3 ms·

> Yes, you would need to inform all the servers of the change, a compliant FIDO authenticator shouldn't be clonable. Depends on how you define clonable, but th

by jolmg 5y ago

> Yes, you would need to inform all the servers of the change, a compliant FIDO authenticator shouldn't be clonable. Depends on how you define clonable, but that shouldn't be a requirement to be able to avoid having to inform servers. OpenPGP smartcards can't be cloned in the sense of being able to read the key off them, but you can write the key to them. So a key-pair can be generated outside, written to the smartcard and backed up however one considers sufficiently secure. If the smartcard is lost, one can buy another one and write the key from the backup. The old smartcard being lost is not much of a concern either, since if the password is entered incorrectly a few times, the smartcard becomes blocked. > However, if you've got a whole bunch of servers you can do SSH certificates instead of raw keys, and then you only need to go through the process once (to get the certificate) since the servers just care that your certificate was signed by the authorised CA. Not all circumstances are equal. Some servers are too old to support certificates :(, and upgrading just the ssh servers is unvalued and non-trivial (I don't know if OpenSSH still even supports the OS). Also, servers are not all under the same organization, so no unified CA. Authenticating via OpenPGP requires no server considerations. It works everywhere and is a personal decision rather than an organizational one.

tialaramex 5y ago
> So a key-pair can be generated outside, written to the smartcard and backed up however one considers sufficiently secure. Presumably you're comfortable with this, but there's no reason the server operator should be. It's pretty obvious where the weakest link is. Also this is pretty inherently contrary to the design of FIDO, because it privileges these private keys as special whereas in FIDO they're random and you can just mint more of them (in FIDO1 it's completely normal to make huge numbers of keys, since you aren't storing them anyway). In the original OpenPGP case where the keys are personal identity keys for signing email that feels reasonable, but already for SSH that's not really what you needed anyway. It is true that OpenPGP is much better if you were obliged to do RSA for compatibility reasons, but I think we'd all like to move away from that world even if some of us can't yet.
- deleted 5y ago
  [deleted]
- jolmg 5y ago
  > It's pretty obvious where the weakest link is. It isn't, considering how little information I've given you. The weakness of links depend on the threats we model and how we protect the links against such threats. You're lacking a lot of information to evaluate the weakness of links in these contexts. > Also this is pretty inherently contrary to the design of FIDO, because it privileges these private keys as special whereas in FIDO they're random and you can just mint more of them (in FIDO1 it's completely normal to make huge numbers of keys, since you aren't storing them anyway). I've read a bit on that, on how it makes a new key-pair per device-service-user combination. I honestly can't tell if that's an advantage or disadvantage. It at least seems like a disadvantage to have to hold both main key and backup key on new registrations to make sure you don't lose access when you lose a key. Besides being inconvenient, it seems to mean that the backup key has similar chances to being lost as the main key. In contrast, with OpenPGP, you can even store the backup key in a separate location like a safety deposit box and generally forget about it until you need it. > It is true that OpenPGP is much better if you were obliged to do RSA for compatibility reasons, but I think we'd all like to move away from that world even if some of us can't yet. Regarding RSA, I agree. OpenPGP isn't limited to RSA though and has more uses than just direct authentication.
  - tialaramex 5y ago
    > It isn't, considering how little information I've given you No, I'm still pretty sure it is obvious because it's that hard to get the authenticator to do anything without you. The trouble with the approach you prefer is that anything you can do "as a backup" crooks can do "as a crime" just as easily. The FIDO people weren't interested in offering a convenient way for crooks to break into your systems, even under the name "backup", so, there isn't one.

by jolmg 5y ago

tialaramex 5y ago

> So a key-pair can be generated outside, written to the smartcard and backed up however one considers sufficiently secure. Presumably you're comfortable with this, but there's no reason the server operator should be. It's pretty obvious where the weakest link is. Also this is pretty inherently contrary to the design of FIDO, because it privileges these private keys as special whereas in FIDO they're random and you can just mint more of them (in FIDO1 it's completely normal to make huge numbers of keys, since you aren't storing them anyway). In the original OpenPGP case where the keys are personal identity keys for signing email that feels reasonable, but already for SSH that's not really what you needed anyway. It is true that OpenPGP is much better if you were obliged to do RSA for compatibility reasons, but I think we'd all like to move away from that world even if some of us can't yet.

deleted 5y ago
[deleted]
jolmg 5y ago
> It's pretty obvious where the weakest link is. It isn't, considering how little information I've given you. The weakness of links depend on the threats we model and how we protect the links against such threats. You're lacking a lot of information to evaluate the weakness of links in these contexts. > Also this is pretty inherently contrary to the design of FIDO, because it privileges these private keys as special whereas in FIDO they're random and you can just mint more of them (in FIDO1 it's completely normal to make huge numbers of keys, since you aren't storing them anyway). I've read a bit on that, on how it makes a new key-pair per device-service-user combination. I honestly can't tell if that's an advantage or disadvantage. It at least seems like a disadvantage to have to hold both main key and backup key on new registrations to make sure you don't lose access when you lose a key. Besides being inconvenient, it seems to mean that the backup key has similar chances to being lost as the main key. In contrast, with OpenPGP, you can even store the backup key in a separate location like a safety deposit box and generally forget about it until you need it. > It is true that OpenPGP is much better if you were obliged to do RSA for compatibility reasons, but I think we'd all like to move away from that world even if some of us can't yet. Regarding RSA, I agree. OpenPGP isn't limited to RSA though and has more uses than just direct authentication.
- tialaramex 5y ago
  > It isn't, considering how little information I've given you No, I'm still pretty sure it is obvious because it's that hard to get the authenticator to do anything without you. The trouble with the approach you prefer is that anything you can do "as a backup" crooks can do "as a crime" just as easily. The FIDO people weren't interested in offering a convenient way for crooks to break into your systems, even under the name "backup", so, there isn't one.