3 ms·
Oh that's great, alleviates my concerns, which was like, how do you know you're even asking the yubikey to do key generation rather than a malicious actor gener
by tanderson92 7y ago
Oh that's great, alleviates my concerns, which was like, how do you know you're even asking the yubikey to do key generation rather than a malicious actor generating a private key and placing it on the yubikey. Thanks!
- trishankdatadog 7y agoIf you don't trust the hardware, then don't use it. I'm not sure what solution would fit your threat model, other than building your own.
- tanderson92 7y agoI didn't say I distrusted the hardware, I said the very opposite. I said I didn't see how, before this attestation feature, you could guarantee your computer software even asked the hardware to generate the key.