2 ms·

I’d rather take these tradeoffs than doing 5 steps of Recaptcha because I’m using a VPN to work, which as Cloudflares announcement said, is very localized to No

I’d rather take these tradeoffs than doing 5 steps of Recaptcha because I’m using a VPN to work, which as Cloudflares announcement said, is very localized to North America and likely extra complicated for those outside the region. In theory, couldn’t Yubikey begin reducing batch sizes to 1,000 and Cloudflare mark specific batch numbers as requiring one extra step to verify? The vast majority of Yubikey sales will be for real people in any case.

kylehotchkiss 5y ago
And if Yubikey could reduce batch sizes - could they require bulk non-wholesale orders to retain the same batch ID to reduce likelihood of abuse?
- SXX 5y ago
  This won't work because guess what? Bad actors have money and means to buy as many devices as needed through individuals. Most of the abuse that CloudFlare protects from is also usually illegal. And those taking risk of doing something illegal usually do it because it's highly profitable so making some authentification devices a bit more expensive won't make any difference.
livre 5y ago
Wouldn't reducing batch sizes make privacy even more of a problem? Now instead of a 1/100000 chance of the user being the same person on another website there would be a 1/1000 chance.
- makomk 5y ago
  Yeah, except that because the other 999 users probably wouldn't be using Tor to access the same websites, in practice this would be pretty much guaranteed to give a highly accurate, persistent tracking identifier.
md_ 5y ago
The batch size requirement is imposed by the FIDO spec, to ensure that batch IDs are not so high entropy as to pose a privacy problem. "In this Full Basic Attestation model, a large number of authenticators must share the same Attestation certificate and Attestation Private Key in order to provide non-linkability (see Protocol Core Design Considerations). Authenticators can only be identified on a production batch level or an AAID level by their Attestation Certificate, and not individually. A large number of authenticators sharing the same Attestation Certificate provides better privacy, but also makes the related private key a more attractive attack target."

kylehotchkiss 5y ago

And if Yubikey could reduce batch sizes - could they require bulk non-wholesale orders to retain the same batch ID to reduce likelihood of abuse?

SXX 5y ago
This won't work because guess what? Bad actors have money and means to buy as many devices as needed through individuals. Most of the abuse that CloudFlare protects from is also usually illegal. And those taking risk of doing something illegal usually do it because it's highly profitable so making some authentification devices a bit more expensive won't make any difference.

livre 5y ago

Wouldn't reducing batch sizes make privacy even more of a problem? Now instead of a 1/100000 chance of the user being the same person on another website there would be a 1/1000 chance.

makomk 5y ago
Yeah, except that because the other 999 users probably wouldn't be using Tor to access the same websites, in practice this would be pretty much guaranteed to give a highly accurate, persistent tracking identifier.

md_ 5y ago

The batch size requirement is imposed by the FIDO spec, to ensure that batch IDs are not so high entropy as to pose a privacy problem. "In this Full Basic Attestation model, a large number of authenticators must share the same Attestation certificate and Attestation Private Key in order to provide non-linkability (see Protocol Core Design Considerations). Authenticators can only be identified on a production batch level or an AAID level by their Attestation Certificate, and not individually. A large number of authenticators sharing the same Attestation Certificate provides better privacy, but also makes the related private key a more attractive attack target."