6 ms·

if this is confirmed I'm really interested into how exactly Apple will somehow deflect this and make it vanish like they somehow always manage to do with the my

if this is confirmed I'm really interested into how exactly Apple will somehow deflect this and make it vanish like they somehow always manage to do with the myriad of issues they're facing over and over

dalke 3y ago
It definitely supports my belief that centralizing identity, payment, and apps into a single device is a fundamentally flawed security model.
- aargh_aargh 3y ago
  Can you elaborate what you mean? I may be misunderstanding what you intended but how do you use traditional means of payment (credit card) without an identity? How do you check your email without identity?
  - madsbuch 3y ago
    Single point of failure? If a single code gives access to everything, loosing that code to a malicious actors is really bad.
  - AnthonyMouse 3y ago
    The premise is that you keep a separate device with the sensitive stuff on it (e.g. the chip in your physical credit card, a physical ID badge), and then you can't click on a link in your email or go to the wrong web page and compromise that data because the device you use for email or browsing never has it to begin with.
  - dalke 3y ago
    What I said was that centralization is the problem. Different tasks require different levels of identification. Cash (a traditional means of payment) requires no identification. I only carry up to about $200 in cash on me, which an amount I'm willing to bear if my wallet is stolen. When I use chip&pin ("what you have and what you know") for small payments, I rarely need any authentication, and when I do it's the PIN. My wife can and has used my card, with my permission. I have my email password written down for her so she can access it, eg, if I die and my computer dies. The banking system probably factors in my usual payment locations to make the choice of when to ask for a PIN, combined with the trust experience with the vendor. My card, even with a PIN, has a spending limit. Years ago I had to authorize raising the limit because my client was willing to reimburse me for a business class flight across the Atlantic. Of COURSE I want more friction in the system when doing something riskier. If the way to authorize a $60 dinner and a $60,000 car are too similar, then it's easier to fool you. For a higher amount, I can go to the bank and carry out a transaction in person, or I can authorize it through their online banking system. "But wait, how?" you might ask. The bank figured this out years ago, when people started going online, using unpatched Windows PCs without virus scanners. The system - whose security I trust much more than a phone's - uses a small device with a camera. The login screen shows me a pattern with colored dots. The camera reads those dots, decodes the message (and probably also validates it cryptographically) and displays a message asking me to verify I want to log in. I enter the PIN, and it generates a response code, which I enter. If I make a payment, or add a new recipient, or a few other things, I am required to use the device again. This device stays at home, because I don't expect to make $10,000 payments while out. I can use it on any web-enabled device, because the security is in "what I have" and "what I know", in a device which cannot be hacked, does not require any physical connection, and does not require network accessed. I like this system more than a Yubikey because it does not require a hardware attachment, which isn't always possible. Yes, Yubikeys feel like a step backwards compare to my bank's security practice. I don't understand why there is no provision for cable-free/wifi-free/mobile-system-free validation in this supposed privacy-oriented switch to passkeys, when I know such a system exists. Furthermore, the bank has the legal obligation to ensure the system works. If the encryption system is somehow broken, they are required to update the hardware. Apple is not. Yubi is not. The cost is all on you. My bank has even shut down mobile phone banking for older hardware/OSes, claiming the security isn't high enough. But they have not needed to update my security device. If you expect your phone to be able to do anything, and authorize anything, then I see it as a giant risk. You can be at the bar, drank to much, and be convinced to make a payment or authorization that you shouldn't of. There's no real, physical way to change your risk level depending on the circumstances if you always have your phone with you. Centralization of identify, payment, and apps is fundamentally flawed.
    - threeseed 3y ago
      The majority of ecommerce purchases made today are done on mobile. And majority of these would be secured via on device biometrics. The fact that this is all happening with approval of credit card companies, banks, regulators etc means that the idea that centralisation is fundamentally flawed is simply wrong.
      - dalke 3y ago
