3 ms·

~10 years ago: How horrible. Sad to see such security holes being found in our devices. Now: Nice. I wonder what kind of DRM/Anti-user feature will this break.

~10 years ago: How horrible. Sad to see such security holes being found in our devices. Now: Nice. I wonder what kind of DRM/Anti-user feature will this break. I hope it never gets patched.

lxgr 5y ago
Would you consider WebAuthN platform credentials and securing payment credentials "anti-user"? DRM is just one application.
- no_time 5y ago
  No. That's the least bad use case out of the bunch. If it stays as an option and/or the issuing organization provides the token, it's a benefit. As a password replacement, whole concept rubs me the wrong way though. Just let me make a god damn backup. "just buy 2 tokens lol" is such a shitty solution. I strongly prefer STANDARDIZED totp.
  - lxgr 5y ago
    As far as I'm aware, there's nothing in either the WebAuthN or the FIDO/CTAP specifications forbidding back-up-able (i.e. clonable) credentials. Apple is even explicitly planning to offer something like this for their platform authenticator implementation on iOS and macOS, although I'm not sure it's been finalized whether and how that fact will be exposed to applications. I'm not sure either is a good idea though, to be honest: The line between enabling credential/authenticator backups and enabling "credential skimming" is very fine.
    - franga2000 5y ago
      WebAuthN is designed to let the site limit what kind of tokens you're allowed to use. It doesn't matter that clonable tokens exist if every site only allows unclonable ones. We're currently in the same boat with rooted Android devices - we have the freedom, but if we want to use anything from bank apps to scooter rentals, we aren't allowed to exercise that freedom.
      - lxgr 5y ago
        > WebAuthN is designed to let the site limit what kind of tokens you're allowed to use. As is their right, no? Hopefully (and heavily depending on jurisdiction), service providers will be liable for any fraud happening on their platform, which I believe is only justifiable if service providers are also allowed to take some reasonable fraud prevention measures. I'll take the requirement for an uncloneable WebAuthN authenticator over privacy-invasive fingerprinting (via location, device sensors etc.) and pointless security theater any day, which seems to be the status quo for many services. (For example, my bank has a habit of locking my account and having me call them about 3 out of 4 times I transfer money between my own checking and savings account.)
        franga2000 5y ago
        No! If I get my token stolen or cloned, that's my problem. When have you seen a service provider held liable for what someone did with credentials that were stolen from a customer. If someone steals my bank card and uses it to buy stuff, the bank isn't going to be liable for that, so why would it be any different for 2FA tokens? As for behavior analysis for fraud detection: that isn't going anywhere any time soon, no matter if our tokens are clonable or not. And clearly the system your bank is using is dumb as nails, so I doubt there's a privacy issue there.
- Schroedingersat 5y ago
  Yes. If it means access to commerce or banking services requires submitting control of your phone to a third party.
  - lxgr 5y ago
    As long as it's a well-defined, sandboxed component of my phone, this seems like a much better tradeoff than behavioral fingerprinting that just gobbles up as much sensor data as it can get its hands on (while still not completely preventing moderately sophisticated spoofing attacks).

~10 years ago: How horrible. Sad to see such security holes being found in our devices. Now: Nice. I wonder what kind of DRM/Anti-user feature will this break. I hope it never gets patched.

lxgr 5y ago

Would you consider WebAuthN platform credentials and securing payment credentials "anti-user"? DRM is just one application.

no_time 5y ago
No. That's the least bad use case out of the bunch. If it stays as an option and/or the issuing organization provides the token, it's a benefit. As a password replacement, whole concept rubs me the wrong way though. Just let me make a god damn backup. "just buy 2 tokens lol" is such a shitty solution. I strongly prefer STANDARDIZED totp.
- lxgr 5y ago
  As far as I'm aware, there's nothing in either the WebAuthN or the FIDO/CTAP specifications forbidding back-up-able (i.e. clonable) credentials. Apple is even explicitly planning to offer something like this for their platform authenticator implementation on iOS and macOS, although I'm not sure it's been finalized whether and how that fact will be exposed to applications. I'm not sure either is a good idea though, to be honest: The line between enabling credential/authenticator backups and enabling "credential skimming" is very fine.
  - franga2000 5y ago
    WebAuthN is designed to let the site limit what kind of tokens you're allowed to use. It doesn't matter that clonable tokens exist if every site only allows unclonable ones. We're currently in the same boat with rooted Android devices - we have the freedom, but if we want to use anything from bank apps to scooter rentals, we aren't allowed to exercise that freedom.
    - lxgr 5y ago
      > WebAuthN is designed to let the site limit what kind of tokens you're allowed to use. As is their right, no? Hopefully (and heavily depending on jurisdiction), service providers will be liable for any fraud happening on their platform, which I believe is only justifiable if service providers are also allowed to take some reasonable fraud prevention measures. I'll take the requirement for an uncloneable WebAuthN authenticator over privacy-invasive fingerprinting (via location, device sensors etc.) and pointless security theater any day, which seems to be the status quo for many services. (For example, my bank has a habit of locking my account and having me call them about 3 out of 4 times I transfer money between my own checking and savings account.)
      - franga2000 5y ago
        No! If I get my token stolen or cloned, that's my problem. When have you seen a service provider held liable for what someone did with credentials that were stolen from a customer. If someone steals my bank card and uses it to buy stuff, the bank isn't going to be liable for that, so why would it be any different for 2FA tokens? As for behavior analysis for fraud detection: that isn't going anywhere any time soon, no matter if our tokens are clonable or not. And clearly the system your bank is using is dumb as nails, so I doubt there's a privacy issue there.
Schroedingersat 5y ago
Yes. If it means access to commerce or banking services requires submitting control of your phone to a third party.
- lxgr 5y ago
  As long as it's a well-defined, sandboxed component of my phone, this seems like a much better tradeoff than behavioral fingerprinting that just gobbles up as much sensor data as it can get its hands on (while still not completely preventing moderately sophisticated spoofing attacks).