3 ms·

This reinforces the need for "mutual trust security" that I've been calling for now for years. All of the significant authentication schemes are built to valid

This reinforces the need for "mutual trust security" that I've been calling for now for years. All of the significant authentication schemes are built to validate the customer, and none validate the vendor. When your bank or mobile provider gives you a call : how do you know it's them? They start asking you for personal data right away, but you have no idea who you are sharing information with. We need "mutual authentication" including better identity, trust, challenge-response and more. Customers should be able to validate who they are talking to before even sharing their own credentials.

Bjartr 3y ago
That exists, but isn't super widespread. Some places will have you choose something (image, phrase, etc.) that they will display to you when logging in. If you don't recognize the thing shown when you go to login, don't trust it.
- tonymet 3y ago
  You're right but it's for web and hardly used. Phone, text and email are much bigger threats. email has some incomplete protections including DKIM and others. Phone and text only have caller-id which is easily spoofed and vendors don't even manage their contact points . we need a platform that consumers can easily understand and use.
zokier 3y ago
EV certs were intended for that. They should always contain info of the company who they were issued to. They were mostly a trainwreck, and now almost completely abandoned.
ianburrell 3y ago
For voice calls, and maybe SMS, there could be mechanism to do bidirectional authentication with words. The problem is that would have to switch to app to generate the words and validate the response. For user, password or passkey would work. For company, the SSL cert on domain might work. Otherwise, would need to download certificates. For SMS and voice calls, it would help if they could implement call authentication so can trust the number. Phones should show the user if the number is validated. It would also be good to add trusted CallerID names; Google does with some numbers.
- tonymet 3y ago
  Great ideas Both could be implemented without apps by using a text message interface
droopyEyelids 3y ago
This is included webauthn, which is the basis for both passkeys and fido2 auth. To sign in, you are sent a 'challenge', and must sign it and return it. The challenge includes a "Relaying Party Identifier" (RPID) which is basically the domain of the site requesting authentication. That way, if a phishing domain prompts you for auth, they can not proxy your response because the RPID you signed will not match the authentic domain, and therefore be invalid.
- tonymet 3y ago
  This is good but how to make it work for phone, email and txt messages ?
  - droopyEyelids 3y ago
    The way I see it, it works for all the above. Passkeys are available on all devices, and whatever contact method the attackers use will harvest a signed response with an invalid RPID (a credential that won't work). Is that the point you were making?
    - tonymet 3y ago
      Yeah I’m thinking of how to integrate authn into messaging and phone apps. One idea is to add the phone to the web certificate so a remote check can be made during the call

Bjartr 3y ago

That exists, but isn't super widespread. Some places will have you choose something (image, phrase, etc.) that they will display to you when logging in. If you don't recognize the thing shown when you go to login, don't trust it.

tonymet 3y ago
You're right but it's for web and hardly used. Phone, text and email are much bigger threats. email has some incomplete protections including DKIM and others. Phone and text only have caller-id which is easily spoofed and vendors don't even manage their contact points . we need a platform that consumers can easily understand and use.

zokier 3y ago

EV certs were intended for that. They should always contain info of the company who they were issued to. They were mostly a trainwreck, and now almost completely abandoned.

ianburrell 3y ago

For voice calls, and maybe SMS, there could be mechanism to do bidirectional authentication with words. The problem is that would have to switch to app to generate the words and validate the response. For user, password or passkey would work. For company, the SSL cert on domain might work. Otherwise, would need to download certificates. For SMS and voice calls, it would help if they could implement call authentication so can trust the number. Phones should show the user if the number is validated. It would also be good to add trusted CallerID names; Google does with some numbers.

tonymet 3y ago
Great ideas Both could be implemented without apps by using a text message interface

droopyEyelids 3y ago

This is included webauthn, which is the basis for both passkeys and fido2 auth. To sign in, you are sent a 'challenge', and must sign it and return it. The challenge includes a "Relaying Party Identifier" (RPID) which is basically the domain of the site requesting authentication. That way, if a phishing domain prompts you for auth, they can not proxy your response because the RPID you signed will not match the authentic domain, and therefore be invalid.

tonymet 3y ago
This is good but how to make it work for phone, email and txt messages ?
- droopyEyelids 3y ago
  The way I see it, it works for all the above. Passkeys are available on all devices, and whatever contact method the attackers use will harvest a signed response with an invalid RPID (a credential that won't work). Is that the point you were making?
  - tonymet 3y ago
    Yeah I’m thinking of how to integrate authn into messaging and phone apps. One idea is to add the phone to the web certificate so a remote check can be made during the call