4 ms·

Friendly reminder that device attestation is part of FIDO and webauthn. It isn't enough that both your device and the website speak the protocol. The website

Friendly reminder that device attestation is part of FIDO and webauthn. It isn't enough that both your device and the website speak the protocol. The website gets to cryptographically verify that your device is not under owner control. If you want a FIDO/webauthn device that lets you have the key material (like HOTP does), you're out of luck. No owner-controlled devices allowed.

dane-pgp 4y ago
That's an important observation. We're going to go from "Log in with your Apple, Google, or Microsoft account" to "Log in with your Apple, Google, or Microsoft hardware".
nonrandomstring 4y ago
> No owner-controlled devices allowed [1]. This is actually a key point with respect to digital rights. When you analyse the debacle that put Jordan Peterson in the spotlight it was not really about gender pronouns as such, but about compelled speech. Compelled anything is a problem. Compulsion removes responsibility. For example, I am currently not compelled to own a car, so I can make the choice to help the climate by walking. I am not compelled to own a television, as in Orwell's 1984, so I can select my own entertainment and news. What does this have to do with cybersecurity? Ownership and control are central to the psychological motivations that allow security to work at all. Let's ask the question, would you allow a stranger to dump their possessions in your lounge for a few weeks? No. You'd at least charge them rent for storage. Stuff that takes up your space, that you cannot use, and are responsible for is an encumbrance. Now let's say that a government or some cabal of tech-monopolists, begin forcing you to shoulder encumbrances that you must install in your home, or walk around carrying - physical devices that you do not own in any real sense. This is an imposition. An analogy that springs to mind is the US constitutional third amendment on the quartering of soldiers in private homes without the owner's consent [2]. With secure enclaves we are seeing a drift toward devices as both an encumbrance and imposition. Hardware one is compelled to use and take responsibility for, such as repair or charging batteries, which serves the interests of others (to track and identify you) is a cost without benefit, and has no future. Unless you physically attach it, like a prison tag, you can no more compel a person to carry an object than you can compel their speech. Unless the owner acts by volition, and chooses to take responsibility for an object in their own self-interest, various forms of sabotage are inevitable. I've seen this where workplaces have tried to push workers into carrying a "company smartphone". It gets "lost". It gets "broken". People lock them and then "forget" the password. Security solutions need the consent and cooperation of both subjects. Otherwise they are not "security", but simply means of control. At the very least we should stop dignifying them with the word "security". [1] "Owner-controlled" is already a tautology. Ownership implies control (and freedom to dispose of) and vice versa. Anything else is simply "in my possession" or "upon my person" as legal-people would say. [2] I never understood this seemingly ridiculous language about garrison of soldiers etc, but it increasingly makes sense to me as a catch all for any agent placed on my property. Hence I think that secure enclaves touch on 3rd amendment rights.
ryukafalz 4y ago
This is a good point, but I don’t know of any sites that actually do this. I hope it remains that way. I do wish the standard didn’t include that at all.
- e2le 4y ago
  Cloudflare is one example, using a security key not found in the FIDO Metadata Service, will not work on their site. This precludes the use of any hacker-friendly solution (making your own). > Supported: All security keys found in the FIDO Metadata Service 3.0, unless they have been revoked for security reasons. https://support.cloudflare.com/hc/en-us/articles/4406889048077-FAQs-for-Cryptographic-Attestation-of-Personhood#h_16OGl1pu5javVk3m408rPU https://support.cloudflare.com/hc/en-us/articles/44068890480... Attestation keys, aren't very "privacy friendly" either and it's much worse for those who wish to create their own key. > Usually, the attestation private key is shared between a batch of at least 100,000 security keys of the same model. If you build your own OpenSK, your private key is unique to you. This makes you identifiable across registrations: Two websites could collaborate to track if registrations were attested with the same key material. If you use OpenSK beyond experimentation, please consider carefully if you want to take this privacy risk. https://github.com/google/OpenSK/blob/f2496a8e6d71a4e838884996a1c9b62121f87df2/docs/customization.md https://github.com/google/OpenSK/blob/f2496a8e6d71a4e8388849...
  - zozbot234 4y ago
    That's used for Cryptographic Attestation of Personhood, so the restriction to genuine devices has some rationale behind it. It's not quite about checking an identity for login purposes, so much as checking that an actual human being is operating the device, via e.g. biometrics or physically poking in a PIN. (As a CAPTCHA replacement.) The precise key you use ought not to matter for that purpose, it could even be "enrolled" on the spot.

