4 ms·

Good point. Looking at this from the user's perspective, my concern is to limit the ability of someone with access to my computer from using a connected hardwa

Good point. Looking at this from the user's perspective, my concern is to limit the ability of someone with access to my computer from using a connected hardware authenticator. Maybe that physical touch activation of the authenticator has a better term—proof of presence?

awesome_dude 2y ago
For my money - I'm incredibly sceptical of the technology. To me it looks like a false sense of security. There's a number of problems with the idea: - The device (eg. Phone or Tablet) gets owned and gives up its value as a provider of confirmation - Users end up nominating a password service like 1Password as the device - Someone manages to convince the authentication systems that their faux device emitting the signal, is the device in question For the second point, when I was integrating a (FOSS) passkey system into a product, it drove me up the wall having to have my phone right next to me every time I was working. I ciouldn't leave it in the next room on charge, for example. As a user I drew no comfort from the system, and viewed it as a burden, and was concerned about replacing the device in the event of a loss/theft or destruction - which is usually the pathway malicious individuals take to insert their device as the one to be used instead of the original.
- Joel_Mckay 2y ago
  Indeed, we used those RSA SecurID key fobs for VPN login in some places, and people would just "forget" them in the laptop bag. At a certain point, the user behavior IDS constraints become more important than building a deeper moat. 2FA cellphone based anything is $23 away from some adversaries control... ultimately more security theater in my opinion YMMV =3
- fc417fc802 2y ago
  > The device (eg. Phone or Tablet) gets owned and gives up its value as a provider of confirmation Any device could get exploited. The requirement that it happen to both that device and my computer, simultaneously, significantly raises the difficulty bar. > Users end up nominating a password service like 1Password as the device I don't see the issue. Isn't that the user's choice to make? If you want better security then don't make that particular choice. > Someone manages to convince the authentication systems that their faux device emitting the signal, is the device in question By that logic why have passwords or keys or anything at all? Someone might exploit the server and get in regardless so why bother? I've got at least a few objections to modern auth schemes but these aren't them.
  - awesome_dude 2y ago
    > Any device could get exploited. Yes. > The requirement that it happen to both that device and my computer, simultaneously, significantly raises the difficulty bar. Well, only one of the two devices needs to be exploited. There's twice the attack surface for you. > I don't see the issue. Isn't that the user's choice to make? If you want better security then don't make that particular choice. Sure, and allowing people to use "password" as their password is bad, but the design of this system encourages using a "cloud" device, because of the issues already pointed out. > By that logic why have passwords or keys or anything at all? Someone might exploit the server and get in regardless so why bother? The system has added nothing that makes passwords or keys more secure. > I've got at least a few objections to modern auth schemes but these aren't them. /me shrugs I'm almost at the point of caring.
    - fc417fc802 2y ago
      > only one of the two devices needs to be exploited I think we must be thinking of very different things here. Maybe I misunderstand the scheme you're objecting to. Would you mind elaborating?
      - awesome_dude 2y ago
        Why do you think that both devices need to be exploited for a problem in the scheme to occur?
        fc417fc802 2y ago
        > the scheme As I already stated I'm no longer certain what scheme we're actually taking about. Is there some reason you don't feel like elaborating? For my part I thought we were taking about a proof of possession scheme in addition to regular auth. The "regular auth" scheme was unspecified so could be password, software based TOTP, hardware token, whatever. Widespread proof of possession already exists in the form of chips in bank cards. It seems to be quite resilient to attack in practice. Even if I use software on my phone for proof of possession you still have to compromise the computer I'm actually logging in with, no? So the attack surface is either the same (primary device) or increased (primary plus secondary, simultaneously) depending on various practical details regarding implementation and usage. If the "regular auth" scheme involves a half decent hardware token then good luck compromising that remotely. I won't be betting in your favor.
fc417fc802 2y ago
> my concern is to limit the ability of someone with access to my computer from using a connected hardware authenticator. You don't need anything special to do that. Just select a hardware token that refuses to sign anything until it receives physical input from you.

awesome_dude 2y ago

For my money - I'm incredibly sceptical of the technology. To me it looks like a false sense of security. There's a number of problems with the idea: - The device (eg. Phone or Tablet) gets owned and gives up its value as a provider of confirmation - Users end up nominating a password service like 1Password as the device - Someone manages to convince the authentication systems that their faux device emitting the signal, is the device in question For the second point, when I was integrating a (FOSS) passkey system into a product, it drove me up the wall having to have my phone right next to me every time I was working. I ciouldn't leave it in the next room on charge, for example. As a user I drew no comfort from the system, and viewed it as a burden, and was concerned about replacing the device in the event of a loss/theft or destruction - which is usually the pathway malicious individuals take to insert their device as the one to be used instead of the original.

Joel_Mckay 2y ago
Indeed, we used those RSA SecurID key fobs for VPN login in some places, and people would just "forget" them in the laptop bag. At a certain point, the user behavior IDS constraints become more important than building a deeper moat. 2FA cellphone based anything is $23 away from some adversaries control... ultimately more security theater in my opinion YMMV =3
fc417fc802 2y ago
> The device (eg. Phone or Tablet) gets owned and gives up its value as a provider of confirmation Any device could get exploited. The requirement that it happen to both that device and my computer, simultaneously, significantly raises the difficulty bar. > Users end up nominating a password service like 1Password as the device I don't see the issue. Isn't that the user's choice to make? If you want better security then don't make that particular choice. > Someone manages to convince the authentication systems that their faux device emitting the signal, is the device in question By that logic why have passwords or keys or anything at all? Someone might exploit the server and get in regardless so why bother? I've got at least a few objections to modern auth schemes but these aren't them.
- awesome_dude 2y ago
  > Any device could get exploited. Yes. > The requirement that it happen to both that device and my computer, simultaneously, significantly raises the difficulty bar. Well, only one of the two devices needs to be exploited. There's twice the attack surface for you. > I don't see the issue. Isn't that the user's choice to make? If you want better security then don't make that particular choice. Sure, and allowing people to use "password" as their password is bad, but the design of this system encourages using a "cloud" device, because of the issues already pointed out. > By that logic why have passwords or keys or anything at all? Someone might exploit the server and get in regardless so why bother? The system has added nothing that makes passwords or keys more secure. > I've got at least a few objections to modern auth schemes but these aren't them. /me shrugs I'm almost at the point of caring.
  - fc417fc802 2y ago
    > only one of the two devices needs to be exploited I think we must be thinking of very different things here. Maybe I misunderstand the scheme you're objecting to. Would you mind elaborating?
    - awesome_dude 2y ago
      Why do you think that both devices need to be exploited for a problem in the scheme to occur?
      - fc417fc802 2y ago
        > the scheme As I already stated I'm no longer certain what scheme we're actually taking about. Is there some reason you don't feel like elaborating? For my part I thought we were taking about a proof of possession scheme in addition to regular auth. The "regular auth" scheme was unspecified so could be password, software based TOTP, hardware token, whatever. Widespread proof of possession already exists in the form of chips in bank cards. It seems to be quite resilient to attack in practice. Even if I use software on my phone for proof of possession you still have to compromise the computer I'm actually logging in with, no? So the attack surface is either the same (primary device) or increased (primary plus secondary, simultaneously) depending on various practical details regarding implementation and usage. If the "regular auth" scheme involves a half decent hardware token then good luck compromising that remotely. I won't be betting in your favor.

fc417fc802 2y ago

> my concern is to limit the ability of someone with access to my computer from using a connected hardware authenticator. You don't need anything special to do that. Just select a hardware token that refuses to sign anything until it receives physical input from you.