3 ms·

No. That's the least bad use case out of the bunch. If it stays as an option and/or the issuing organization provides the token, it's a benefit. As a password

No. That's the least bad use case out of the bunch. If it stays as an option and/or the issuing organization provides the token, it's a benefit. As a password replacement, whole concept rubs me the wrong way though. Just let me make a god damn backup. "just buy 2 tokens lol" is such a shitty solution. I strongly prefer STANDARDIZED totp.

lxgr 5y ago
As far as I'm aware, there's nothing in either the WebAuthN or the FIDO/CTAP specifications forbidding back-up-able (i.e. clonable) credentials. Apple is even explicitly planning to offer something like this for their platform authenticator implementation on iOS and macOS, although I'm not sure it's been finalized whether and how that fact will be exposed to applications. I'm not sure either is a good idea though, to be honest: The line between enabling credential/authenticator backups and enabling "credential skimming" is very fine.
- franga2000 5y ago
  WebAuthN is designed to let the site limit what kind of tokens you're allowed to use. It doesn't matter that clonable tokens exist if every site only allows unclonable ones. We're currently in the same boat with rooted Android devices - we have the freedom, but if we want to use anything from bank apps to scooter rentals, we aren't allowed to exercise that freedom.
  - lxgr 5y ago
    > WebAuthN is designed to let the site limit what kind of tokens you're allowed to use. As is their right, no? Hopefully (and heavily depending on jurisdiction), service providers will be liable for any fraud happening on their platform, which I believe is only justifiable if service providers are also allowed to take some reasonable fraud prevention measures. I'll take the requirement for an uncloneable WebAuthN authenticator over privacy-invasive fingerprinting (via location, device sensors etc.) and pointless security theater any day, which seems to be the status quo for many services. (For example, my bank has a habit of locking my account and having me call them about 3 out of 4 times I transfer money between my own checking and savings account.)
    - franga2000 5y ago
      No! If I get my token stolen or cloned, that's my problem. When have you seen a service provider held liable for what someone did with credentials that were stolen from a customer. If someone steals my bank card and uses it to buy stuff, the bank isn't going to be liable for that, so why would it be any different for 2FA tokens? As for behavior analysis for fraud detection: that isn't going anywhere any time soon, no matter if our tokens are clonable or not. And clearly the system your bank is using is dumb as nails, so I doubt there's a privacy issue there.

lxgr 5y ago

As far as I'm aware, there's nothing in either the WebAuthN or the FIDO/CTAP specifications forbidding back-up-able (i.e. clonable) credentials. Apple is even explicitly planning to offer something like this for their platform authenticator implementation on iOS and macOS, although I'm not sure it's been finalized whether and how that fact will be exposed to applications. I'm not sure either is a good idea though, to be honest: The line between enabling credential/authenticator backups and enabling "credential skimming" is very fine.

franga2000 5y ago
WebAuthN is designed to let the site limit what kind of tokens you're allowed to use. It doesn't matter that clonable tokens exist if every site only allows unclonable ones. We're currently in the same boat with rooted Android devices - we have the freedom, but if we want to use anything from bank apps to scooter rentals, we aren't allowed to exercise that freedom.
- lxgr 5y ago
  > WebAuthN is designed to let the site limit what kind of tokens you're allowed to use. As is their right, no? Hopefully (and heavily depending on jurisdiction), service providers will be liable for any fraud happening on their platform, which I believe is only justifiable if service providers are also allowed to take some reasonable fraud prevention measures. I'll take the requirement for an uncloneable WebAuthN authenticator over privacy-invasive fingerprinting (via location, device sensors etc.) and pointless security theater any day, which seems to be the status quo for many services. (For example, my bank has a habit of locking my account and having me call them about 3 out of 4 times I transfer money between my own checking and savings account.)
  - franga2000 5y ago
    No! If I get my token stolen or cloned, that's my problem. When have you seen a service provider held liable for what someone did with credentials that were stolen from a customer. If someone steals my bank card and uses it to buy stuff, the bank isn't going to be liable for that, so why would it be any different for 2FA tokens? As for behavior analysis for fraud detection: that isn't going anywhere any time soon, no matter if our tokens are clonable or not. And clearly the system your bank is using is dumb as nails, so I doubt there's a privacy issue there.