dane-pgp 4y ago

That's an important observation. We're going to go from "Log in with your Apple, Google, or Microsoft account" to "Log in with your Apple, Google, or Microsoft hardware".

nonrandomstring 4y ago

> No owner-controlled devices allowed [1]. This is actually a key point with respect to digital rights. When you analyse the debacle that put Jordan Peterson in the spotlight it was not really about gender pronouns as such, but about compelled speech. Compelled anything is a problem. Compulsion removes responsibility. For example, I am currently not compelled to own a car, so I can make the choice to help the climate by walking. I am not compelled to own a television, as in Orwell's 1984, so I can select my own entertainment and news. What does this have to do with cybersecurity? Ownership and control are central to the psychological motivations that allow security to work at all. Let's ask the question, would you allow a stranger to dump their possessions in your lounge for a few weeks? No. You'd at least charge them rent for storage. Stuff that takes up your space, that you cannot use, and are responsible for is an encumbrance. Now let's say that a government or some cabal of tech-monopolists, begin forcing you to shoulder encumbrances that you must install in your home, or walk around carrying - physical devices that you do not own in any real sense. This is an imposition. An analogy that springs to mind is the US constitutional third amendment on the quartering of soldiers in private homes without the owner's consent [2]. With secure enclaves we are seeing a drift toward devices as both an encumbrance and imposition. Hardware one is compelled to use and take responsibility for, such as repair or charging batteries, which serves the interests of others (to track and identify you) is a cost without benefit, and has no future. Unless you physically attach it, like a prison tag, you can no more compel a person to carry an object than you can compel their speech. Unless the owner acts by volition, and chooses to take responsibility for an object in their own self-interest, various forms of sabotage are inevitable. I've seen this where workplaces have tried to push workers into carrying a "company smartphone". It gets "lost". It gets "broken". People lock them and then "forget" the password. Security solutions need the consent and cooperation of both subjects. Otherwise they are not "security", but simply means of control. At the very least we should stop dignifying them with the word "security". [1] "Owner-controlled" is already a tautology. Ownership implies control (and freedom to dispose of) and vice versa. Anything else is simply "in my possession" or "upon my person" as legal-people would say. [2] I never understood this seemingly ridiculous language about garrison of soldiers etc, but it increasingly makes sense to me as a catch all for any agent placed on my property. Hence I think that secure enclaves touch on 3rd amendment rights.

ryukafalz 4y ago

This is a good point, but I don’t know of any sites that actually do this. I hope it remains that way. I do wish the standard didn’t include that at all.

e2le 4y ago
Cloudflare is one example, using a security key not found in the FIDO Metadata Service, will not work on their site. This precludes the use of any hacker-friendly solution (making your own). > Supported: All security keys found in the FIDO Metadata Service 3.0, unless they have been revoked for security reasons. https://support.cloudflare.com/hc/en-us/articles/4406889048077-FAQs-for-Cryptographic-Attestation-of-Personhood#h_16OGl1pu5javVk3m408rPU https://support.cloudflare.com/hc/en-us/articles/44068890480... Attestation keys, aren't very "privacy friendly" either and it's much worse for those who wish to create their own key. > Usually, the attestation private key is shared between a batch of at least 100,000 security keys of the same model. If you build your own OpenSK, your private key is unique to you. This makes you identifiable across registrations: Two websites could collaborate to track if registrations were attested with the same key material. If you use OpenSK beyond experimentation, please consider carefully if you want to take this privacy risk. https://github.com/google/OpenSK/blob/f2496a8e6d71a4e838884996a1c9b62121f87df2/docs/customization.md https://github.com/google/OpenSK/blob/f2496a8e6d71a4e8388849...
- zozbot234 4y ago
  That's used for Cryptographic Attestation of Personhood, so the restriction to genuine devices has some rationale behind it. It's not quite about checking an identity for login purposes, so much as checking that an actual human being is operating the device, via e.g. biometrics or physically poking in a PIN. (As a CAPTCHA replacement.) The precise key you use ought not to matter for that purpose, it could even be "enrolled" on the spot.