6 ms·

I don't understand which part of FIDO/WebAuthn requires "trusting Google or Microsoft"?

by cyphar 3y ago

stavros 3y ago
None, it's just misinformation.
- TacticalCoder 3y ago
  I don't think it's misinformation. You may decide, on your own website, for your own users, to accept passkeys from everybody but others won't. Sadly enough it's a near guarantee that the less secure implementations of passkeys (the software ones, allowing cloning and backups in the cloud) are likely to be the most accepted. While actually secure implementation with the secret hidden deep down behind an HSM and never leaving it, made by smaller companies who do care about security, are likely to be rejected on the ground that it's too much of an "obscure" vendor. I already posted about it today but if you think about it it's literally insane that cloning was meant to be detectable (and detection was enforced and upon detecting a cloned key, one of the two keys would stop working) and that this feature has now been removed with the sole justification being: "Because software backups to the cloud". It is not good.
  - vbezhenar 3y ago
    Are passkeys somehow signed by Google/Apple? I thought passkeys are like ssh keys.
    - stavros 3y ago
      They are, except they have a vendor ID that allows you to tell which vendor made the device you're talking to. You can get Passkeys by any number of vendors, but any authenticating website can decide to only allow a few vendors to log in with it.
      - rootusrootus 3y ago
        > any authenticating website can decide to only allow a few vendors to log in with it. That's an excellent way of telling your customers you want them to go somewhere else. What's the upside?
        stavros 3y ago
        I'm not sure, it sounds silly to me. I guess you can mandate "secure" brands?
      - lxgr 3y ago
        Synchronized passkeys by both Apple and Google don't use that mechanism (attestation). There's also the AAGUID, but without attestation, every implementation is free to provide Apple's or Google's, should websites ever start requiring that.
  - stavros 3y ago
    I don't understand how what you say relates to what was said. You don't need to trust Google/Microsoft for your Passkeys, you can use a Yubikey, or whatever else you want. If Google wants to only accepts its own Passkeys to log in to your Google account, that's as much its choice as any other site has for its authentication.
    - danShumway 3y ago
      > that's as much its choice as any other site has for its authentication. A site having the technical ability to determine not just its authentication mechanism but how that authentication mechanism is stored is not its choice and should not be its choice and is not its business. And its a clear degradation in user freedom over passwords, a system where it's impossible for Google to dictate that you use only a specific password manager to store and sync that password. It shouldn't be possible for Google to know how I'm storing a passkey. It's not their right to decide anything about that. They've never had that right. We're not taking a freedom away from Google, we're saying that Google should not have the ability to take away a freedom that we've always had, because they're our devices and it's our login information; it doesn't belong to Google.
      - rootusrootus 3y ago
        I suppose the answer is to use Apple, then? It sounds like you have something against attestation, which is a reasonable point, and Apple doesn't support attestation in their implementation of passkeys. Given the size of their customer base, that pretty much guarantees that nobody is going to be denying passkeys based on lack of attestation.
        danShumway 3y ago
        Yeah, I wrote this comment before I knew that Apple was dropping attestation. Them dropping attestation kind of renders the entire conversation moot, practically no one is going to require it if it means cutting off the entire Apple userbase. It's good news. It's honestly kind of the best possible situation short of attestation being outright removed from the spec. My bank doesn't understand "I should be able to use real 2FA instead of a text message", but they will understand "I should be able to log in from a Mac."
- bheadmaster 3y ago
  "It's just misinformation" is just fancy-speak for "it's bullshit". The former sounds pretentious and (wanna-be) authoritative. I personally prefer the latter form.
speed_spread 3y ago
The part where they are the sole implementors of the spec.
- vladvasiliu 3y ago
  What do you mean? I run Keycloak for my home lab authentication needs and can use my YubiKey as a Webauthn factor from Firefox running on my Linux PC. The only part where MS comes into the picture is the "Microsoft Windows" sticker on the bottom of the laptop, since HP shipped windows pre-installed.
  - eulers_secret 3y ago
    Even forcing people to buy yubikeys is an antipattern. We shouldn’t be forced to spend money at any company. Where are the Free (beer and Libre) methods??
    - vladvasiliu 3y ago
      There was a kinda-free option (as in you had to have an iPhone, but the app itself was free). Krypt.co had this based on the iphone's secure enclave. It was bought by Akamai, and it's not clear what state it's in. https://krypt.co/ https://krypt.co/ I think there was also an implementation for mac os based on the t1/t2 chip, but since I've never had such a mac, I've never looked properly into that. But that probably means that you could roll your own. A quick google search yields this for Linux with a TPM: https://github.com/psanford/tpm-fido https://github.com/psanford/tpm-fido
    - cyphar 3y ago
      Nitrokey has a free software implementation of their firmware. But ultimately you need to get some hardware _somehow_ which costs money, though some conferences give out free Yubikeys (or equivalent) and most enterprises would provide them to users directly.
account-5 3y ago
Nothing unless they're on only ones to provide it, or their implementations are the only "trusted" or accepted versions third parties allow you to use.
jerjerjer 3y ago
It is a very large and complex standard that further centralizes authentication in the hands of several megacorps. The previous OpenID attempt was a resounding success, and this is a logical continuation. Google and co want to know where you log in to serve you "better" ads. The countermeasure remains the same - create an isolated account on each new website/service you use.
- vladvasiliu 3y ago
  But you can use FIDO without ever touching MS/Google. For example, Codeberg (code hosting based on some soft-fork of Gitea) supports this with local-accounts.
- cyphar 3y ago
  What you are describing is Single Sign On, not WebAuthn/FIDO. Every site that I've used that has WebAuthn self-hosts it (GitHub, Twitter, Google, Microsoft, etc).

