4 ms·
Can a FIDO key be implemented in software? Can you write a program to register a FIDO key as a multi-factor authentication device with a Google account? Or is
by djoldman 5y ago
Can a FIDO key be implemented in software? Can you write a program to register a FIDO key as a multi-factor authentication device with a Google account?
Or is there some repository of all allowed devices with identifiers? Intuitively that'd be the only way to prevent infinite virtual devices..
- wereHamster 5y agoYes. Example: https://github.com/github/SoftU2F https://github.com/github/SoftU2F
- floatboth 5y agoAttestation (what they use) is orthogonal to authentication. Token manufacturers have per-batch keys, private key being in the devices of that batch, so sites can verify that your device is from that batch of that vendor. You "can" implement attestation with your own key in software or in whatever, but Cloudflare won't trust your key :D
- djoldman 5y agoSo how does cloudflare know to not trust your key? They know some secrets from the token manufacturers and test your response against them? If so, what if the secrets get out? Then all the keys in those batches are poisoned? Isn't this just some sort of side channel certificate authority?
- floatboth 5y agoToken manufacturers are the CAs for their own tokens, Cloudflare would know these CA public keys.