3 ms·
As I understand this, if malware is on the machine it can do unlimited WebAuthn validations in the background without user interaction. Anchoring to physical h
by lrvick 5y ago
As I understand this, if malware is on the machine it can do unlimited WebAuthn validations in the background without user interaction.
Anchoring to physical human interaction with a button or biometric sensor is a huge security property I don't think current gen TPMs can solve for.
In a typical implementation someone must be present at the machine expecting a tap, and tapping.
That said, overall this is a clever best effort for when a TPM is all a user has and you at least want to prove a given machine is involved in with.
- UncleMeat 5y agoIf malware is on the machine you are basically screwed anyway. A threat model where you happen to never authenticate with a service while you have the malware installed is not especially compelling.