4 ms·

> "Does this mean 'Attestation of Personhood' is broken? ... In my opinion, no. Starting with the obvious, Cloudflare has clearly considered this attack vector

> "Does this mean 'Attestation of Personhood' is broken? ... In my opinion, no. Starting with the obvious, Cloudflare has clearly considered this attack vector as they mentioned it in the post and decided it still raises the cost of an attack over the current CAPTCHA model... Attackers are already willing to purchase a bunch of cell phones to emulate human behavior. 'Attestation of Personhood' with the use of a hardware key is completely broken.

xaduha 5y ago
It doesn't have to be 100% impenetrable to do its job most of the time and make it economically not viable with scale. Biggest issue is expecting a big chunk of users to actually have a FIDO2 token. They would have to be as ubiquitous as thumb drives or be built-in into phones and notebooks.
- loloquwowndueo 5y ago
  They are cheap enough to be ubiquitous (cheap ones can be had for $5 or so) and are already built into most phones, usually behind biometric verification (face or fingerprint recognition). Note the biometric only unlocks the FIDO2 private key in the phone’s TPM so biometric data never leaves the device. Edit: just checked, a hyperfido mini sells for $9.99 CAD, so not quite five bucks but still pretty affordable.
  - xaduha 5y ago
    > are already built into most phones I don't know know about most unless you mean that most iPhones have it, but I wasn't aware it was built into mine, using Android 10. Just didn't put two and two together. My old smartphone on Android 9 didn't have it, I'm pretty sure.