10 ms·

Eh. They don’t have a big incentive to, right? It’s a risk, and I believe the batch attestation was controversial as a result. But the use cases are compelling

• mindslight 5y ago
  My point is that it's not a "risk", but rather an extremely slow developing inevitability. Think forward to when most everyone is using security keys, and 90% of users use one from one of the big brands. Then someone tells a bank's security chief "did you know users can defeat our security by installing a piece of software?" They'll look for a solution to that, and the solution will be using the feature to restrict keys to trusted brands. The only downside will be annoying a small segment of customers. But at that point they won't care, because those customers don't conform to their security mold anyway. For a contemporary situation playing out right now, many websites have decided to outright block or CAPTCHA-harass connections from datacenter IP addresses. In their mind, all such connections are fraud and abuse rather than legitimate paying customers that happen to have custom network setups. And of course the use cases seem compelling in the corporate context, because corporations are authoritarian organizations where top-down control is simply accepted. The problem is that they push their authoritarian desire for control into technical standards, which then unleash that centralizing control onto the outside world.
  • md_ 5y ago
    Authoritarian, or utilitarian?
    • mindslight 5y ago
      Authoritarian - a corporation is directed in a completely top-down manner, with singular authority vesting in the executive. They obviously exist within a larger society where workers are free to quit, have some rights that can't be taken away, are bound by agreements, etc. But the organizational structure itself is strictly hierarchical. The problem comes when these assumptions are baked into systems that are supposed to serve wider society. A corporation can tell their employees that they must use only certain computers to do their work, modify those devices, revoke access on a whim, etc. Whereas in wider society, relationships should be that of independent peers interacting through well-defined protocols, with each party free to make their own choices.
      • md_ 5y ago
        Oh, for sure that‘s true (with respect to telling employees “use these devices or you’re fired”). But I thought we were talking about the corporate relationship with society and the company’s users/customers. In that broader context, I’m surprised that so many folks in this thread are arguing, essentially, that companies have a strong incentive to push (potentially needless, or costly from a privacy-perspective[1]) features on their users. Historically, my feeling—-and I think that of many in the security industry—-was that the market does not reward pushing security, especially not security that customers can’t see; as a result, there’s some chunk of security theater, but real security features are often under-rewarded. shrug [1] To be clear, I disagree that most of these things have a severe privacy cost, hence my point that FIDO allows strong pseudonymity.