3 ms·
That's a good question, now isn't it? In reality, what we can expose, is that during the early boot process, our systems reach out to another system that regis
by qmarchi 5y ago
That's a good question, now isn't it?
In reality, what we can expose, is that during the early boot process, our systems reach out to another system that register's its interest, and as a user (from another trusted device, phone, laptop, etc.) you can visit the web service and click a button.
How and where keys are stored is a great big "?" that's up to the implementer to solve..
- exikyut 5y agoSo basically you have 2FA for workstation boot. That's really quite cool. Of course I want to know how and where the keys are stored :D so I can do the same thing myself! Arguably security systems in this class demonstrate their integrity *because* their architecture is fully open, documented and straightforwardly reproducible. It isn't science if it isn't reproducible, right? Something something computer science... That's the idealistic view, of course. In the <insert cartoon punching fight cloud here> real world, we have The Legacy PC Problem™, where secure boot isn't, TPMs can be bus sniffed, SGX doesn't really support the hacker/tinkerer exploration necessary to power defense in depth, ME is a ginormous black box that eats authentication headers like they might as well be glue... and it doesn't matter that I am a dog residing on Mars because the MDM my 2FA device is signed into has decided I'm legit. Hence my interest in real security. It's a giant debacle, surely there are some genuinely cool wins to be had out there that truly make a dent ._.
- zbrozek 5y agoLike most Alphabet implementations it's 80% awesome and 20% undone. Unfortunately that means it's a bad time.