4 ms·

The only real problem with passwords is that humans are extremely bad at those without an aid of a password manager (when they’re no longer words but turn into

The only real problem with passwords is that humans are extremely bad at those without an aid of a password manager (when they’re no longer words but turn into pre-shared tokens). There are more, of course, but not as important. So people invented OpenID and OAuth and stuff, but all those things are fundamentally flawed because users were no longer a source of their “own” identifies. Their identities became provided by third parties - and this is notoriously bad. WebAuthn (and FIDO stuff) is not centralized, on the contrary - users still own their credentials and are sources of their identities (though there are optional attestations). It doesn’t require cryptography knowledge to use it, but it does to implement it - thus the certification (though anyone can surely do it without certifying for anything).

db65edfc7996 4y ago
>The only real problem with passwords is that humans are extremely bad at those without an aid of a password manager (when they’re no longer words but turn into pre-shared tokens) Human are also bad at not losing/breaking their magical security totem. I need to know that I can easily backup codes to any of these hardware tokens for if/when one is lost. Ultimate security be damned.
- postalrat 4y ago
  Whats wrong with authenticating multiple tokens and backing up the physical tokens? I'd rather know that each token is unique and not wonder how many copies of the token exist.
eikenberry 4y ago
It is implicitly centralized if the user doesn't have a means to control the secret key themselves. The minimally need to be able to import new keys into a device to keep control. Otherwise whoever owns those keys is really the one in control, which is really what the higher FIDO levels are about (as they are targeting enterprise customers that want central control). L1 (software based) obviously fits this requirement. I think L2 also can because while it is a physical key it could allow for the user to import their own secret. L3 takes that away as it must come from the manufacture with a key that cannot be accessed. Not 100% on any of this, but it's what I get from their level doc... https://fidoalliance.org/certification/authenticator-certification-levels/ https://fidoalliance.org/certification/authenticator-certifi...
- supertrope 4y ago
  That's the trade-off between security for the masses and savvy individuals having more control. A person can't get phished for their credentials if they can't access the private key. Journalists have emailed their GPG private key when learning how to use it. Even TOTP can be beat with fake webpages or a social engineer who asks for the code.

db65edfc7996 4y ago

>The only real problem with passwords is that humans are extremely bad at those without an aid of a password manager (when they’re no longer words but turn into pre-shared tokens) Human are also bad at not losing/breaking their magical security totem. I need to know that I can easily backup codes to any of these hardware tokens for if/when one is lost. Ultimate security be damned.

postalrat 4y ago
Whats wrong with authenticating multiple tokens and backing up the physical tokens? I'd rather know that each token is unique and not wonder how many copies of the token exist.

eikenberry 4y ago

It is implicitly centralized if the user doesn't have a means to control the secret key themselves. The minimally need to be able to import new keys into a device to keep control. Otherwise whoever owns those keys is really the one in control, which is really what the higher FIDO levels are about (as they are targeting enterprise customers that want central control). L1 (software based) obviously fits this requirement. I think L2 also can because while it is a physical key it could allow for the user to import their own secret. L3 takes that away as it must come from the manufacture with a key that cannot be accessed. Not 100% on any of this, but it's what I get from their level doc... https://fidoalliance.org/certification/authenticator-certification-levels/ https://fidoalliance.org/certification/authenticator-certifi...

supertrope 4y ago
That's the trade-off between security for the masses and savvy individuals having more control. A person can't get phished for their credentials if they can't access the private key. Journalists have emailed their GPG private key when learning how to use it. Even TOTP can be beat with fake webpages or a social engineer who asks for the code.