4 ms·
> which U2F devices will magically not work? Atleast Krypton doesnt' work, neither do Titan keys it seems. I would consider they did that on purpose in some k
by holstvoogd 8y ago
> which U2F devices will magically not work?
Atleast Krypton doesnt' work, neither do Titan keys it seems.
I would consider they did that on purpose in some kind of deal with yubico. But given the general level of 'buring-pile-of-failure' AWS manages to produce around the console, it is probably just that they didn't know
- tialaramex 8y agoIf they require attestation that's one more reason I won't be using this, sadly. I always block attestation because there's no need for it when you're supposedly offering an optional second factor, even though I actually do own a Yubico product. It makes no security sense to check attestation if your second factor is optional. How could a non-Yubico second factor make things worse compared to not using one? It couldn't. If you really, really care then store the attestations so that when fifty customers claim their U2F was broken into you can show that they all have Crap Co. FIDO tokens and point the finger at Crap Co. that's the absolute most that makes any sense with attestation. Now, if second factor is _mandatory_ then it could make sense to decide OK, we trust Mattel, Apple and LexCorp but not HP, Tyrell Corp, or Weyland-Yutani. It's anticipated that banks (in fifty years when they hear about this new-fangled FIDO technology) would want that, giving customers their own tokens with their own attestation certs. But for an outfit like AWS this option makes no sense, so the correct design is to Never Ask, and if some higher-up insists on asking, just store the answer (including "No, fuck off") with the user's account and press on anyway.
- lvh 8y agoI'm hearing confirmations that it's just Yubico, yes.