        My bank's terms of services say they are not responsible for flaws in the mobile phone or privacy issues in the store. If there is a vulnerability, who pays for fixing it? Who pays for the new phones? Of course the credit card companies and banks don't want to be responsible. They currently aren't, and they don't want to take it on. Why should the regulators care yet? Using a mobile phone is still under the fiction that it's an optional functionality, where the user has agreed to take on the risk themselves, in exchange for better convenience and non-essential services.
    - acdha 3y ago
      > The system - whose security I trust much more than a phone's - uses a small device with a camera. The login screen shows me a pattern with colored dots. The camera reads those dots, decodes the message (and probably also validates it cryptographically) and displays a message asking me to verify I want to log in. > I enter the PIN, and it generates a response code, which I enter. How do they protect against phishing? That sounds like the weak MFA where attacks spoof the login page but make their own connection to your bank and pass through the challenge and response, which means that a user who doesn’t fastidiously check the hostname can be convinced to enter a TOTP, SMS, etc. code. Phone-based WebAuthn systems are immune to that because they incorporate the hostname into the signing process so even if they convince you that they’re hugeb<cyrillic a>nk.com there’s no way for you to override that and give it a response which works for hugebank.com.
      - dalke 3y ago
        > How do they protect against phishing? The same way they minimize the vulnerability when running on an exploited Windows machine? Even if I log in, via a MITM attack, all they can do is read my account history. Actually making changes requires further authorization. When I make a payment the screen asks me to confirm the amount I'm about to pay. The same applies to other security sensitive changes. Still, you make a very valid point, and I thank you for pointing out the flaw in my understanding. I still have a very deep distrust about centralizing identification, payment, and apps on a single device, and strongly dislike the inability to have physically very distinct trust levels.
- EtienneK 3y ago
  As opposed to what else? Please elaborate.
  - madsbuch 3y ago
    Using multiple devices: Credit cards for payment, instead og apple pay. A camera for taking pictures, instead of a camera app, a notebook to write notes, instead of an app. From my perspective the original comment is not rocket science?
    - electric_mayhem 3y ago
      I learned from another commenter on HN when a post asks low-effort questions where the answer is common sense or implicitly understood, it’s most likely a bot or troll or shill. Best not to engage with them.
      - madsbuch 3y ago
        that makes sense. within the past couple of months the value of comments, especially before community cueation, has gone very much down. Maybe hackernews is mostly LLMs speaking at this point. what a shame.
    - threeseed 3y ago
      What an awful and counterproductive experience. If you require someone to enter their credit card number every time they make a purchase they end up doing dumb, insecure things like storing it as a text file on their desktop. And having external hardware just means more cables, batteries, updates to keep it secure etc. Initiatives like PassKey, ApplePay, TouchID etc. have been a huge win for security and privacy.
      - madsbuch 3y ago
        Hey, this is completely up to you. nobody is trying to steal your apple pay. this is merely the parent commenter's belief that they would should use different apps to reduce the risk vector when secrets are stolen. no reason to completely ballistic.
Kluggy 3y ago
It’s a total non issue for the majority of folks. It requires local access and takes hours under very specific conditions that don’t apply to most people. How often do you run a server that will run arbitrary crypto operations on attacker controlled inputs? Plus all the secrets in the Secure Enclave are immune to this attack, so your FileVault keys and your Apple Pay cards and all that jazz are completely safe. It sucks that it exists, and crypto libraries that run on the platform outside of the Secure Enclave will get slightly slower, but no one will notice.
- switch007 3y ago
  > It’s a total non issue for the majority of folks People said the _exact_ same thing about Spectre/Meltdown. Then the JS PoCs came out
  - Aaargh20318 3y ago
    Isn't the lesson here that scripting in the browser needs to die. Letting untrusted code run on your computer is always a bad idea, no matter how much you try to sandbox it.
    - deleted 3y ago
      [deleted]
    - threeseed 3y ago
      I would also love to see the API surface of the browser come way down. If people knew just how widespread and effective browser fingerprinting is they would be shocked. It's Cambridge Analytica on steroids.
  - Dalewyn 3y ago
    The SpectreMeltdown mitigations have caused me more grief than the problem themselves to this day. These vulnerabilities definitely exist, that much is a matter of fact. But whether it's something someone should consider in their threat model is a different matter.
  - 3y ago
Angostura 3y ago
I imagine something like a software framework that can be called if properly secure crypto is needed at the expense of performance
- junon 3y ago
  Like a TPM?

