4 ms·

> Any device could get exploited. Yes. > The requirement that it happen to both that device and my computer, simultaneously, significantly raises the difficul

> Any device could get exploited. Yes. > The requirement that it happen to both that device and my computer, simultaneously, significantly raises the difficulty bar. Well, only one of the two devices needs to be exploited. There's twice the attack surface for you. > I don't see the issue. Isn't that the user's choice to make? If you want better security then don't make that particular choice. Sure, and allowing people to use "password" as their password is bad, but the design of this system encourages using a "cloud" device, because of the issues already pointed out. > By that logic why have passwords or keys or anything at all? Someone might exploit the server and get in regardless so why bother? The system has added nothing that makes passwords or keys more secure. > I've got at least a few objections to modern auth schemes but these aren't them. /me shrugs I'm almost at the point of caring.

fc417fc802 2y ago
> only one of the two devices needs to be exploited I think we must be thinking of very different things here. Maybe I misunderstand the scheme you're objecting to. Would you mind elaborating?
- awesome_dude 2y ago
  Why do you think that both devices need to be exploited for a problem in the scheme to occur?
  - fc417fc802 2y ago
    > the scheme As I already stated I'm no longer certain what scheme we're actually taking about. Is there some reason you don't feel like elaborating? For my part I thought we were taking about a proof of possession scheme in addition to regular auth. The "regular auth" scheme was unspecified so could be password, software based TOTP, hardware token, whatever. Widespread proof of possession already exists in the form of chips in bank cards. It seems to be quite resilient to attack in practice. Even if I use software on my phone for proof of possession you still have to compromise the computer I'm actually logging in with, no? So the attack surface is either the same (primary device) or increased (primary plus secondary, simultaneously) depending on various practical details regarding implementation and usage. If the "regular auth" scheme involves a half decent hardware token then good luck compromising that remotely. I won't be betting in your favor.
  - awesome_dude 2y ago
    For some reason the comment responding to this cannot be replied to (probably a good thing given the lack of understanding that author has demonstrated thus far)
    - fc417fc802 2y ago
      What's the point of participating on a site like HN if instead of technical discussion you opt to dodge questions and make condescending but vague statements? How could I possibly demonstrate lack of understanding when you actively avoid clarifying what you're even talking about in the first place? Perhaps what you had in mind are the PoP tokens from RFC 7800? (Sure would be nice not to play guessing games though.) Given that those are intended to replace OAuth bearer tokens they are quite a decent upgrade from a security perspective. Used with a purely software based password manager it is no longer enough to simply exfiltrate a token from the browser. Used with TPM backed keys it is approximately equivalent to the chip in a bank card.
      - awesome_dude 2y ago
        > What's the point of participating on a site like HN Because I get to talk to people that actually understand technical discussions. > How could I possibly demonstrate lack of understanding when you actively avoid clarifying what you're even talking about in the first place? You came into the thread with no understanding, then some time later decided to play word games. All of the rest of your contributions from now are going straight to /dev/null where they belong.

fc417fc802 2y ago

> only one of the two devices needs to be exploited I think we must be thinking of very different things here. Maybe I misunderstand the scheme you're objecting to. Would you mind elaborating?

awesome_dude 2y ago
Why do you think that both devices need to be exploited for a problem in the scheme to occur?
- fc417fc802 2y ago
  > the scheme As I already stated I'm no longer certain what scheme we're actually taking about. Is there some reason you don't feel like elaborating? For my part I thought we were taking about a proof of possession scheme in addition to regular auth. The "regular auth" scheme was unspecified so could be password, software based TOTP, hardware token, whatever. Widespread proof of possession already exists in the form of chips in bank cards. It seems to be quite resilient to attack in practice. Even if I use software on my phone for proof of possession you still have to compromise the computer I'm actually logging in with, no? So the attack surface is either the same (primary device) or increased (primary plus secondary, simultaneously) depending on various practical details regarding implementation and usage. If the "regular auth" scheme involves a half decent hardware token then good luck compromising that remotely. I won't be betting in your favor.
- awesome_dude 2y ago
  For some reason the comment responding to this cannot be replied to (probably a good thing given the lack of understanding that author has demonstrated thus far)
  - fc417fc802 2y ago
    What's the point of participating on a site like HN if instead of technical discussion you opt to dodge questions and make condescending but vague statements? How could I possibly demonstrate lack of understanding when you actively avoid clarifying what you're even talking about in the first place? Perhaps what you had in mind are the PoP tokens from RFC 7800? (Sure would be nice not to play guessing games though.) Given that those are intended to replace OAuth bearer tokens they are quite a decent upgrade from a security perspective. Used with a purely software based password manager it is no longer enough to simply exfiltrate a token from the browser. Used with TPM backed keys it is approximately equivalent to the chip in a bank card.
    - awesome_dude 2y ago
      > What's the point of participating on a site like HN Because I get to talk to people that actually understand technical discussions. > How could I possibly demonstrate lack of understanding when you actively avoid clarifying what you're even talking about in the first place? You came into the thread with no understanding, then some time later decided to play word games. All of the rest of your contributions from now are going straight to /dev/null where they belong.