4 ms·

The idea of authenticator hardware is inherently hostile to DIY and open source because you cannot produce or extract a keypair to generate valid attestation st

The idea of authenticator hardware is inherently hostile to DIY and open source because you cannot produce or extract a keypair to generate valid attestation statements. Unless you are part of the cartel of course. https://w3c.github.io/webauthn/#attestation-statement https://w3c.github.io/webauthn/#attestation-statement

woodruffw 3y ago
WebAuthn doesn’t require the RP to enforce any particular hardware attestation, and many sites (the overwhelmingly majority?) allow anonymous attestation, self-attestation, or simply no attestation at all. Having hard-to-extract device keys isn’t “DIY hostile”; it’s critical to the attestation security model. If you want to build your own WebAuthn authenticator, then you can either form your attestation root (there’s no “blessed” vendor list that I know of) or simply ignore that part of the spec.
- no_time 3y ago
  I am aware how attestation works and what problem it addresses. But I strongly believe the power imbalance it creates outweighs the benefits. Especially with bullshit like CF using it as a captcha substitute. https://blog.cloudflare.com/introducing-cryptographic-attestation-of-personhood/ https://blog.cloudflare.com/introducing-cryptographic-attest...
  - adql 3y ago
    This fucking article. CF, WHICH IS THE FUCKING SOURCE OF THIS PROBLEM, complains about the problem
  - woodruffw 3y ago
    I happen to agree that this is a bad use of attestation (as well as a pointless one, since it’s cheaper and easier for a click farm to do attestation with a bunch of yubikeys than to contact out CAPTCHA solves). However, I don’t really think it’s an indictment of either WebAuthn or attestation more generally: as pointed out, most public services do not (and probably will never) require attestation. The winds are against it more generally: non-attestation flows are easier to implement, and WebAuthn adoption is increasingly driven by authenticators that don’t necessarily offer useful attestations (e.g. on-device and virtual tokens). Most future users of WebAuthn won’t have physical keys of the sort that Cloudflare’s scheme will require.
- mooreds 3y ago
  The FIDO alliance offers up a JWT with attestation data: https://fidoalliance.org/metadata/ https://fidoalliance.org/metadata/ But I agree, I don't think there's any enforcement mechanism beyond whatever the RP decide.
robertlagrant 3y ago
> The idea of authenticator hardware is inherently hostile to DIY and open source Isn't this the same with all hardware?
mindslight 3y ago
Attestation isn't a necessary requirement of an authentication token, and is inherently hostile to user freedom. If some knobsite wants to insist on me using a "hardware authentication key" (similar to how many currently insist on using email/SMS codes), but I want to set it up so that secret is stored in my browser because that site isn't so important to me, setting my own security policy that directly contradicts their wishes should be my right. Their control shouldn't extend onto my own computers(s), with the demarcation point being the Internet itself.
JohnFen 3y ago
> The idea of authenticator hardware is inherently hostile to DIY and open source The authenticator hardware that I use every day is a device I built myself.

woodruffw 3y ago

WebAuthn doesn’t require the RP to enforce any particular hardware attestation, and many sites (the overwhelmingly majority?) allow anonymous attestation, self-attestation, or simply no attestation at all. Having hard-to-extract device keys isn’t “DIY hostile”; it’s critical to the attestation security model. If you want to build your own WebAuthn authenticator, then you can either form your attestation root (there’s no “blessed” vendor list that I know of) or simply ignore that part of the spec.

no_time 3y ago
I am aware how attestation works and what problem it addresses. But I strongly believe the power imbalance it creates outweighs the benefits. Especially with bullshit like CF using it as a captcha substitute. https://blog.cloudflare.com/introducing-cryptographic-attestation-of-personhood/ https://blog.cloudflare.com/introducing-cryptographic-attest...
- adql 3y ago
  This fucking article. CF, WHICH IS THE FUCKING SOURCE OF THIS PROBLEM, complains about the problem
- woodruffw 3y ago
  I happen to agree that this is a bad use of attestation (as well as a pointless one, since it’s cheaper and easier for a click farm to do attestation with a bunch of yubikeys than to contact out CAPTCHA solves). However, I don’t really think it’s an indictment of either WebAuthn or attestation more generally: as pointed out, most public services do not (and probably will never) require attestation. The winds are against it more generally: non-attestation flows are easier to implement, and WebAuthn adoption is increasingly driven by authenticators that don’t necessarily offer useful attestations (e.g. on-device and virtual tokens). Most future users of WebAuthn won’t have physical keys of the sort that Cloudflare’s scheme will require.
mooreds 3y ago
The FIDO alliance offers up a JWT with attestation data: https://fidoalliance.org/metadata/ https://fidoalliance.org/metadata/ But I agree, I don't think there's any enforcement mechanism beyond whatever the RP decide.

robertlagrant 3y ago

> The idea of authenticator hardware is inherently hostile to DIY and open source Isn't this the same with all hardware?

mindslight 3y ago

Attestation isn't a necessary requirement of an authentication token, and is inherently hostile to user freedom. If some knobsite wants to insist on me using a "hardware authentication key" (similar to how many currently insist on using email/SMS codes), but I want to set it up so that secret is stored in my browser because that site isn't so important to me, setting my own security policy that directly contradicts their wishes should be my right. Their control shouldn't extend onto my own computers(s), with the demarcation point being the Internet itself.

JohnFen 3y ago

> The idea of authenticator hardware is inherently hostile to DIY and open source The authenticator hardware that I use every day is a device I built myself.