Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea • Hacker News Board

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#91

Post by danShumway » Fri, May 14, 2021, 2:08 PM UTC

md_ wrote: post #81

danShumway wrote: post #65

Complete aside, but I'm still not certain I understand the technical details of why Cloudflare can't uniquely identify users. I thought I knew how hardware keys worked, but apparently I don't. If the key being shared is embedded in the device, even in a secure enclave or something, then my understanding was that would open the door for key extraction. If the key is unique per-device, then that's not a problem. But if…

https://fidoalliance.org/fido-technotes-the-truth-about-atte... explains this pretty well. Basically: * Attestation keys are not unique per authenticator; they're shared among batches of authenticators. * If you extract the batch's attestation key, you can imitate authenticators from that batch. That doesn't mean you can authenticate as a registered authenticator, of course; it just means you can pretend to be a "Yub…

Thanks, that's really helpful. Followup questions though:

- Does this mean if I buy 2 of these devices at the same time, it's possible for me to get the same attestation keys on both devices? I guess depends on how many batches at a time a company is producing.

- Doesn't this mean that attestation keys will get more unique over time as devices from the pool fall out of circulation and become rarer? Are keys rotated to prevent that (ie, would a manufacturer ever re-release a new pool with the same keys as an old one)?

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#92

Post by infogulch » Fri, May 14, 2021, 2:10 PM UTC

Ayesh wrote: post #85

ComodoHacker wrote: post #80

Is CAPTCHA a necessity only in ad-sponsored web? Is there other compelling use-case for it? Can we make CAPTCHA obsolete with decent micropayments solution, when you pay for every transaction with every website, just like we pay for every drop of water we use? Perhaps ISPs could handle it for us?

How do you know who to pay to? Sure, you are paying for the every drop of water, but what if you really wanted to pay for water from a specific region, doesn't want water from another region, and trust that the water company does not keep a cut or rip off either of you?

Https with the origin?

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#93

Post by wfleming » Fri, May 14, 2021, 2:17 PM UTC

ignoramous wrote: post #78

The article here ignores the view of the Web that Cloudflare has, which coupled with "something you have" (the U2F keys) makes for a compelling alternative to CAPTCHAs. Sure, bots can automate keys, but those keys could also be banned just as well. Cloudflare only needs to know which ones are the good keys and track those forever. This means, for every non-bot out there, the CAPTCHAs are as good as gone. The genius o…

Each key is associated with a batch of devices, though. If you ban a key, you risk banning a bunch of legitimate users.

It's an interesting trade-off. It seems like batch keys for device attestation was designed to help protect individual privacy (good), but if you can't ban a key without potentially a lot of splash damage when you detect a bad actor, that seems like a very limiting choice.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#94

Post by ex_amazon_sde » Fri, May 14, 2021, 2:18 PM UTC

thejosh wrote: post #12

Cloudflare is both a great thing and a terrible thing that has happened to the internet in recent years. Great in that they have a fantastic UI to add your site in, basically shielding the average user from attacks. Bad from a standpoint of that now only Google, Bing, and maybe other big search engines have the capabilities to actually crawl the internet now. I don't see us getting a massive innovation in search on t…

...also Cloudflare has been a disaster for Tor. It really harms Tor's usability.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#95

Post by md_ » Fri, May 14, 2021, 2:19 PM UTC

danShumway wrote: post #91

md_ wrote: post #81

Earlier quoted context omitted.

https://fidoalliance.org/fido-technotes-the-truth-about-atte... explains this pretty well. Basically: * Attestation keys are not unique per authenticator; they're shared among batches of authenticators. * If you extract the batch's attestation key, you can imitate authenticators from that batch. That doesn't mean you can authenticate as a registered authenticator, of course; it just means you can pretend to be a "Yub…

Thanks, that's really helpful. Followup questions though: - Does this mean if I buy 2 of these devices at the same time, it's possible for me to get the same attestation keys on both devices? I guess depends on how many batches at a time a company is producing. - Doesn't this mean that attestation keys will get more unique over time as devices from the pool fall out of circulation and become rarer? Are keys rotated t…

- Yes.

- To my (limited) knowledge, yes, you are right that keys will get more unique over time. That's a very good point. Keys are not rotated nor (generally) are they rotatable; they are usually read-only. If you are using a very old FIDO device and worried it has too much entropy now--like, if it's a "rare" or "vintage" device!--then you should buy a new one, I guess?

(I honestly have not thought about your second point before, but I am not really deep in the FIDO stuff. So take my answer with a grain of salt.)

