4 ms·

> Websites can check the attestation response to specifically block those, however. (Seems like Github allows it, and I've written code that allows it.) For th

> Websites can check the attestation response to specifically block those, however. (Seems like Github allows it, and I've written code that allows it.) For the client side of things WebAuthn contains a standard option to block/allow "platform" authenticators, which I empirically know includes Windows Hello, and I'm not sure about Apple's or other equivalents. Of course you'd still want to verify the attestation on the server side.

tialaramex 5y ago
> Of course you'd still want to verify the attestation on the server side. You almost certainly do not want to do this for a public web site. If you insist on attestation right thinking people will hit "No" and block the site. Think about it, what is attestation doing for you in this scenario? You're saying that you don't trust your users/ customers to pick the authentication methods that work for them, and instead you're going to insist on methods you prefer. Do you also choose each user's passwords? "No, sorry, that resembles an English word, we have selected the password 48'J3X$q)M3NBfr_2 for you instead" ? In a corporate environment this could make sense. If you issue every employee a $100 FooCorp Security Key with their photo engraved on it, maybe you decide to require attestation that the keys used are FooCorp brand keys to prevent employees adding some off-brand Yubico product. I don't know whether that's a good idea, but it's no crazier than lots of corporate policies, however doing this for a public site makes no sense, please just skip attestation.
- franga2000 5y ago
  Yes! Any developer that forces the user to use a specific type of device needs to be smacked around a bit (or more accurately, the manager that told them to do it that way). Banks are notorious for this, since their stupid 2FA apps will do insane things like scan your app list for common root-only apps and non-vendor ROMs (even with no root). Some even have a vendor whitelist that obscure brands (like OnePlus used to be) aren't on and in both cases, their only response is "well just factory reset your phone" or "just buy a different device". I've switched banks twice because of this insanity. And there's no reason to do this! It's not like they're liable if I get my money stolen. If they prove 2FA was used and the security issue was on my device, not their app/server, it's my fault! As you said, if you're a custodian of something sensitive (an account, documents, money..), not the owner of it, it makes sense that the owner shouldd be able to dictate how you should protect it (like if you're accessing confidential company documents using 2FA). But in any other case, the service provider should never be allowed to force you to use a certain type of authentication device.

tialaramex 5y ago

> Of course you'd still want to verify the attestation on the server side. You almost certainly do not want to do this for a public web site. If you insist on attestation right thinking people will hit "No" and block the site. Think about it, what is attestation doing for you in this scenario? You're saying that you don't trust your users/ customers to pick the authentication methods that work for them, and instead you're going to insist on methods you prefer. Do you also choose each user's passwords? "No, sorry, that resembles an English word, we have selected the password 48'J3X$q)M3NBfr_2 for you instead" ? In a corporate environment this could make sense. If you issue every employee a $100 FooCorp Security Key with their photo engraved on it, maybe you decide to require attestation that the keys used are FooCorp brand keys to prevent employees adding some off-brand Yubico product. I don't know whether that's a good idea, but it's no crazier than lots of corporate policies, however doing this for a public site makes no sense, please just skip attestation.

franga2000 5y ago
Yes! Any developer that forces the user to use a specific type of device needs to be smacked around a bit (or more accurately, the manager that told them to do it that way). Banks are notorious for this, since their stupid 2FA apps will do insane things like scan your app list for common root-only apps and non-vendor ROMs (even with no root). Some even have a vendor whitelist that obscure brands (like OnePlus used to be) aren't on and in both cases, their only response is "well just factory reset your phone" or "just buy a different device". I've switched banks twice because of this insanity. And there's no reason to do this! It's not like they're liable if I get my money stolen. If they prove 2FA was used and the security issue was on my device, not their app/server, it's my fault! As you said, if you're a custodian of something sensitive (an account, documents, money..), not the owner of it, it makes sense that the owner shouldd be able to dictate how you should protect it (like if you're accessing confidential company documents using 2FA). But in any other case, the service provider should never be allowed to force you to use a certain type of authentication device.