3 ms·

Can you link to more documentation on this issue? Why can my Linux box not act as an authenticator, perhaps using TPM or just with software security?

by aftbit 3y ago

danShumway 3y ago
> Why can my Linux box not act as an authenticator That is a really good question. For whatever reason, I'm not aware of a single Open Source platform authenticator for any platform. It seems to me like that would be a pretty big priority for an Open standard, but what do I know? Google has said they have "no plans" to support platform authentication on Linux[0]. I don't know if this is just them saying they don't plan to build a platform authenticator themselves, or if they're saying that if a Linux box advertises that it has a platform authenticator, they're not going to trust it. Either way, passkeys basically require you to either buy a Yubikey/dongle (which will not support cloud sync) or to use a proprietary OS as your authenticator. https://developers.google.com/identity/passkeys/supported-environments#:~:text=Passkeys%20from%20Google%20Password%20Manager%20are%20available%20to%20all%20Android%20apps%2C%20including%20Chrome%20and%20other%20browsers https://developers.google.com/identity/passkeys/supported-en...
derefr 3y ago
It's probably because biometrics support (via fingerprint sensors et al) isn't a standard part of the Linux desktop/notebook "platform"; and so most Linux devices would just be prompting you for a password to unlock your passkey anyway (like prompting for an SSH passphrase to unlock an SSH key) — at which point, why bother, if the whole goal was just to eliminate the possibility of being phished?
- danShumway 3y ago
  iCloud syncing already has this problem though. If I lose an iPhone and I buy a new iPhone and sign into an iCloud account, my passkeys will get synced. So I'm not sure I believe that really strong stances on potential phishing attacks are the real reason here. Passkeys with cloud sync are phishable. > why bother A single master password would still be a massive increase in security and would still eliminate a ton of phishing attacks. The cool parts of passkey aren't really the biometrics, the cool parts are how they get shared with websites. That's where the real phishing protection comes from.
  - rootusrootus 3y ago
    > If I lose an iPhone and I buy a new iPhone and sign into an iCloud account Have you done that recently? What a godforsaken pain in the ass it is, especially if you don't have another Apple device handy that you are already signed in to.
    - danShumway 3y ago
      It has been a fairly long while since I've needed to sync an iCloud account to a new computer. I'm mainly going off of https://support.apple.com/en-us/HT204974 https://support.apple.com/en-us/HT204974 so it definitely could be oversimplifying the requirements. Though even ignoring SMS and recovery codes, I'm not sure that using a second Apple device as 2FA would change anything; we generally don't consider one-time codes to be unphishable. But again, that's only me looking at the docs. Is there something I'm missing about the process that would block a phisher from using an iCloud password plus an SMS hijacking attack or phished one-time code to log in and set one of their devices as trusted?
    - lxgr 3y ago
      Isn’t an SMS-OTP as well as your old device’s unlock code enough?
- jasonjayr 3y ago
  Becuase you would not be entering your password into the browser, or a web site, you'd be entering your password to a seperate password manager, presumedly with an OS-level dialog which would would be using the backend protocol to verify/hash against the origin domain and supply the right key.

Can you link to more documentation on this issue? Why can my Linux box not act as an authenticator, perhaps using TPM or just with software security?

by aftbit 3y ago

Can you link to more documentation on this issue? Why can my Linux box not act as an authenticator, perhaps using TPM or just with software security?

danShumway 3y ago

> Why can my Linux box not act as an authenticator That is a really good question. For whatever reason, I'm not aware of a single Open Source platform authenticator for any platform. It seems to me like that would be a pretty big priority for an Open standard, but what do I know? Google has said they have "no plans" to support platform authentication on Linux[0]. I don't know if this is just them saying they don't plan to build a platform authenticator themselves, or if they're saying that if a Linux box advertises that it has a platform authenticator, they're not going to trust it. Either way, passkeys basically require you to either buy a Yubikey/dongle (which will not support cloud sync) or to use a proprietary OS as your authenticator. https://developers.google.com/identity/passkeys/supported-environments#:~:text=Passkeys%20from%20Google%20Password%20Manager%20are%20available%20to%20all%20Android%20apps%2C%20including%20Chrome%20and%20other%20browsers https://developers.google.com/identity/passkeys/supported-en...

derefr 3y ago

It's probably because biometrics support (via fingerprint sensors et al) isn't a standard part of the Linux desktop/notebook "platform"; and so most Linux devices would just be prompting you for a password to unlock your passkey anyway (like prompting for an SSH passphrase to unlock an SSH key) — at which point, why bother, if the whole goal was just to eliminate the possibility of being phished?

danShumway 3y ago
iCloud syncing already has this problem though. If I lose an iPhone and I buy a new iPhone and sign into an iCloud account, my passkeys will get synced. So I'm not sure I believe that really strong stances on potential phishing attacks are the real reason here. Passkeys with cloud sync are phishable. > why bother A single master password would still be a massive increase in security and would still eliminate a ton of phishing attacks. The cool parts of passkey aren't really the biometrics, the cool parts are how they get shared with websites. That's where the real phishing protection comes from.
- rootusrootus 3y ago
  > If I lose an iPhone and I buy a new iPhone and sign into an iCloud account Have you done that recently? What a godforsaken pain in the ass it is, especially if you don't have another Apple device handy that you are already signed in to.
  - danShumway 3y ago
    It has been a fairly long while since I've needed to sync an iCloud account to a new computer. I'm mainly going off of https://support.apple.com/en-us/HT204974 https://support.apple.com/en-us/HT204974 so it definitely could be oversimplifying the requirements. Though even ignoring SMS and recovery codes, I'm not sure that using a second Apple device as 2FA would change anything; we generally don't consider one-time codes to be unphishable. But again, that's only me looking at the docs. Is there something I'm missing about the process that would block a phisher from using an iCloud password plus an SMS hijacking attack or phished one-time code to log in and set one of their devices as trusted?
  - lxgr 3y ago
    Isn’t an SMS-OTP as well as your old device’s unlock code enough?
jasonjayr 3y ago
Becuase you would not be entering your password into the browser, or a web site, you'd be entering your password to a seperate password manager, presumedly with an OS-level dialog which would would be using the backend protocol to verify/hash against the origin domain and supply the right key.