3 ms·

Safari already gates password autofill on the secure element (or enclave, I can never remember the difference) when such is available, which is what you're sugg

by olliej 4y ago

Safari already gates password autofill on the secure element (or enclave, I can never remember the difference) when such is available, which is what you're suggesting :D That said you're absolutely correct, making autofill harder to use would mean people wouldn't use it, and would revert to predictable and reused passwords, and if you're a business you should be using token based authentication be they dongles or phone and PC's secure elements.

denton-scratch 4y ago
> you should be using token based authentication be they dongles or phone and PC's secure elements. Phone? Really? I regard my smartphone as the least-secure piece of computing equipment in my posession. I certainly don't trust it to secure anything. A phone isn't a token; it happens to be "something you own", so some sites treat a phone as if it were a security token. This is a problem I encounter mainly on UK government sites (sites that I more-or-less have to use). These sites don't offer support for alternative hardware "tokens", nor for people who don't own a smartphone.
- olliej 4y ago
  I had assumed that at this point all android phones have got some equivalent to the secure element present in all apple products produced in the last 5+ years, if they don't that's bananas. Assuming that, a phone is likely one of the most secure devices that you own.
  - denton-scratch 4y ago
    Having a "secure element", enclave or whatever, doesn't mean that some rando TPA app is using it. I'm not qualified to inspect the source-code of Android apps. As far as I'm conceerned, these enclaves aren't for my protection; they're there to protect the interests of the device's owners (which isn't me). A smartphone OS runs under the supervision of another OS, which is proprietary - source-code not supplied. A lot of the hardware is also proprietary, each component having its own (opaque) firmware blob. The device has telephony and internet connectivity. The connectivity providers behave as if they own the device, install software without warning, and surreptitiously inject content. If I'm not competent to analyse the device myself (and I'm not), then I'm dependent on third-parties to confirm the device is secure. How many smartphone reviews have you read recently that focused on security, rather than how shiny the device is, how good the cameras are, or how good the screen is? I don't recall ever seeing a review that paid any attention to security. These are opaque devices, with a huge attack surface. It makes no sense to me to describe it as "one of the most secure devices that you own".
    - olliej 4y ago
      I agree on the TPA not using the secure element on the phone is an issue, but I wasn't addressing low quality authenticator apps, but for apps or for tokens you're assuming that the developers haven't cheaped out. > A smartphone OS ... Yes, and the same applies to tokens albeit with simpler logic, and the same applies to any PC. So at some point you're saying "I trust that the company producing the product I'm using is not lying in their security documentation". > .. Reviews ... Correct, because reviewers are talking about feature set, competent phone companies provide extensive documentation of the security architecture of the devices. Security researchers periodically write up their investigations. > These are opaque devices, with a huge attack surface. No, by the standards you have presented all your devices are opaque, but unlike every other device you own the default security model of a well designed phone is far stronger than any other device you have. They don't run arbitrary code, they don't support loading code into kernel space, user partitions are completely separated from the read only system partitions, etc.
      - denton-scratch 4y ago
        > all your devices are opaque Point taken. I'd take a maximum transparency keyfob-type device. By "maximum transparency", I mean I'd have to be able to assemble it myself, from COTS components, and understand any software it runs. But I have no idea how to make such a thing (I've tinkered a bit with microcontrollers and TTL). The closest I'm aware of is the fob my bank gave me; it has a number-pad and a display, you read a challenge off the screen, and trype it into the keypad. It displays numeric response, and you type it into the website form. That seems cool, if I could build the device myself, or even know what it does.

by olliej 4y ago

denton-scratch 4y ago

> you should be using token based authentication be they dongles or phone and PC's secure elements. Phone? Really? I regard my smartphone as the least-secure piece of computing equipment in my posession. I certainly don't trust it to secure anything. A phone isn't a token; it happens to be "something you own", so some sites treat a phone as if it were a security token. This is a problem I encounter mainly on UK government sites (sites that I more-or-less have to use). These sites don't offer support for alternative hardware "tokens", nor for people who don't own a smartphone.

olliej 4y ago
I had assumed that at this point all android phones have got some equivalent to the secure element present in all apple products produced in the last 5+ years, if they don't that's bananas. Assuming that, a phone is likely one of the most secure devices that you own.
- denton-scratch 4y ago
  Having a "secure element", enclave or whatever, doesn't mean that some rando TPA app is using it. I'm not qualified to inspect the source-code of Android apps. As far as I'm conceerned, these enclaves aren't for my protection; they're there to protect the interests of the device's owners (which isn't me). A smartphone OS runs under the supervision of another OS, which is proprietary - source-code not supplied. A lot of the hardware is also proprietary, each component having its own (opaque) firmware blob. The device has telephony and internet connectivity. The connectivity providers behave as if they own the device, install software without warning, and surreptitiously inject content. If I'm not competent to analyse the device myself (and I'm not), then I'm dependent on third-parties to confirm the device is secure. How many smartphone reviews have you read recently that focused on security, rather than how shiny the device is, how good the cameras are, or how good the screen is? I don't recall ever seeing a review that paid any attention to security. These are opaque devices, with a huge attack surface. It makes no sense to me to describe it as "one of the most secure devices that you own".
  - olliej 4y ago
    I agree on the TPA not using the secure element on the phone is an issue, but I wasn't addressing low quality authenticator apps, but for apps or for tokens you're assuming that the developers haven't cheaped out. > A smartphone OS ... Yes, and the same applies to tokens albeit with simpler logic, and the same applies to any PC. So at some point you're saying "I trust that the company producing the product I'm using is not lying in their security documentation". > .. Reviews ... Correct, because reviewers are talking about feature set, competent phone companies provide extensive documentation of the security architecture of the devices. Security researchers periodically write up their investigations. > These are opaque devices, with a huge attack surface. No, by the standards you have presented all your devices are opaque, but unlike every other device you own the default security model of a well designed phone is far stronger than any other device you have. They don't run arbitrary code, they don't support loading code into kernel space, user partitions are completely separated from the read only system partitions, etc.
    - denton-scratch 4y ago
      > all your devices are opaque Point taken. I'd take a maximum transparency keyfob-type device. By "maximum transparency", I mean I'd have to be able to assemble it myself, from COTS components, and understand any software it runs. But I have no idea how to make such a thing (I've tinkered a bit with microcontrollers and TTL). The closest I'm aware of is the fob my bank gave me; it has a number-pad and a display, you read a challenge off the screen, and trype it into the keypad. It displays numeric response, and you type it into the website form. That seems cool, if I could build the device myself, or even know what it does.