4 ms·
Not disagreeing. Note however that I'm talking about the authenticator. If that is compromised, then the attacker now has access to all keys.
by not_that_noob 9y ago
Not disagreeing. Note however that I'm talking about the authenticator. If that is compromised, then the attacker now has access to all keys.
- krupan 9y agoAll keys, for one person That is not great, but it's much much better than the 500 million people in the Have I Been Pwned database.
- pfg 9y agoI'm not exactly sure what your threat model is, then. The typical way this gets deployed is with U2F USB devices with non-extractable keys. "Access to all keys" is not exactly technically feasible. If your concern is "well, there's always the admin/support backdoor", i.e. a compromised admin account or a social engineering attack on support personell could lead to attacker-controlled keys being enrolled, I'm afraid that's not really something you can solve by just throwing new technology at the problem. However, you'll definitely make it harder to even get to the point where admin accounts are compromised by rolling out U2F or webauthn. Personally, I'm perfectly fine with a technical solution that solves phishing for everything but the most advanced social engineering campaigns.
- lvh 9y agoIf an attacker compromises the credential, the credential is useless, yes? The credential is still customized _per origin_, so you'd have to decap the U2F key to extract the secret. This hardware is specifically designed to make that hard to do.