4 ms·

"Ultimately, in such a world, sites only operate on a single bit of information about any registration: was this public-key generated in a certified device or n

"Ultimately, in such a world, sites only operate on a single bit of information about any registration: was this public-key generated in a certified device or not? The FIDO Alliance wants to run the certification process, so then the problem reduces down to providing that bit to the site." Are we really building a web where a single organisation gets to decide which devices people can use to access any website securely? I don't know if that's worse than a web where individual sites can say "Only Windows/Android/iOS/WeChat users can create accounts here". Before long, the requirements for a "secure" device will be one which effectively implements something like DRM (i.e. has secret signing keys outside of your control), probably requiring biometrics (iris scan or fingerprint), and possibly phoning home to a government or corporation, to check for firmware updates or revocation information (i.e. a kill switch, like in AACS).

deleted 8y ago
[deleted]
yayana 8y ago
I think you can swap out FIDO in the role of certification for any other group willing to run the process of certifying devices, so it is basically just CA style PKI for client certs again but with an initial attempt at a free CA. I think FIDO specifications and most organizations feeling pressure to at least support devices they approve would mostly be good for the user. The rate FIDO will introduce more invasive behavior instead of user benefiting behavior before there is a version too common for most sites to reject is going to be related to the level proprietary dongles issued by Banks, etc, remain acceptable. In the FIDO case, the consumer actually is the customer, so negative features will have to arrive by vendors fighting their own customers interests, and pushing institutions to reject their older devices. I think they probably will, but not at the rate they can fight users when the institution is the customer.
- dane-pgp 8y ago
  A likely scenario is that, just as with mobile OSes or browsers, there will be effectively an oligarchy or cartel of approved FIDO device manufacturers, who will end up setting the rules to make it hard for new manufacturers to join the trusted set. This is basically a huge coordination problem, and there are natural barriers to entry against becoming a globally accepted provider of hardware which websites are prepared to trust. History has shown that, as long as a market appears to have two options, people will be content to choose the lesser or two evils rather than invest time and effort into changing the system to add more options.
ecesena 8y ago
So far it doesn’t seem to be the case. FIDO has done a great job of pushing the standard adoption, and finally even Safari/Apple seems to be supporting it. On the device side, there are also open source solutions (disclaimer: I work on SoloKeys). Other than Vanguard, Amazon AWS also temporarily launched support for fido2/u2f only with yubikeys, but soon after they relaxed the requirements. It might be just a marketing/co-sponsorship move. This is not to say that the risk isn’t there, but support for anonymous attestation is certainly a great feature, and it’s already available (though, not sure if implemented).

deleted 8y ago

[deleted]

yayana 8y ago

I think you can swap out FIDO in the role of certification for any other group willing to run the process of certifying devices, so it is basically just CA style PKI for client certs again but with an initial attempt at a free CA. I think FIDO specifications and most organizations feeling pressure to at least support devices they approve would mostly be good for the user. The rate FIDO will introduce more invasive behavior instead of user benefiting behavior before there is a version too common for most sites to reject is going to be related to the level proprietary dongles issued by Banks, etc, remain acceptable. In the FIDO case, the consumer actually is the customer, so negative features will have to arrive by vendors fighting their own customers interests, and pushing institutions to reject their older devices. I think they probably will, but not at the rate they can fight users when the institution is the customer.

dane-pgp 8y ago
A likely scenario is that, just as with mobile OSes or browsers, there will be effectively an oligarchy or cartel of approved FIDO device manufacturers, who will end up setting the rules to make it hard for new manufacturers to join the trusted set. This is basically a huge coordination problem, and there are natural barriers to entry against becoming a globally accepted provider of hardware which websites are prepared to trust. History has shown that, as long as a market appears to have two options, people will be content to choose the lesser or two evils rather than invest time and effort into changing the system to add more options.

ecesena 8y ago

So far it doesn’t seem to be the case. FIDO has done a great job of pushing the standard adoption, and finally even Safari/Apple seems to be supporting it. On the device side, there are also open source solutions (disclaimer: I work on SoloKeys). Other than Vanguard, Amazon AWS also temporarily launched support for fido2/u2f only with yubikeys, but soon after they relaxed the requirements. It might be just a marketing/co-sponsorship move. This is not to say that the risk isn’t there, but support for anonymous attestation is certainly a great feature, and it’s already available (though, not sure if implemented).