3 ms·

> We also have to consider the possibility of facing automated button-pressing systems. A drinking bird able to press the capacitive touch sensor could pass the

> We also have to consider the possibility of facing automated button-pressing systems. A drinking bird able to press the capacitive touch sensor could pass the Cryptographic Attestation of Personhood. At best, the bird solving rate matches the time it takes for the hardware to generate an attestation. With our current set of trusted manufacturers, this would be slower than the solving rate of professional CAPTCHA-solving services, while allowing legitimate users to pass through with certainty. Is it true that most of these FIDO keys try to prevent automation by, for example, requiring someone to activate a button on the device?

doomrobo 5y ago
Short answer: yes. I don't think they intend to support U2F hardware that lends itself to automation. I doubt any reputable manufacturer even makes these, since it defeats the purpose to begin with.
tablespoon 5y ago
> Is it true that most of these FIDO keys try to prevent automation by, for example, requiring someone to activate a button on the device? All the security keys I have require a human to be in the loop by pressing a button, but I don't think that's to prevent automation. I think it's to prevent a hacker who has control of your device from being able to use your 2FA token remotely. > With our current set of trusted manufacturers, this would be slower than the solving rate of professional CAPTCHA-solving services, while allowing legitimate users to pass through with certainty. Are those solving services automated, or do they just exploit low-paid humans doing mechanical-turk tasks? If it's the latter, I could totally see that changing quickly with a bunch of machines with 50+ port USB hubs filled with security keys.
nybble41 5y ago
Most devices require some sort of out-of-band signal to generate an attestation, but this is fairly trivial to bypass if you wanted to automate the process. They used the example of a mechanical Rube Goldberg contraption to press the button, but you could also do it more reliably by connecting a circuit to the touch sensor. I also see no reason why the process couldn't be sped up, at least in aggregate, by using multiple keys and activating them in sequence.

doomrobo 5y ago

Short answer: yes. I don't think they intend to support U2F hardware that lends itself to automation. I doubt any reputable manufacturer even makes these, since it defeats the purpose to begin with.

tablespoon 5y ago

> Is it true that most of these FIDO keys try to prevent automation by, for example, requiring someone to activate a button on the device? All the security keys I have require a human to be in the loop by pressing a button, but I don't think that's to prevent automation. I think it's to prevent a hacker who has control of your device from being able to use your 2FA token remotely. > With our current set of trusted manufacturers, this would be slower than the solving rate of professional CAPTCHA-solving services, while allowing legitimate users to pass through with certainty. Are those solving services automated, or do they just exploit low-paid humans doing mechanical-turk tasks? If it's the latter, I could totally see that changing quickly with a bunch of machines with 50+ port USB hubs filled with security keys.

nybble41 5y ago

Most devices require some sort of out-of-band signal to generate an attestation, but this is fairly trivial to bypass if you wanted to automate the process. They used the example of a mechanical Rube Goldberg contraption to press the button, but you could also do it more reliably by connecting a circuit to the touch sensor. I also see no reason why the process couldn't be sped up, at least in aggregate, by using multiple keys and activating them in sequence.