3 ms·
Attestation (what they use) is orthogonal to authentication. Token manufacturers have per-batch keys, private key being in the devices of that batch, so sites c
by floatboth 5y ago
Attestation (what they use) is orthogonal to authentication. Token manufacturers have per-batch keys, private key being in the devices of that batch, so sites can verify that your device is from that batch of that vendor. You "can" implement attestation with your own key in software or in whatever, but Cloudflare won't trust your key :D
- djoldman 5y agoSo how does cloudflare know to not trust your key? They know some secrets from the token manufacturers and test your response against them? If so, what if the secrets get out? Then all the keys in those batches are poisoned? Isn't this just some sort of side channel certificate authority?
- floatboth 5y agoToken manufacturers are the CAs for their own tokens, Cloudflare would know these CA public keys.