dalke 3y ago

It definitely supports my belief that centralizing identity, payment, and apps into a single device is a fundamentally flawed security model.

aargh_aargh 3y ago
Can you elaborate what you mean? I may be misunderstanding what you intended but how do you use traditional means of payment (credit card) without an identity? How do you check your email without identity?
- madsbuch 3y ago
  Single point of failure? If a single code gives access to everything, loosing that code to a malicious actors is really bad.
- AnthonyMouse 3y ago
  The premise is that you keep a separate device with the sensitive stuff on it (e.g. the chip in your physical credit card, a physical ID badge), and then you can't click on a link in your email or go to the wrong web page and compromise that data because the device you use for email or browsing never has it to begin with.
- dalke 3y ago
  What I said was that centralization is the problem. Different tasks require different levels of identification. Cash (a traditional means of payment) requires no identification. I only carry up to about $200 in cash on me, which an amount I'm willing to bear if my wallet is stolen. When I use chip&pin ("what you have and what you know") for small payments, I rarely need any authentication, and when I do it's the PIN. My wife can and has used my card, with my permission. I have my email password written down for her so she can access it, eg, if I die and my computer dies. The banking system probably factors in my usual payment locations to make the choice of when to ask for a PIN, combined with the trust experience with the vendor. My card, even with a PIN, has a spending limit. Years ago I had to authorize raising the limit because my client was willing to reimburse me for a business class flight across the Atlantic. Of COURSE I want more friction in the system when doing something riskier. If the way to authorize a $60 dinner and a $60,000 car are too similar, then it's easier to fool you. For a higher amount, I can go to the bank and carry out a transaction in person, or I can authorize it through their online banking system. "But wait, how?" you might ask. The bank figured this out years ago, when people started going online, using unpatched Windows PCs without virus scanners. The system - whose security I trust much more than a phone's - uses a small device with a camera. The login screen shows me a pattern with colored dots. The camera reads those dots, decodes the message (and probably also validates it cryptographically) and displays a message asking me to verify I want to log in. I enter the PIN, and it generates a response code, which I enter. If I make a payment, or add a new recipient, or a few other things, I am required to use the device again. This device stays at home, because I don't expect to make $10,000 payments while out. I can use it on any web-enabled device, because the security is in "what I have" and "what I know", in a device which cannot be hacked, does not require any physical connection, and does not require network accessed. I like this system more than a Yubikey because it does not require a hardware attachment, which isn't always possible. Yes, Yubikeys feel like a step backwards compare to my bank's security practice. I don't understand why there is no provision for cable-free/wifi-free/mobile-system-free validation in this supposed privacy-oriented switch to passkeys, when I know such a system exists. Furthermore, the bank has the legal obligation to ensure the system works. If the encryption system is somehow broken, they are required to update the hardware. Apple is not. Yubi is not. The cost is all on you. My bank has even shut down mobile phone banking for older hardware/OSes, claiming the security isn't high enough. But they have not needed to update my security device. If you expect your phone to be able to do anything, and authorize anything, then I see it as a giant risk. You can be at the bar, drank to much, and be convinced to make a payment or authorization that you shouldn't of. There's no real, physical way to change your risk level depending on the circumstances if you always have your phone with you. Centralization of identify, payment, and apps is fundamentally flawed.
  - threeseed 3y ago
    The majority of ecommerce purchases made today are done on mobile. And majority of these would be secured via on device biometrics. The fact that this is all happening with approval of credit card companies, banks, regulators etc means that the idea that centralisation is fundamentally flawed is simply wrong.
    - dalke 3y ago
      My bank's terms of services say they are not responsible for flaws in the mobile phone or privacy issues in the store. If there is a vulnerability, who pays for fixing it? Who pays for the new phones? Of course the credit card companies and banks don't want to be responsible. They currently aren't, and they don't want to take it on. Why should the regulators care yet? Using a mobile phone is still under the fiction that it's an optional functionality, where the user has agreed to take on the risk themselves, in exchange for better convenience and non-essential services.
  - acdha 3y ago
    > The system - whose security I trust much more than a phone's - uses a small device with a camera. The login screen shows me a pattern with colored dots. The camera reads those dots, decodes the message (and probably also validates it cryptographically) and displays a message asking me to verify I want to log in. > I enter the PIN, and it generates a response code, which I enter. How do they protect against phishing? That sounds like the weak MFA where attacks spoof the login page but make their own connection to your bank and pass through the challenge and response, which means that a user who doesn’t fastidiously check the hostname can be convinced to enter a TOTP, SMS, etc. code. Phone-based WebAuthn systems are immune to that because they incorporate the hostname into the signing process so even if they convince you that they’re hugeb<cyrillic a>nk.com there’s no way for you to override that and give it a response which works for hugebank.com.
    - dalke 3y ago
      > How do they protect against phishing? The same way they minimize the vulnerability when running on an exploited Windows machine? Even if I log in, via a MITM attack, all they can do is read my account history. Actually making changes requires further authorization. When I make a payment the screen asks me to confirm the amount I'm about to pay. The same applies to other security sensitive changes. Still, you make a very valid point, and I thank you for pointing out the flaw in my understanding. I still have a very deep distrust about centralizing identification, payment, and apps on a single device, and strongly dislike the inability to have physically very distinct trust levels.
EtienneK 3y ago
As opposed to what else? Please elaborate.
- madsbuch 3y ago
  Using multiple devices: Credit cards for payment, instead og apple pay. A camera for taking pictures, instead of a camera app, a notebook to write notes, instead of an app. From my perspective the original comment is not rocket science?
  - electric_mayhem 3y ago
    I learned from another commenter on HN when a post asks low-effort questions where the answer is common sense or implicitly understood, it’s most likely a bot or troll or shill. Best not to engage with them.
    - madsbuch 3y ago
      that makes sense. within the past couple of months the value of comments, especially before community cueation, has gone very much down. Maybe hackernews is mostly LLMs speaking at this point. what a shame.
  - threeseed 3y ago
    What an awful and counterproductive experience. If you require someone to enter their credit card number every time they make a purchase they end up doing dumb, insecure things like storing it as a text file on their desktop. And having external hardware just means more cables, batteries, updates to keep it secure etc. Initiatives like PassKey, ApplePay, TouchID etc. have been a huge win for security and privacy.
    - madsbuch 3y ago
      Hey, this is completely up to you. nobody is trying to steal your apple pay. this is merely the parent commenter's belief that they would should use different apps to reduce the risk vector when secrets are stolen. no reason to completely ballistic.

