4 ms·
there is attestation of the registration device in webauthn so you can tell that a token was signed by an official yubikey, apple secure enclave, tpm, etc for
by blibble 2y ago
there is attestation of the registration device in webauthn
so you can tell that a token was signed by an official yubikey, apple secure enclave, tpm, etc
for yubikeys the attestation signing certificate is shared between devices, but this number is limited
so you could rate limit... just it would be a horrible experience when you are limited
- doctorpangloss 2y agoI don’t see that in the code. But you’re right that there is something heuristic you can do.
- yonixw 2y agoHere is a relevant discussion about it in S/O: https://stackoverflow.com/questions/67797804/how-to-distinguish-fido2-devices https://stackoverflow.com/questions/67797804/how-to-distingu...
- blibble 2y agothe cynic in me thinks this will become mandatory on major websites at some future point so you won't be able to log into youtube unless you have a TPM approved by Google
- solardev 2y agoWhat about for software implementations like 1Password and Bitwarden?
- voxic11 2y agoThey can't fake the attestation from hardware implementations so you could just reject keys from software implementations.
- ale42 2y agoSo what about users that don't have any such hardware?
- wkat4242 2y agoYeah but that breaks real usecases from real users. It's really annoying, PayPal does this too. They only support passkeys in safari or chrome, even though it works just fine with a yubikey in Firefox. They just go out of their way to stop it from working. Really really annoying. And they also refuse to enroll more than one token even for the basic fido2 mfa.
- ranger_danger 2y agoWouldn't companies/bots/etc. still just get around this by buying many such hardware devices and automating their usage instead?
- deleted 2y ago[deleted]