3 ms·
Hmmm.... let passwords become unusable, and move to hardware crypto dongle? That sure sounds like a great way to remove any remaining anonymity on their service
by pdkl95 13y ago
Hmmm.... let passwords become unusable, and move to hardware crypto dongle? That sure sounds like a great way to remove any remaining anonymity on their services, once they tie shipping addresses to accounts.
// I like the idea of crypto dongles... when you control both sides
- im3w1l 13y ago>Note that the secure element never returns a previously generated public key in any new registration step. >This makes tracking users across websites difficult by using the token as a supercookie that bypasses other anonymizing precautions. So at least they make an effort to prevent that, and if they do not subvert this scheme you wont be trackable. But as the dongle is more or less a black box, it would probably be hard to ascertain that generated public keys do not have some property in common to allow them to be associated with each other.
- tonfa 13y agoAccept the key isn't tied to you account when you buy it and you don't have to buy from google... > Consumer provisioning should allow users to buy a compliant token from a vendor of their choice, insert it into a computer where they’re already authenticated to a website, and register their token with a single mouse click. http://www.computer.org/cms/Computer.org/ComputingNow/pdfs/AuthenticationAtScale.pdf http://www.computer.org/cms/Computer.org/ComputingNow/pdfs/A... Furthermore there are no serial number exchanged afaict, so the key itself isn't identified by the server, only the fact it has valid credentials.
- pdkl95 13y agoAhh, was not aware of that. I think this would solve a lot of my concern.