F is that it looks like yet another push of treacherous computing acceptance. It has attestation certificates that end-user (both legal and physical token owner) isn't supposed to have any control over. SQRL is much simpler and doesn't have that.

nickik 9y ago
Seems to me the attestation certificates allow people who want to restrict the type of token to do that in a reliable way. Let's say you are a bank, you want to use U2F or UAF. Some cheap 5$ U2F stick is not acceptable, you want to require some high quality stick from trustworthy people. Or maybe you even want to give your costumers costume sticks. In UAF its even more important. You want to be able to reliable exclude Finger Print sensors or something like that. It adds security and options. As long as the certification is not highly restricted I don't see it as a problem.
- drdaeman 9y ago
  > You want to be able to reliable exclude As a vendor - oh, yes, of course, I would absolutely enjoy as much control as possible. As an end-user - nope, I want to decide on my trust vectors on my own. Even if I'm utterly delusional about my abilities to do so. I just believe that a freedom to make a decision - even a terribly wrong one - is better than a secure lack of any. I don't want "trusted" authentication tokens to access sites from a "trusted" browser on a "trusted" OS to be displayed on a "trusted" monitor and so on[1]. Even if that makes world much more secure place. ________ [1] Yes, that sounds far-fetched and alarmist, but it's really all the same - end user is out of control and "their" hardware is attested for the sake of security. We're already knee-deep in there, please don't let it spread on more things, gradually gaining acceptance.
  - nickik 9y ago
    I just don't think banks and so on would adopt the technology otherwise. This system makes it possible to use the same protocol for super high security application where you require a UAF authenticater with its own keyboard and screen. A bank just be hacked because somebody used a sup-par authenticater. The good thing is that while a bank can force you to use some specific device, they can not stop you from using that same device in other places.
    - drdaeman 9y ago
      Lagging behind, but I'm sure they will. Here, banks used to implement proprietary measures. ActiveX or Java applets, custom encrypting HTTP proxies, nonsensical password policies and all other sorts of weirdness you can imagine. It's still not unheard of (because those institutions are extremely inert), but I'm absolutely sure the norm is shifting. Saner stuff gets adopted. And until they don't - YMMV, but that's okay with me. Personally, I'm better with them lagging behind, rather than leading us to the "trusted" computing future. Security is important and nice, but not when it has adverse side effects.
- zxcvbn4038 9y ago
  I've wondered why Yubico is the only u2f device manufacturer that has released a root certificate which validates the attestation certificates that the keys provide - maybe it is to discourage their use so they can't be locked out reliably?

nickik 9y ago

Seems to me the attestation certificates allow people who want to restrict the type of token to do that in a reliable way. Let's say you are a bank, you want to use U2F or UAF. Some cheap 5$ U2F stick is not acceptable, you want to require some high quality stick from trustworthy people. Or maybe you even want to give your costumers costume sticks. In UAF its even more important. You want to be able to reliable exclude Finger Print sensors or something like that. It adds security and options. As long as the certification is not highly restricted I don't see it as a problem.

drdaeman 9y ago
> You want to be able to reliable exclude As a vendor - oh, yes, of course, I would absolutely enjoy as much control as possible. As an end-user - nope, I want to decide on my trust vectors on my own. Even if I'm utterly delusional about my abilities to do so. I just believe that a freedom to make a decision - even a terribly wrong one - is better than a secure lack of any. I don't want "trusted" authentication tokens to access sites from a "trusted" browser on a "trusted" OS to be displayed on a "trusted" monitor and so on[1]. Even if that makes world much more secure place. ________ [1] Yes, that sounds far-fetched and alarmist, but it's really all the same - end user is out of control and "their" hardware is attested for the sake of security. We're already knee-deep in there, please don't let it spread on more things, gradually gaining acceptance.
- nickik 9y ago
  I just don't think banks and so on would adopt the technology otherwise. This system makes it possible to use the same protocol for super high security application where you require a UAF authenticater with its own keyboard and screen. A bank just be hacked because somebody used a sup-par authenticater. The good thing is that while a bank can force you to use some specific device, they can not stop you from using that same device in other places.
  - drdaeman 9y ago
    Lagging behind, but I'm sure they will. Here, banks used to implement proprietary measures. ActiveX or Java applets, custom encrypting HTTP proxies, nonsensical password policies and all other sorts of weirdness you can imagine. It's still not unheard of (because those institutions are extremely inert), but I'm absolutely sure the norm is shifting. Saner stuff gets adopted. And until they don't - YMMV, but that's okay with me. Personally, I'm better with them lagging behind, rather than leading us to the "trusted" computing future. Security is important and nice, but not when it has adverse side effects.
zxcvbn4038 9y ago
I've wondered why Yubico is the only u2f device manufacturer that has released a root certificate which validates the attestation certificates that the keys provide - maybe it is to discourage their use so they can't be locked out reliably?