4 ms·

With webauthn, you can require user verification. This is left as an exercise for the authenticator but means the authenticator guarantees it's checked either

With webauthn, you can require user verification. This is left as an exercise for the authenticator but means the authenticator guarantees it's checked either biometrics or PIN, thus meeting the "have" && ("know" || "are") criteria. If you're paranoid the authenticator might lie to you, you can use the attestation data and only trust the UV flag from tested/trusted authenticators. That said, know/have/are thing is more of a heuristic than a rule. A theoretical system that _perfectly_ tests only "are" could be more secure than a "have" && "know" system, depending on your threat model.

the8472 5y ago
> A theoretical system that _perfectly_ tests only "are" could be more secure than a "have" && "know" system, depending on your threat model. That circles back to the right against self-incrimination part. And a biometric system on its own (without the "have" part) seems like it could be done without verifying intent by just pointing a remote version of the same sensor at a person.
- cameronh90 5y ago
  Whether that's an issue depends on the threat model of the system you're building, and also the legal context you are operating in. In the UK, for example, biological authentication and password authentication are both treated equally and you can be imprisoned for two years for refusing to provide either under RIPA legislation. Equally the US could (and IMO should) change the law to treat biological authentication as equivalent to password authentication when it comes to the right against self-incrimination. But besides that, a biological verification could rely on someone performing some sort of affirmative action (think "my voice is my password" type systems). Indeed, prior to computers, nearly all authentication was performed roughly in this manner but with humans rather than AIs doing the evaluation. In practice, the authentication part generally worked quite well (but bribing the authenticator was a good "hack").

the8472 5y ago

> A theoretical system that _perfectly_ tests only "are" could be more secure than a "have" && "know" system, depending on your threat model. That circles back to the right against self-incrimination part. And a biometric system on its own (without the "have" part) seems like it could be done without verifying intent by just pointing a remote version of the same sensor at a person.

cameronh90 5y ago
Whether that's an issue depends on the threat model of the system you're building, and also the legal context you are operating in. In the UK, for example, biological authentication and password authentication are both treated equally and you can be imprisoned for two years for refusing to provide either under RIPA legislation. Equally the US could (and IMO should) change the law to treat biological authentication as equivalent to password authentication when it comes to the right against self-incrimination. But besides that, a biological verification could rely on someone performing some sort of affirmative action (think "my voice is my password" type systems). Indeed, prior to computers, nearly all authentication was performed roughly in this manner but with humans rather than AIs doing the evaluation. In practice, the authentication part generally worked quite well (but bribing the authenticator was a good "hack").