I don't understand which part of FIDO/WebAuthn requires "trusting Google or Microsoft"?

by cyphar 3y ago

I don't understand which part of FIDO/WebAuthn requires "trusting Google or Microsoft"?

stavros 3y ago

None, it's just misinformation.

TacticalCoder 3y ago
I don't think it's misinformation. You may decide, on your own website, for your own users, to accept passkeys from everybody but others won't. Sadly enough it's a near guarantee that the less secure implementations of passkeys (the software ones, allowing cloning and backups in the cloud) are likely to be the most accepted. While actually secure implementation with the secret hidden deep down behind an HSM and never leaving it, made by smaller companies who do care about security, are likely to be rejected on the ground that it's too much of an "obscure" vendor. I already posted about it today but if you think about it it's literally insane that cloning was meant to be detectable (and detection was enforced and upon detecting a cloned key, one of the two keys would stop working) and that this feature has now been removed with the sole justification being: "Because software backups to the cloud". It is not good.
- vbezhenar 3y ago
  Are passkeys somehow signed by Google/Apple? I thought passkeys are like ssh keys.
  - stavros 3y ago
    They are, except they have a vendor ID that allows you to tell which vendor made the device you're talking to. You can get Passkeys by any number of vendors, but any authenticating website can decide to only allow a few vendors to log in with it.
    - rootusrootus 3y ago
      > any authenticating website can decide to only allow a few vendors to log in with it. That's an excellent way of telling your customers you want them to go somewhere else. What's the upside?
      - stavros 3y ago
        I'm not sure, it sounds silly to me. I guess you can mandate "secure" brands?
    - lxgr 3y ago
      Synchronized passkeys by both Apple and Google don't use that mechanism (attestation). There's also the AAGUID, but without attestation, every implementation is free to provide Apple's or Google's, should websites ever start requiring that.
- stavros 3y ago
  I don't understand how what you say relates to what was said. You don't need to trust Google/Microsoft for your Passkeys, you can use a Yubikey, or whatever else you want. If Google wants to only accepts its own Passkeys to log in to your Google account, that's as much its choice as any other site has for its authentication.
  - danShumway 3y ago
    > that's as much its choice as any other site has for its authentication. A site having the technical ability to determine not just its authentication mechanism but how that authentication mechanism is stored is not its choice and should not be its choice and is not its business. And its a clear degradation in user freedom over passwords, a system where it's impossible for Google to dictate that you use only a specific password manager to store and sync that password. It shouldn't be possible for Google to know how I'm storing a passkey. It's not their right to decide anything about that. They've never had that right. We're not taking a freedom away from Google, we're saying that Google should not have the ability to take away a freedom that we've always had, because they're our devices and it's our login information; it doesn't belong to Google.
    - rootusrootus 3y ago
      I suppose the answer is to use Apple, then? It sounds like you have something against attestation, which is a reasonable point, and Apple doesn't support attestation in their implementation of passkeys. Given the size of their customer base, that pretty much guarantees that nobody is going to be denying passkeys based on lack of attestation.
      - danShumway 3y ago
        Yeah, I wrote this comment before I knew that Apple was dropping attestation. Them dropping attestation kind of renders the entire conversation moot, practically no one is going to require it if it means cutting off the entire Apple userbase. It's good news. It's honestly kind of the best possible situation short of attestation being outright removed from the spec. My bank doesn't understand "I should be able to use real 2FA instead of a text message", but they will understand "I should be able to log in from a Mac."
bheadmaster 3y ago
"It's just misinformation" is just fancy-speak for "it's bullshit". The former sounds pretentious and (wanna-be) authoritative. I personally prefer the latter form.

speed_spread 3y ago

The part where they are the sole implementors of the spec.

vladvasiliu 3y ago
What do you mean? I run Keycloak for my home lab authentication needs and can use my YubiKey as a Webauthn factor from Firefox running on my Linux PC. The only part where MS comes into the picture is the "Microsoft Windows" sticker on the bottom of the laptop, since HP shipped windows pre-installed.
- eulers_secret 3y ago
  Even forcing people to buy yubikeys is an antipattern. We shouldn’t be forced to spend money at any company. Where are the Free (beer and Libre) methods??
  - vladvasiliu 3y ago
    There was a kinda-free option (as in you had to have an iPhone, but the app itself was free). Krypt.co had this based on the iphone's secure enclave. It was bought by Akamai, and it's not clear what state it's in. https://krypt.co/ https://krypt.co/ I think there was also an implementation for mac os based on the t1/t2 chip, but since I've never had such a mac, I've never looked properly into that. But that probably means that you could roll your own. A quick google search yields this for Linux with a TPM: https://github.com/psanford/tpm-fido https://github.com/psanford/tpm-fido
  - cyphar 3y ago
    Nitrokey has a free software implementation of their firmware. But ultimately you need to get some hardware _somehow_ which costs money, though some conferences give out free Yubikeys (or equivalent) and most enterprises would provide them to users directly.

account-5 3y ago

Nothing unless they're on only ones to provide it, or their implementations are the only "trusted" or accepted versions third parties allow you to use.

jerjerjer 3y ago

It is a very large and complex standard that further centralizes authentication in the hands of several megacorps. The previous OpenID attempt was a resounding success, and this is a logical continuation. Google and co want to know where you log in to serve you "better" ads. The countermeasure remains the same - create an isolated account on each new website/service you use.

vladvasiliu 3y ago
But you can use FIDO without ever touching MS/Google. For example, Codeberg (code hosting based on some soft-fork of Gitea) supports this with local-accounts.
cyphar 3y ago
What you are describing is Single Sign On, not WebAuthn/FIDO. Every site that I've used that has WebAuthn self-hosts it (GitHub, Twitter, Google, Microsoft, etc).