4 ms·

The idea to replace CAPTCHA with FIDO doesn't seem sound, isn't it trivial to imitate it with DevTools in Chrome or some other software? https://developer.chro

The idea to replace CAPTCHA with FIDO doesn't seem sound, isn't it trivial to imitate it with DevTools in Chrome or some other software? https://developer.chrome.com/docs/devtools/webauthn/ https://developer.chrome.com/docs/devtools/webauthn/

BillinghamJ 5y ago
The attestation process is capable of cryptographically checking the device manufacturer etc (although practically I'm unsure as to whether that's really a good idea or would work well)
arsome 5y ago
I believe the idea here is you need to buy actual FIDO U2F keys and they could then be revoked on a per-key basis if you're caught abusing them as they're signed by a 3rd party so can't just be emulated. Meaning you need to buy more. Makes it expensive at least.
- Nextgrid 5y ago
  How can you revoke on a per-key basis without at the same time being able to track keys uniquely?
  - arsome 5y ago
    I'm not terribly familiar with U2F itself, but I assume the site has a way to identify you're using the right key that can be reused for this purpose?
    - tialaramex 5y ago
      When you enroll a token with a site, the token mints a random new key pair and sends the site an ID and the public key, signed with the private key. The site records the ID and public key. When you return, to confirm it's really you, the site sends one or more IDs you've enrolled and says, sign this fresh random data with one of the associated private keys. Your tokens can look at the site and an ID and decide if they made that ID for that site, if they did they sign the message with the private key, proving you are still you. If they didn't make it, they pass and maybe you own a different token that can sign, or maybe you show them a different ID they do recognise. To reuse this capability for tracking, the site would need to guess who you are first. "I guess this is arsome, they have this U2F key". But if they can guess who you are, they already don't need such tracking.
  - y7 5y ago
    Yup, you can't. Keys are perfectly trackable by Cloudflare, but they promise they won't do this. Edit: I was wrong. Cloudflare claims they could track people, but it would require tracking via cookies. [1] The hardware security keys have an "attestation key pair" that is shared among all units in one production batch (which contains at least 100K units). [2] 1: https://blog.cloudflare.com/introducing-cryptographic-attestation-of-personhood/ https://blog.cloudflare.com/introducing-cryptographic-attest... 2: https://www.w3.org/TR/webauthn-2/#sctn-attestation-privacy https://www.w3.org/TR/webauthn-2/#sctn-attestation-privacy
    - dboreham 5y ago
      No, they can't do this. It's the U2F key vendor that promises not to release a device-unique key to someone like CF.
      - y7 5y ago
        Thanks, I stand corrected.
  - dboreham 5y ago
    You can't. The device attestation protocol specifically excludes the ability to uniquely identify devices (the key has to be re-used in at least 99999 other devices).
- sdfhbdf 5y ago
  But i'm specifically asking about software. I know Touch ID can be used with WebAuthn and also see the DevTools in chrome WebAuthn debugger. Just seems easy to fool when I regenerate a key on every visit unless there is additional step I don't get.
  - arsome 5y ago
    You can't generate an attested key with the devtools. It won't be signed by a 3rd party that CloudFlare has approved.
    - sdfhbdf 5y ago
      Ok, you're right. I did miss a step!

BillinghamJ 5y ago

The attestation process is capable of cryptographically checking the device manufacturer etc (although practically I'm unsure as to whether that's really a good idea or would work well)

arsome 5y ago

I believe the idea here is you need to buy actual FIDO U2F keys and they could then be revoked on a per-key basis if you're caught abusing them as they're signed by a 3rd party so can't just be emulated. Meaning you need to buy more. Makes it expensive at least.

Nextgrid 5y ago
How can you revoke on a per-key basis without at the same time being able to track keys uniquely?
- arsome 5y ago
  I'm not terribly familiar with U2F itself, but I assume the site has a way to identify you're using the right key that can be reused for this purpose?
  - tialaramex 5y ago
    When you enroll a token with a site, the token mints a random new key pair and sends the site an ID and the public key, signed with the private key. The site records the ID and public key. When you return, to confirm it's really you, the site sends one or more IDs you've enrolled and says, sign this fresh random data with one of the associated private keys. Your tokens can look at the site and an ID and decide if they made that ID for that site, if they did they sign the message with the private key, proving you are still you. If they didn't make it, they pass and maybe you own a different token that can sign, or maybe you show them a different ID they do recognise. To reuse this capability for tracking, the site would need to guess who you are first. "I guess this is arsome, they have this U2F key". But if they can guess who you are, they already don't need such tracking.
- y7 5y ago
  Yup, you can't. Keys are perfectly trackable by Cloudflare, but they promise they won't do this. Edit: I was wrong. Cloudflare claims they could track people, but it would require tracking via cookies. [1] The hardware security keys have an "attestation key pair" that is shared among all units in one production batch (which contains at least 100K units). [2] 1: https://blog.cloudflare.com/introducing-cryptographic-attestation-of-personhood/ https://blog.cloudflare.com/introducing-cryptographic-attest... 2: https://www.w3.org/TR/webauthn-2/#sctn-attestation-privacy https://www.w3.org/TR/webauthn-2/#sctn-attestation-privacy
  - dboreham 5y ago
    No, they can't do this. It's the U2F key vendor that promises not to release a device-unique key to someone like CF.
    - y7 5y ago
      Thanks, I stand corrected.
- dboreham 5y ago
  You can't. The device attestation protocol specifically excludes the ability to uniquely identify devices (the key has to be re-used in at least 99999 other devices).
sdfhbdf 5y ago
But i'm specifically asking about software. I know Touch ID can be used with WebAuthn and also see the DevTools in chrome WebAuthn debugger. Just seems easy to fool when I regenerate a key on every visit unless there is additional step I don't get.
- arsome 5y ago
  You can't generate an attested key with the devtools. It won't be signed by a 3rd party that CloudFlare has approved.
  - sdfhbdf 5y ago
    Ok, you're right. I did miss a step!