4 ms·

Isn't part of the point is that a phishing site wouldnt get the same response as a legit site, and therefore it's be useless to do that, so this behavior is ok?

stickfigure 5y ago
It's not about phishing, it's about getting the user to blindly accept security checks. If users are trained to insert their usb key / scan their fingerprint whenever they see a cloudflare page, bad actors can present a mockup of this page to exploit that reaction. Physical keys (and biometrics) work well because they are rarely called for, and the user knows they are doing something security sensitive. "This random page asked me to insert my security key" can't be healthy.
- ehutch79 5y ago
  But wouldn't the response the mockup gets only work for that page, not something they could pass through? If any page can request any other pages response that'd make the whole system pointless
- tialaramex 5y ago
  No. Ignorance is a big problem. What makes Security Keys work well isn't that they are "rarely called for" but almost the opposite, they're so easy that you can add them with little friction all over the place. Tapping to sign into a remote server over SSH is no problem, it's scarcely more effort than thumping "enter" on the command is. What the user is doing is not security sensitive. They are, in fact, themselves, and that's all the Security Key is confirming. "Yup, still me". One of the easy ways fools trip themselves up here is that they think this is identifying information. But it isn't. "Yup, still me" doesn't identify anyone. The identity was already known to your interlocutor, which is why "Yup, still me" is enough. And that's what's so clever about the FIDO design. A Security Key has no idea who it "is", it just knows it's still the same as before. If you're already authenticated as Jim Smith, you can enroll a security key "Yup, still me" -> the Relying Party stores the information, and then you can later sign in using it to verify your identity, "I'm Jim Smith". "Is this still you Jim Smith?" "Yup, still me". So that's why this doesn't help bad guys. "Are you still er... you?" "Yup, still me". Completely useless. Of course you are, that doesn't help them at all.

stickfigure 5y ago

It's not about phishing, it's about getting the user to blindly accept security checks. If users are trained to insert their usb key / scan their fingerprint whenever they see a cloudflare page, bad actors can present a mockup of this page to exploit that reaction. Physical keys (and biometrics) work well because they are rarely called for, and the user knows they are doing something security sensitive. "This random page asked me to insert my security key" can't be healthy.

ehutch79 5y ago
But wouldn't the response the mockup gets only work for that page, not something they could pass through? If any page can request any other pages response that'd make the whole system pointless
tialaramex 5y ago
No. Ignorance is a big problem. What makes Security Keys work well isn't that they are "rarely called for" but almost the opposite, they're so easy that you can add them with little friction all over the place. Tapping to sign into a remote server over SSH is no problem, it's scarcely more effort than thumping "enter" on the command is. What the user is doing is not security sensitive. They are, in fact, themselves, and that's all the Security Key is confirming. "Yup, still me". One of the easy ways fools trip themselves up here is that they think this is identifying information. But it isn't. "Yup, still me" doesn't identify anyone. The identity was already known to your interlocutor, which is why "Yup, still me" is enough. And that's what's so clever about the FIDO design. A Security Key has no idea who it "is", it just knows it's still the same as before. If you're already authenticated as Jim Smith, you can enroll a security key "Yup, still me" -> the Relying Party stores the information, and then you can later sign in using it to verify your identity, "I'm Jim Smith". "Is this still you Jim Smith?" "Yup, still me". So that's why this doesn't help bad guys. "Are you still er... you?" "Yup, still me". Completely useless. Of course you are, that doesn't help them at all.