7 ms·

I think that the solution is to make it a non-issue: fingerprint the machine and make sure that the auth tokens are only usable on that specific machine... but

I think that the solution is to make it a non-issue: fingerprint the machine and make sure that the auth tokens are only usable on that specific machine... but this solution is both a privacy nightmare and a flimsy deterrent (especially on Linux, somewhat on Windows, might actually work on Macs though). I agree with Microsoft that it's a non-issue: there's no concept of a separate user-inaccessible data compartment unlike with Android and iOS, so the best they could do is to store it in system-provided keychain (but usually it is often unlocked during log-in, defeating its purpose).

gw99 4y ago
Actually there is Credential Guard which in concept does this. But Microsoft only use this for Kerberos/Domain stuff and it's only supported in Enterprise Edition. They only don't support this because Windows is market segmented and Microsoft have fuck all product management and direction that isn't run by an army of crack smoking monkeys.
zhengyi13 4y ago
> there's no concept of a separate user-inaccessible data compartment Would a TPM serve here, in some hypothetical world where folk were willing to put in the work to do this? Or I guess I'm asking, naively, what are the functional differences between the TPMs on our desktop/laptop machines, and what smartphones have in them?
- zinekeller 4y ago
  It could work but in Windows you generally need administrator privileges to touch TPM. > Or I guess I'm asking, naively, what are the functional differences between the TPMs on our desktop/laptop machines, and what smartphones have in them? A security processor on mobile devices are usually actually like TPM and Intel SGX combined together. I won't say it's better than PC TPMs, but have a very different design.
- yrro 4y ago
  At some point Teams has to ask the TPM to unseal its encrypted copy of the access token. At that point an attacker can read the communication between Teams and the TPM, or it can read the token straight out of Teams' memory space.
  - Genbox 4y ago
    Unless the TPM performs the cryptographic operations on the chip itself. TPM can do asymmetric crypto using a key in it's secure storage. It would require Microsoft to use a different authentication scheme based on ephemeral signed tokens instead of OAUth to be beneficial for security. That is very unlikely to happen. That scheme would also only reduce the access timeframe from whatever the OAuth token's lifetime is, to a timeframe constrained to the amount of time the computer (the key) is online.

gw99 4y ago

Actually there is Credential Guard which in concept does this. But Microsoft only use this for Kerberos/Domain stuff and it's only supported in Enterprise Edition. They only don't support this because Windows is market segmented and Microsoft have fuck all product management and direction that isn't run by an army of crack smoking monkeys.

zhengyi13 4y ago

> there's no concept of a separate user-inaccessible data compartment Would a TPM serve here, in some hypothetical world where folk were willing to put in the work to do this? Or I guess I'm asking, naively, what are the functional differences between the TPMs on our desktop/laptop machines, and what smartphones have in them?

zinekeller 4y ago
It could work but in Windows you generally need administrator privileges to touch TPM. > Or I guess I'm asking, naively, what are the functional differences between the TPMs on our desktop/laptop machines, and what smartphones have in them? A security processor on mobile devices are usually actually like TPM and Intel SGX combined together. I won't say it's better than PC TPMs, but have a very different design.
yrro 4y ago
At some point Teams has to ask the TPM to unseal its encrypted copy of the access token. At that point an attacker can read the communication between Teams and the TPM, or it can read the token straight out of Teams' memory space.
- Genbox 4y ago
  Unless the TPM performs the cryptographic operations on the chip itself. TPM can do asymmetric crypto using a key in it's secure storage. It would require Microsoft to use a different authentication scheme based on ephemeral signed tokens instead of OAUth to be beneficial for security. That is very unlikely to happen. That scheme would also only reduce the access timeframe from whatever the OAuth token's lifetime is, to a timeframe constrained to the amount of time the computer (the key) is online.