5 ms·
Have a question, is the TLSSessionState part of the signature nonce? I remember this being an anti-MITM measure for u2f
by exabrial 1y ago
Have a question, is the TLSSessionState part of the signature nonce?
I remember this being an anti-MITM measure for u2f
- whs 1y agoMy friend asked similar question yesterday, and while I don't know the answer I wish it don't Most large websites are hosted behind a CDN or a load balancer, which terminate the TLS session and is a MITM between the customer and the actual backend server. The problem is similar to TLS Client Certificate - you can't forward these to the backend now, and the load balancer is not smart enough to validate the data so it is impossible to use it. In recent years (~5 years), AWS ALB and competitors gained the client certificate support now which pass the certificate information to your application in HTTP headers - instead of a standardized way of reading client certificate the servers has to read from non-standard headers. If passkeys is also passed as HTTP payload, I don't see believe that the LB would read the payload anytime soon. It might become a selling feature for IDP-as-a-service like Auth0 that you can't do it with IaaS.
- exabrial 1y agoDamn, I didn't of that. Yeah, Cloudflare is [technically] a [friendly] MITM attack. Didn't think of that.