4 ms·

The problem with any key based auth or biometric auth is a user can be compelled by LEO to hand over private keys or open a biometric lock. Passwords are prote

The problem with any key based auth or biometric auth is a user can be compelled by LEO to hand over private keys or open a biometric lock. Passwords are protected by the 5th amendment.

Rafert 4y ago
The actual exchange with the server is using public key cryptography. How you unlock the key material locally could be a number of ways: PIN, password, fingerprint scan, voice recognition, etc
la6472 4y ago
Why do we need another AuthN protocol? We should extend OIDC as needed instead of again trying to reinvent the wheel.
- bdamm 4y ago
  Because the interaction with the hardware authenticator is local. OIDC and WebAuthn can work together.
- drdaeman 4y ago
  In WebAuthn you're actually in possession of your own identity (or, to be more precise, your identity is established between you and website). In OpenID, OAuth and OpenID Connect the paradigm is completely different, where your identity is provided by someone else.
  - la6472 4y ago
    Yes I get that but I think OIDC could be extended to cover that too whereas the Authenticator or iDP is the local face scanner kr other biometric and then the rest ie exchange of token etc stays the same. That way there won’t be two completely separate path and that will defeat the purpose of SSO. And it looks like there are already some implementation of this https://www.bioid.com/facial-recognition-app/ https://www.bioid.com/facial-recognition-app/
deleted 4y ago
[deleted]
stingraycharles 4y ago
The standard answers for these things is to use both; they’re not mutually exclusive, and for important things you almost certainly want both.
- staticassertion 4y ago
  The expansion mentioned in the article is explicitly passwordless.
lnxg33k1 4y ago
I think the main problem I’m never buying into Fido keys anymore is that mine point blank stopped working and I had to sweat to get back in website that supported it, hopefully back then not many, but if identity is the responsibility of a close piece of hardware if it breaks you’re out
- bdamm 4y ago
  Normally you can assign multiple keys to one identity. That's baked into WebAuthn and pretty much all the implementations I've seen do it.
devwastaken 4y ago
You can be compelled by the court to divulge passwords. It's one of those areas of interpretation of law and there's precedent against it as can be searched for.
rad88 4y ago
The litigation on that matter is ongoing. What you said is not true right now. If you try to fight an order for your password, you'll wind up in court and probably lose, and then have to chose whether to act in contempt.
danuker 4y ago
> Passcodes can therefore be compelled if their existence, possession and authentication are "foregone conclusions," the court said in the August 2020 ruling, determining the 5th Amendment's foregone conclusion exception applied in the case. https://www.reuters.com/business/legal/us-supreme-court-nixes-appeal-over-forced-password-disclosure-2021-05-17/ https://www.reuters.com/business/legal/us-supreme-court-nixe...
- matheusmoreira 4y ago
  What if you forget the password?
  - deleted 4y ago
    [deleted]
  - Wohlf 4y ago
    Same as if you forget your safe combination, you're charged with contempt of court.
babypuncher 4y ago
For most people living in a western democracy, this is a pretty minor consideration to their threat model. Most people default to what is easiest. Before TouchID, most iPhone users did not lock their phones with a password. Making biometrics readily available and default means more people are walking around with more secure devices than would be if we only encouraged people to use the absolute most secure options available.
jbverschoor 4y ago
For apple devices the keys are stored in a secure element. You need your password to access when booting, or after certain timeouts. Until then you can’t use faceid/touchid
deleted 4y ago
[deleted]

The problem with any key based auth or biometric auth is a user can be compelled by LEO to hand over private keys or open a biometric lock. Passwords are protected by the 5th amendment.

Rafert 4y ago

The actual exchange with the server is using public key cryptography. How you unlock the key material locally could be a number of ways: PIN, password, fingerprint scan, voice recognition, etc

la6472 4y ago

Why do we need another AuthN protocol? We should extend OIDC as needed instead of again trying to reinvent the wheel.

bdamm 4y ago
Because the interaction with the hardware authenticator is local. OIDC and WebAuthn can work together.
drdaeman 4y ago
In WebAuthn you're actually in possession of your own identity (or, to be more precise, your identity is established between you and website). In OpenID, OAuth and OpenID Connect the paradigm is completely different, where your identity is provided by someone else.
- la6472 4y ago
  Yes I get that but I think OIDC could be extended to cover that too whereas the Authenticator or iDP is the local face scanner kr other biometric and then the rest ie exchange of token etc stays the same. That way there won’t be two completely separate path and that will defeat the purpose of SSO. And it looks like there are already some implementation of this https://www.bioid.com/facial-recognition-app/ https://www.bioid.com/facial-recognition-app/

deleted 4y ago

[deleted]

stingraycharles 4y ago

The standard answers for these things is to use both; they’re not mutually exclusive, and for important things you almost certainly want both.

staticassertion 4y ago
The expansion mentioned in the article is explicitly passwordless.

lnxg33k1 4y ago

I think the main problem I’m never buying into Fido keys anymore is that mine point blank stopped working and I had to sweat to get back in website that supported it, hopefully back then not many, but if identity is the responsibility of a close piece of hardware if it breaks you’re out

bdamm 4y ago
Normally you can assign multiple keys to one identity. That's baked into WebAuthn and pretty much all the implementations I've seen do it.

devwastaken 4y ago

You can be compelled by the court to divulge passwords. It's one of those areas of interpretation of law and there's precedent against it as can be searched for.

rad88 4y ago

The litigation on that matter is ongoing. What you said is not true right now. If you try to fight an order for your password, you'll wind up in court and probably lose, and then have to chose whether to act in contempt.

danuker 4y ago

> Passcodes can therefore be compelled if their existence, possession and authentication are "foregone conclusions," the court said in the August 2020 ruling, determining the 5th Amendment's foregone conclusion exception applied in the case. https://www.reuters.com/business/legal/us-supreme-court-nixes-appeal-over-forced-password-disclosure-2021-05-17/ https://www.reuters.com/business/legal/us-supreme-court-nixe...

matheusmoreira 4y ago
What if you forget the password?
- deleted 4y ago
  [deleted]
- Wohlf 4y ago
  Same as if you forget your safe combination, you're charged with contempt of court.

babypuncher 4y ago

For most people living in a western democracy, this is a pretty minor consideration to their threat model. Most people default to what is easiest. Before TouchID, most iPhone users did not lock their phones with a password. Making biometrics readily available and default means more people are walking around with more secure devices than would be if we only encouraged people to use the absolute most secure options available.

jbverschoor 4y ago

For apple devices the keys are stored in a secure element. You need your password to access when booting, or after certain timeouts. Until then you can’t use faceid/touchid

deleted 4y ago

[deleted]