3 ms·

I don't see any user verification anywhere here. All I see is Javascript calls that create a credential on the client without ever asking the user about it. How

by pdonis 4y ago

I don't see any user verification anywhere here. All I see is Javascript calls that create a credential on the client without ever asking the user about it. How is this not vulnerable to someone else impersonating me?

tialaramex 4y ago
If you request User Verification (UV) rather than just User Presence (UP) then the authenticator does whatever it does verify this is actually the same user, and not just any human. That's up to the authenticator, and is irrelevant to the Javascript code. On the cheapest devices this is typically a PIN entry, so maybe a GUI window appears on their PC and they type in some value the authenticator knows, maybe it's "FuckGoogle" or "870429". But there are devices where it's fingerprint recognition, it's entirely up to the device (except that the PIN entry feature has explicit protocol support so that your OS can help out) After it sees acceptable verification, the authenticator signs the message it's sending back, it doesn't actually understand most of the message, because it is just a very dumb piece of electronics, but it does understand a series of bitflags, in this case the flags UP and UV which we mentioned at the start. So it knows it is signing a message about User Verification (or in most cases on the Web, it is not asked for User Verification, because for e.g. second factor on the web you needn't have that, "I have the device" is the second factor)
some_furry 4y ago
The browser APIs in question handle that aspect. Check out the linked demos if you're not sure what that looks like.
sebk 4y ago
It's on the other portion of FIDO2: CTAP, short for Client to Authenticator Protocol. Your authenticator (A TPM, a YubiKey, maybe a phone) verifies your biometrics, pin, or presence before signing a request for the client (the browser, in the case of WebAuthn).
- pdonis 4y ago
  Ah, got it. Thanks!

by pdonis 4y ago

tialaramex 4y ago

If you request User Verification (UV) rather than just User Presence (UP) then the authenticator does whatever it does verify this is actually the same user, and not just any human. That's up to the authenticator, and is irrelevant to the Javascript code. On the cheapest devices this is typically a PIN entry, so maybe a GUI window appears on their PC and they type in some value the authenticator knows, maybe it's "FuckGoogle" or "870429". But there are devices where it's fingerprint recognition, it's entirely up to the device (except that the PIN entry feature has explicit protocol support so that your OS can help out) After it sees acceptable verification, the authenticator signs the message it's sending back, it doesn't actually understand most of the message, because it is just a very dumb piece of electronics, but it does understand a series of bitflags, in this case the flags UP and UV which we mentioned at the start. So it knows it is signing a message about User Verification (or in most cases on the Web, it is not asked for User Verification, because for e.g. second factor on the web you needn't have that, "I have the device" is the second factor)

some_furry 4y ago

The browser APIs in question handle that aspect. Check out the linked demos if you're not sure what that looks like.

sebk 4y ago

It's on the other portion of FIDO2: CTAP, short for Client to Authenticator Protocol. Your authenticator (A TPM, a YubiKey, maybe a phone) verifies your biometrics, pin, or presence before signing a request for the client (the browser, in the case of WebAuthn).

pdonis 4y ago
Ah, got it. Thanks!