4 ms·
> Identities cannot be linked Yes, they can. Quite obviously they can and all it takes is even a modicum of cooperation. We have already extensively seen corpo
by krageon 5y ago
> Identities cannot be linked
Yes, they can. Quite obviously they can and all it takes is even a modicum of cooperation. We have already extensively seen corporations love to cooperate when it comes to compromising information that belongs to you.
- md_ 5y agoCompliant FIDO2 keys guarantee unlinkability even against colluding relying parties. See https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-security-ref-v2.0-rd-20180702.html https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-se..., specifically "security goal 4", and the unique authentication keys requirement.
- krageon 5y agoAgainst any two, not any number.
- tialaramex 5y agoDid you look at how this is actually achieved? Attackers (even if they control several major outfits like say Microsoft) are not going to succeed in a correlation attack. Roughly what they're doing is like trying to guess the AES keys. This is in stark contrast to passwords of course, where correlation is so high that haveibeenpwned is worth existing...
- md_ 5y agoSeriously? Please, explain to me how an arbitrary number of RPs can collude to link a FIDO2 identity.