4 ms·

> But that's not a solution. If user authorization to certificates are based off passwords, for example, then what prevents an attacker from taking compromised

> But that's not a solution. If user authorization to certificates are based off passwords, for example, then what prevents an attacker from taking compromised data about me and using that to get access to passwords? Maybe I'm misunderstanding your point, but an attacker will also need physical access to your authenticator. That's a much less scalable attack vector. As for a real problem, others pointed out phishing already. U2F and Webauthn aren't just a certificate management solution, but a protocol for the user agent to make trusted statements to the server.

not_that_noob 9y ago
Attackers don't bother stealing physical tokens - way too hard. It's much easier to ask for token re-issue using compromised info. See for example https://www.techlicious.com/blog/phone-porting-scam-can-empty-bank-account/ https://www.techlicious.com/blog/phone-porting-scam-can-empt...
- arnarbi 9y ago
  Right, if a service provider is willing to register new public keys/certs (or any kind of credential) on your account as a result of identity fraud, that is indeed a different problem. But not nearly as big as phishing and password reuse. So, I don't see how the presence of that problem suggests it's not worthwhile to work on better types of credentials.
  - not_that_noob 9y ago
    If one link of the chain is broken, it's game over. While this is a good effort, my point is that not considering the entire system as a whole simply transfers problems from one part of the domain to another.
    - krupan 9y ago
      You are right in a sense. Right now the problem is up to individuals to create secure passwords for each and every website they interact with. People that have no idea how computer security works. The problem now is also on individual website developers to be trusted with those passwords and keep them secure. This transfers the problem away from both of those groups. Individual no longer have to create multiple secure passwords and website developers no longer have to store those precious secrets. This is a huge improvement. You are correct that it's not perfect, but instead of security pros spending all their energy teaching people how to manage passwords, they can focus on the remaining problems that you point out.
    - djrogers 9y ago
      > simply transfers problems from one part of the domain to another. No, it completely eliminates several huge vulnerability domains. Just because it doesn't solve a different one doesn't make it bad.

not_that_noob 9y ago

Attackers don't bother stealing physical tokens - way too hard. It's much easier to ask for token re-issue using compromised info. See for example https://www.techlicious.com/blog/phone-porting-scam-can-empty-bank-account/ https://www.techlicious.com/blog/phone-porting-scam-can-empt...

arnarbi 9y ago
Right, if a service provider is willing to register new public keys/certs (or any kind of credential) on your account as a result of identity fraud, that is indeed a different problem. But not nearly as big as phishing and password reuse. So, I don't see how the presence of that problem suggests it's not worthwhile to work on better types of credentials.
- not_that_noob 9y ago
  If one link of the chain is broken, it's game over. While this is a good effort, my point is that not considering the entire system as a whole simply transfers problems from one part of the domain to another.
  - krupan 9y ago
    You are right in a sense. Right now the problem is up to individuals to create secure passwords for each and every website they interact with. People that have no idea how computer security works. The problem now is also on individual website developers to be trusted with those passwords and keep them secure. This transfers the problem away from both of those groups. Individual no longer have to create multiple secure passwords and website developers no longer have to store those precious secrets. This is a huge improvement. You are correct that it's not perfect, but instead of security pros spending all their energy teaching people how to manage passwords, they can focus on the remaining problems that you point out.
  - djrogers 9y ago
    > simply transfers problems from one part of the domain to another. No, it completely eliminates several huge vulnerability domains. Just because it doesn't solve a different one doesn't make it bad.