5 ms·

There's nothing that stands in the way of anyone implementing a software FIDO2 key (though some RPs can reject self-signed attestation certs if they want to, bu

by md_ 5y ago

There's nothing that stands in the way of anyone implementing a software FIDO2 key (though some RPs can reject self-signed attestation certs if they want to, but it's not common AFAIK). See https://github.blog/2017-07-20-soft-u2f/ https://github.blog/2017-07-20-soft-u2f/ for an example.

mindslight 5y ago
I didn't say there was, and I figured there had to be, given the amount of open implementations. I was speaking more to adoption path and resulting customs rather than what is technically possible. Like for example to use "FIDO authentication", if I have to plug in a specific USB key, pass it through to a VM, etc, then that extra effort isn't worth it for 90% of my accounts (although that won't stop them from insisting that it is!). Whereas if Firefox can handle it in software by default, and I can easily backup/restore its keying material with standard shell scripts, then I'm much more likely to see it as a benefit. FWIW do you know if the server can reliably determine what brand of authenticator is being used (eg through a pubkey signature)? I haven't studied the protocol enough to know if it contains those kind of anti-features.
- md_ 5y ago
  There's a concept of "batch attestation", by which the manufacturer builds in a key that attests to a batch (with a minimum batch size, to avoid identifying a single USB key--either 10k or 100k but I forget offhand which). This is (AFAICT) intended to be used by, say, an enterprise who wants to restrict their employees to some trusted brand, but some banks and similar have also used it. This is somewhat discouraged and annoying. In general, most places you can use a "self-signed" authenticator, which could be software and nobody would know.
  - mindslight 5y ago
    Damn. That's the exactly the type of long-term security vulnerability that I'm concerned about. What you're describing is only today's present conditions. They're allowed to continue because adoption is low, and so businesses aren't trying to add even more "security". This is like IP before DPI, or when people considered Bitcoin anonymous. Once FIDO keys become popular, and especially if software-only keys become popular, companies will most certainly restrict their services to only work with trusted brands.
    - md_ 5y ago
      Eh. They don’t have a big incentive to, right? It’s a risk, and I believe the batch attestation was controversial as a result. But the use cases are compelling.
      - mindslight 5y ago
        My point is that it's not a "risk", but rather an extremely slow developing inevitability. Think forward to when most everyone is using security keys, and 90% of users use one from one of the big brands. Then someone tells a bank's security chief "did you know users can defeat our security by installing a piece of software?" They'll look for a solution to that, and the solution will be using the feature to restrict keys to trusted brands. The only downside will be annoying a small segment of customers. But at that point they won't care, because those customers don't conform to their security mold anyway. For a contemporary situation playing out right now, many websites have decided to outright block or CAPTCHA-harass connections from datacenter IP addresses. In their mind, all such connections are fraud and abuse rather than legitimate paying customers that happen to have custom network setups. And of course the use cases seem compelling in the corporate context, because corporations are authoritarian organizations where top-down control is simply accepted. The problem is that they push their authoritarian desire for control into technical standards, which then unleash that centralizing control onto the outside world.
        md_ 5y ago
        Authoritarian, or utilitarian?
        mindslight 5y ago
        Authoritarian - a corporation is directed in a completely top-down manner, with singular authority vesting in the executive. They obviously exist within a larger society where workers are free to quit, have some rights that can't be taken away, are bound by agreements, etc. But the organizational structure itself is strictly hierarchical. The problem comes when these assumptions are baked into systems that are supposed to serve wider society. A corporation can tell their employees that they must use only certain computers to do their work, modify those devices, revoke access on a whim, etc. Whereas in wider society, relationships should be that of independent peers interacting through well-defined protocols, with each party free to make their own choices.

by md_ 5y ago

mindslight 5y ago

I didn't say there was, and I figured there had to be, given the amount of open implementations. I was speaking more to adoption path and resulting customs rather than what is technically possible. Like for example to use "FIDO authentication", if I have to plug in a specific USB key, pass it through to a VM, etc, then that extra effort isn't worth it for 90% of my accounts (although that won't stop them from insisting that it is!). Whereas if Firefox can handle it in software by default, and I can easily backup/restore its keying material with standard shell scripts, then I'm much more likely to see it as a benefit. FWIW do you know if the server can reliably determine what brand of authenticator is being used (eg through a pubkey signature)? I haven't studied the protocol enough to know if it contains those kind of anti-features.

md_ 5y ago
There's a concept of "batch attestation", by which the manufacturer builds in a key that attests to a batch (with a minimum batch size, to avoid identifying a single USB key--either 10k or 100k but I forget offhand which). This is (AFAICT) intended to be used by, say, an enterprise who wants to restrict their employees to some trusted brand, but some banks and similar have also used it. This is somewhat discouraged and annoying. In general, most places you can use a "self-signed" authenticator, which could be software and nobody would know.
- mindslight 5y ago
  Damn. That's the exactly the type of long-term security vulnerability that I'm concerned about. What you're describing is only today's present conditions. They're allowed to continue because adoption is low, and so businesses aren't trying to add even more "security". This is like IP before DPI, or when people considered Bitcoin anonymous. Once FIDO keys become popular, and especially if software-only keys become popular, companies will most certainly restrict their services to only work with trusted brands.
  - md_ 5y ago
    Eh. They don’t have a big incentive to, right? It’s a risk, and I believe the batch attestation was controversial as a result. But the use cases are compelling.
    - mindslight 5y ago
      My point is that it's not a "risk", but rather an extremely slow developing inevitability. Think forward to when most everyone is using security keys, and 90% of users use one from one of the big brands. Then someone tells a bank's security chief "did you know users can defeat our security by installing a piece of software?" They'll look for a solution to that, and the solution will be using the feature to restrict keys to trusted brands. The only downside will be annoying a small segment of customers. But at that point they won't care, because those customers don't conform to their security mold anyway. For a contemporary situation playing out right now, many websites have decided to outright block or CAPTCHA-harass connections from datacenter IP addresses. In their mind, all such connections are fraud and abuse rather than legitimate paying customers that happen to have custom network setups. And of course the use cases seem compelling in the corporate context, because corporations are authoritarian organizations where top-down control is simply accepted. The problem is that they push their authoritarian desire for control into technical standards, which then unleash that centralizing control onto the outside world.
      - md_ 5y ago
        Authoritarian, or utilitarian?
        mindslight 5y ago
        Authoritarian - a corporation is directed in a completely top-down manner, with singular authority vesting in the executive. They obviously exist within a larger society where workers are free to quit, have some rights that can't be taken away, are bound by agreements, etc. But the organizational structure itself is strictly hierarchical. The problem comes when these assumptions are baked into systems that are supposed to serve wider society. A corporation can tell their employees that they must use only certain computers to do their work, modify those devices, revoke access on a whim, etc. Whereas in wider society, relationships should be that of independent peers interacting through well-defined protocols, with each party free to make their own choices.