Kluggy 3y ago

It’s a total non issue for the majority of folks. It requires local access and takes hours under very specific conditions that don’t apply to most people. How often do you run a server that will run arbitrary crypto operations on attacker controlled inputs? Plus all the secrets in the Secure Enclave are immune to this attack, so your FileVault keys and your Apple Pay cards and all that jazz are completely safe. It sucks that it exists, and crypto libraries that run on the platform outside of the Secure Enclave will get slightly slower, but no one will notice.

switch007 3y ago
> It’s a total non issue for the majority of folks People said the _exact_ same thing about Spectre/Meltdown. Then the JS PoCs came out
- Aaargh20318 3y ago
  Isn't the lesson here that scripting in the browser needs to die. Letting untrusted code run on your computer is always a bad idea, no matter how much you try to sandbox it.
  - deleted 3y ago
    [deleted]
  - threeseed 3y ago
    I would also love to see the API surface of the browser come way down. If people knew just how widespread and effective browser fingerprinting is they would be shocked. It's Cambridge Analytica on steroids.
- Dalewyn 3y ago
  The SpectreMeltdown mitigations have caused me more grief than the problem themselves to this day. These vulnerabilities definitely exist, that much is a matter of fact. But whether it's something someone should consider in their threat model is a different matter.
- 3y ago

Angostura 3y ago

I imagine something like a software framework that can be called if properly secure crypto is needed at the expense of performance

junon 3y ago
Like a TPM?