3 ms·

> Your Android Phone Is a Security Key no it's not. it's pretending to be, but without vendors actually maintaining and investing in their forks and the hardwa

> Your Android Phone Is a Security Key no it's not. it's pretending to be, but without vendors actually maintaining and investing in their forks and the hardware having a known good security enclave, you might as well post your credentials on twitter.

penagwin 8y ago
Yeah I don't see how this is any different from the standard Google Authenticator style affair. Without a security enclave (which devices are starting to include) I don't see how this is an improvement.
- oneplane 8y ago
  I think that using a soft token or push notifications are better than nothing, but a company putting a (often known vulnerable) phone at the same level as a security key seems like setting a bad precedent. Then again, at least it's not SMS-verification. Perhaps in future leaks and scrapes of end-user deviced we don't just get data dumps and passwords, but also internal key seeds and tokens... It's the secure enclave and the purpose-built firmware that makes a security key a security key. I'm sure some specific Android devices have a safe implementation, and I'm sure that some SIM cards and perhaps the recent iPhone Secure Elements have properties that allow them to be safely used as a security key, but putting it forward that phones can be seen and used that way in general lacks that important distinction.
- verdverm 8y ago
  Connects via Bluetooth to the device you wish to sign into.
- lern_too_spel 8y ago
  Android 7 added support for key attestation, making it possible to verify that a key came from a secure enclave. That's presumably why the blog post says Android 7 and above. https://source.android.com/security/keystore https://source.android.com/security/keystore
- christiaanbrand 8y ago
  It’s resistant against phishing. That’s solving the problem. OTPs are not.
Rafert 8y ago
That's a bit snarky. As other commenters mentioned, it can leverage TEEs using the Android Keystore for secure storage. And the way WebAuthn works means users are protected in case of a database breach (it contains only public keys) and the protocol protects against phishing. Both are ways better than usernames and passwords. It got certified (at level 1[0]) too, in case that changes your mind: https://fidoalliance.org/android-now-fido2-certified-accelerating-global-migration-beyond-passwords/ https://fidoalliance.org/android-now-fido2-certified-acceler... [0]: https://fidoalliance.org/certification/authenticator-certification-levels/authenticator-level-1/ https://fidoalliance.org/certification/authenticator-certifi...
- oneplane 8y ago
  I was intended to be a bit snarky indeed. I know TEE's and remote attestation are supposed to help out here, but I also know that even a purpose-designed chip couldn't get it right the first few times (think MIFARE NFC, TPMs and YubiKeys with Infineon cores). It's a very hard problem, and making light of it by having marketing (big assumption) play it as if a phone is now a security key seems a bit of a leap here. At the same time, WebAuthn is better in itself but still not the silver bullet versus passwords and a password manager. We don't live in an ideal world of course, but if we are going to turn commodity multipurpose devices into soft tokens, we might as well name it as such. (but naming it that way definitely doesn't have the same ring to it: "Your Phone is a Soft Token").
vbezhenar 8y ago
I don't see how it's less secure than storing passwords in ~/Documents/Passwords.txt. And it's a second factor, so combined with first factor the result is pretty secure. You can't browse other people phones, even without security enclave.
- oneplane 8y ago
  Websites running javascript weren't supposed to browse other people's computers either, but we all know how that assumption went. Yes, it has gotten better the past few years, but the whole point of a security key is that it takes a purpose-designed piece of hardware and software, with a minimal attack surface. A phone is far from it.
rrdharan 8y ago
We could test this claim pretty easily: - you post your credentials on Twitter - I'll store mine using this Android Phone Let's see who gets hacked first!

penagwin 8y ago

Yeah I don't see how this is any different from the standard Google Authenticator style affair. Without a security enclave (which devices are starting to include) I don't see how this is an improvement.

oneplane 8y ago
I think that using a soft token or push notifications are better than nothing, but a company putting a (often known vulnerable) phone at the same level as a security key seems like setting a bad precedent. Then again, at least it's not SMS-verification. Perhaps in future leaks and scrapes of end-user deviced we don't just get data dumps and passwords, but also internal key seeds and tokens... It's the secure enclave and the purpose-built firmware that makes a security key a security key. I'm sure some specific Android devices have a safe implementation, and I'm sure that some SIM cards and perhaps the recent iPhone Secure Elements have properties that allow them to be safely used as a security key, but putting it forward that phones can be seen and used that way in general lacks that important distinction.
verdverm 8y ago
Connects via Bluetooth to the device you wish to sign into.
lern_too_spel 8y ago
Android 7 added support for key attestation, making it possible to verify that a key came from a secure enclave. That's presumably why the blog post says Android 7 and above. https://source.android.com/security/keystore https://source.android.com/security/keystore
christiaanbrand 8y ago
It’s resistant against phishing. That’s solving the problem. OTPs are not.

Rafert 8y ago

That's a bit snarky. As other commenters mentioned, it can leverage TEEs using the Android Keystore for secure storage. And the way WebAuthn works means users are protected in case of a database breach (it contains only public keys) and the protocol protects against phishing. Both are ways better than usernames and passwords. It got certified (at level 1[0]) too, in case that changes your mind: https://fidoalliance.org/android-now-fido2-certified-accelerating-global-migration-beyond-passwords/ https://fidoalliance.org/android-now-fido2-certified-acceler... [0]: https://fidoalliance.org/certification/authenticator-certification-levels/authenticator-level-1/ https://fidoalliance.org/certification/authenticator-certifi...

oneplane 8y ago
I was intended to be a bit snarky indeed. I know TEE's and remote attestation are supposed to help out here, but I also know that even a purpose-designed chip couldn't get it right the first few times (think MIFARE NFC, TPMs and YubiKeys with Infineon cores). It's a very hard problem, and making light of it by having marketing (big assumption) play it as if a phone is now a security key seems a bit of a leap here. At the same time, WebAuthn is better in itself but still not the silver bullet versus passwords and a password manager. We don't live in an ideal world of course, but if we are going to turn commodity multipurpose devices into soft tokens, we might as well name it as such. (but naming it that way definitely doesn't have the same ring to it: "Your Phone is a Soft Token").

vbezhenar 8y ago

I don't see how it's less secure than storing passwords in ~/Documents/Passwords.txt. And it's a second factor, so combined with first factor the result is pretty secure. You can't browse other people phones, even without security enclave.

oneplane 8y ago
Websites running javascript weren't supposed to browse other people's computers either, but we all know how that assumption went. Yes, it has gotten better the past few years, but the whole point of a security key is that it takes a purpose-designed piece of hardware and software, with a minimal attack surface. A phone is far from it.

rrdharan 8y ago

We could test this claim pretty easily: - you post your credentials on Twitter - I'll store mine using this Android Phone Let's see who gets hacked first!