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#96

Post by tialaramex » Fri, May 14, 2021, 2:19 PM UTC

arsome wrote: post #16

Nextgrid wrote: post #6

Earlier quoted context omitted.

How can you revoke on a per-key basis without at the same time being able to track keys uniquely?

I'm not terribly familiar with U2F itself, but I assume the site has a way to identify you're using the right key that can be reused for this purpose?

When you enroll a token with a site, the token mints a random new key pair and sends the site an ID and the public key, signed with the private key.

The site records the ID and public key.

When you return, to confirm it's really you, the site sends one or more IDs you've enrolled and says, sign this fresh random data with one of the associated private keys.

Your tokens can look at the site and an ID and decide if they made that ID for that site, if they did they sign the message with the private key, proving you are still you. If they didn't make it, they pass and maybe you own a different token that can sign, or maybe you show them a different ID they do recognise.

To reuse this capability for tracking, the site would need to guess who you are first. "I guess this is arsome, they have this U2F key". But if they can guess who you are, they already don't need such tracking.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#97

Post by adspedia » Fri, May 14, 2021, 2:22 PM UTC

PaulHoule wrote: post #45

SXX wrote: post #29

Earlier quoted context omitted.

For instance there is no way for distributed search engines to work with CloudFlare. No, "contact me and we'll help" is not always a solution.

I've never been able to "reach a human" at Google, Facebook and other web giants and I'm skeptical that you can at a place like Cloudflare. In fact, I'd be really astonished it was possible, because otherwise their business isn't scalable.

Did you contact anyone at Cloudflare for an issue not explained in the support docs and you got no response?

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#98

Post by dannyw » Fri, May 14, 2021, 2:25 PM UTC

thejosh wrote: post #73

jgrahamc wrote: post #20

Earlier quoted context omitted.

I don't see us getting a massive innovation in search on the internet now that Google has such a massive foothold, and companies like Cloudflare stop innovation from happening. How are we "stopping search innovation"?

Hi! Thanks for taking the time to reply. You mentioned about "legit" crawlers, what defines a "legit" crawler in the eyes of Cloudflare, and what happens when Cloudflare suddenly decides it does not want to honour that "agreement"? What happens if/when Cloudflare is sold, or the contact who greenlit these smaller "legit" crawlers moves on and decides that it no longer agrees with said website anymore? Is a price comp…

There are a lot of hypotheticals here. I think you'll convince CloudFlare, and their customers, if you could name names and mention specific examples?

If you are a price comparison site getting blocked by cloudflare, site owners may be losing sales, and that's good feedback.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#99

Post by dannyw » Fri, May 14, 2021, 2:28 PM UTC

joepie91_ wrote: post #53

jgrahamc wrote: post #42

Earlier quoted context omitted.

Be a good netizen? Respect robots.txt. Don't lie in your User-Agent. Don't crawl at a ridiculous rate. All those are a good starting point.

Do you not realize the more fundamental problem with you, as a company, essentially being the one who gatekeeps crawler access to the web?

I use cloudflare out of my free will because there's malicious traffic out there, and I have enough control over everything.

They're only a gatekeeper because sites voluntarily enter into commercial agreements with them. There's no coercion or manipulation like Google AMP.

Re: Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a bad idea

#100

Post by fuckyouriotshit » Fri, May 14, 2021, 2:28 PM UTC

md_ wrote: post #95

danShumway wrote: post #91

Earlier quoted context omitted.

Thanks, that's really helpful. Followup questions though: - Does this mean if I buy 2 of these devices at the same time, it's possible for me to get the same attestation keys on both devices? I guess depends on how many batches at a time a company is producing. - Doesn't this mean that attestation keys will get more unique over time as devices from the pool fall out of circulation and become rarer? Are keys rotated t…

- Yes. - To my (limited) knowledge, yes, you are right that keys will get more unique over time. That's a very good point. Keys are not rotated nor (generally) are they rotatable; they are usually read-only. If you are using a very old FIDO device and worried it has too much entropy now--like, if it's a "rare" or "vintage" device!--then you should buy a new one, I guess? (I honestly have not thought about your second…

Manufacturers don't necessarily have to rotate the keys on older devices; they could rotate the keys on newer devices such that it's difficult to reliably tell what batch/generation a newer device is from, because it could be using a newer or older key.

Such behavior would require some way of revoking old keys from newer devices to prevent a situation where a compromised and blacklisted old key is selected and causes the CAPTCHA to fail, seemingly at random.