4 ms·

WebAuthN is designed to let the site limit what kind of tokens you're allowed to use. It doesn't matter that clonable tokens exist if every site only allows unc

• lxgr 5y ago
  > WebAuthN is designed to let the site limit what kind of tokens you're allowed to use. As is their right, no? Hopefully (and heavily depending on jurisdiction), service providers will be liable for any fraud happening on their platform, which I believe is only justifiable if service providers are also allowed to take some reasonable fraud prevention measures. I'll take the requirement for an uncloneable WebAuthN authenticator over privacy-invasive fingerprinting (via location, device sensors etc.) and pointless security theater any day, which seems to be the status quo for many services. (For example, my bank has a habit of locking my account and having me call them about 3 out of 4 times I transfer money between my own checking and savings account.)
  • franga2000 5y ago
    No! If I get my token stolen or cloned, that's my problem. When have you seen a service provider held liable for what someone did with credentials that were stolen from a customer. If someone steals my bank card and uses it to buy stuff, the bank isn't going to be liable for that, so why would it be any different for 2FA tokens? As for behavior analysis for fraud detection: that isn't going anywhere any time soon, no matter if our tokens are clonable or not. And clearly the system your bank is using is dumb as nails, so I doubt there's a privacy issue there.