5 ms·

Does anyone here know what privacy/tracking issues are with this standard?

jeroenhd 5y ago
I haven't found any so far. Each account gets a new public/private key pair so accounts can't be traced back to each other. Usernames are optional and might even become a thing or the past, making username reuse less of an issue for linking accounts. It all depends on the sync method provided. If synchronisation isn't end-to-end protected, you're handing Apple/Google/Microsoft the keys to the kingdom which is pretty bad.
bachmeier 5y ago
It fully resolves all existing privacy and tracking issues. You will have no privacy and will be tracked all the time. Problem solved.
0daystock 5y ago
FIDO2 privacy is actually pretty good and well thought out. There's a theoretical risk of a website sending authentication challenges for two different accounts and having both assertions signed by the same credential, basically correlating those accounts together, but this is unlikely to weaken collective privacy at scale.
- RL_Quine 5y ago
  Kind of. Yubikeys intentionally have a very small number of devices signed with one CA key and then they produce a new CA key, so those devices do have a basically unique identifier.
  - 0daystock 5y ago
    Can you share any more information about that? Is this identifier shared as part of the FIDO2/U2F spec?
    - md_ 5y ago
      I think they're referring to attestation (https://fidoalliance.org/fido-technotes-the-truth-about-attestation/#:~:text=Making%20sure%20that%20attestation%20certificates%20are%20used%20across%20large%20batches%20of%20authenticators%20of%20the%20same%20model%20(100%2C000%2B)%20ensures%20that%20users%20can%E2%80%99t%20be%20tracked%20based%20on%20their%20attestation%20certificate https://fidoalliance.org/fido-technotes-the-truth-about-atte....), which requires that attestation certificates be shared with a minimum of 100,000 other devices in order to ensure they're not unique IDs. Maybe the parent misread the spec as saying a _maximum_ of 100,000? Or something?
      - dane-pgp 5y ago
        The point being, the FIDO Alliance reserves the right to blacklist any device that an attacker manages to extract the secret keys from, which has the consequence that 99,999 other people have their devices bricked. Also, the Alliance could decide to blacklist a manufacturer just because they haven't implemented some new policy (like requiring a DNA scan of the user) so you better make sure that you buy a device from one of the "too big to fail" providers.
        md_ 5y ago
        > The point being, the FIDO Alliance reserves the right to blacklist any device that an attacker manages to extract the secret keys from, which has the consequence that 99,999 other people have their devices bricked. 1. By what mechanism can they blacklist a device? A given relying party can choose to use or not use attestation and, if they choose to use it, which certificates to trust. But that's between you and the RP. Authentication doesn't "talk to" the FIDO Alliance--which is just a standards body and does not (AFAIK) even publish anything like a CRL for "bad" attestation keys, so I don't understand what you are talking about here. 2. The intention of the attestation, as I understand it, is to enable RPs to use attestation to limit authenticators to e.g. those that pass FIPS certification (or similar enterprisey requirements), not to ban a whole batch because one key is known to be compromised. That's crazy; can you point out where anyone other than you has ever proposed this? 3. DNA scan? What are you talking about? 4. This assertion you are making, while bizarre and wrong, is very different than the assertion the grandparent made ("Yubikeys intentionally have a very small number of devices signed with one CA key...so those devices do have a basically unique identifier"), which, while also wrong, is I think a genuine mistake and not a bad-faith argument.
- raxxorraxor 5y ago
  What is collective privacy? Also, why not allow uncertified devices to generate keys? Why do I have to implement secure boot or TPM?

I haven't found any so far. Each account gets a new public/private key pair so accounts can't be traced back to each other. Usernames are optional and might even become a thing or the past, making username reuse less of an issue for linking accounts. It all depends on the sync method provided. If synchronisation isn't end-to-end protected, you're handing Apple/Google/Microsoft the keys to the kingdom which is pretty bad.

bachmeier 5y ago

It fully resolves all existing privacy and tracking issues. You will have no privacy and will be tracked all the time. Problem solved.

0daystock 5y ago

FIDO2 privacy is actually pretty good and well thought out. There's a theoretical risk of a website sending authentication challenges for two different accounts and having both assertions signed by the same credential, basically correlating those accounts together, but this is unlikely to weaken collective privacy at scale.

RL_Quine 5y ago
Kind of. Yubikeys intentionally have a very small number of devices signed with one CA key and then they produce a new CA key, so those devices do have a basically unique identifier.
- 0daystock 5y ago
  Can you share any more information about that? Is this identifier shared as part of the FIDO2/U2F spec?
  - md_ 5y ago
    I think they're referring to attestation (https://fidoalliance.org/fido-technotes-the-truth-about-attestation/#:~:text=Making%20sure%20that%20attestation%20certificates%20are%20used%20across%20large%20batches%20of%20authenticators%20of%20the%20same%20model%20(100%2C000%2B)%20ensures%20that%20users%20can%E2%80%99t%20be%20tracked%20based%20on%20their%20attestation%20certificate https://fidoalliance.org/fido-technotes-the-truth-about-atte....), which requires that attestation certificates be shared with a minimum of 100,000 other devices in order to ensure they're not unique IDs. Maybe the parent misread the spec as saying a _maximum_ of 100,000? Or something?
    - dane-pgp 5y ago
      The point being, the FIDO Alliance reserves the right to blacklist any device that an attacker manages to extract the secret keys from, which has the consequence that 99,999 other people have their devices bricked. Also, the Alliance could decide to blacklist a manufacturer just because they haven't implemented some new policy (like requiring a DNA scan of the user) so you better make sure that you buy a device from one of the "too big to fail" providers.
      - md_ 5y ago
        > The point being, the FIDO Alliance reserves the right to blacklist any device that an attacker manages to extract the secret keys from, which has the consequence that 99,999 other people have their devices bricked. 1. By what mechanism can they blacklist a device? A given relying party can choose to use or not use attestation and, if they choose to use it, which certificates to trust. But that's between you and the RP. Authentication doesn't "talk to" the FIDO Alliance--which is just a standards body and does not (AFAIK) even publish anything like a CRL for "bad" attestation keys, so I don't understand what you are talking about here. 2. The intention of the attestation, as I understand it, is to enable RPs to use attestation to limit authenticators to e.g. those that pass FIPS certification (or similar enterprisey requirements), not to ban a whole batch because one key is known to be compromised. That's crazy; can you point out where anyone other than you has ever proposed this? 3. DNA scan? What are you talking about? 4. This assertion you are making, while bizarre and wrong, is very different than the assertion the grandparent made ("Yubikeys intentionally have a very small number of devices signed with one CA key...so those devices do have a basically unique identifier"), which, while also wrong, is I think a genuine mistake and not a bad-faith argument.
raxxorraxor 5y ago
What is collective privacy? Also, why not allow uncertified devices to generate keys? Why do I have to implement secure boot or TPM?