31–40 of 71 posts
Earlier quoted context omitted.
Well, it's a good thing Device Bound Session Credentials (DBSC) as proposed here has no way to actually send said endorsement key anywhere; rending the objection irrelevant. The TPM is only for secure storage as verified by the browser itself, not the website being visited.
[flagged]
We do; and it is specifically called out in the spec that the certificate chain is not submitted, due to the potential for overpowered fingerprinting. As such, this battle, should they make a move to change that, needs to be fought a different day. Fighting against hypotheticals is pointless.
Edit: For the pedantic, fighting against hypothetical things that they could do if they invented something that doesn't exist right now, is pointless.
Edit 2: You can't boil a frog without ecosystem cooperation. The internet isn't going to bow to inconsistent adoption. They already made it clear with WEI they have no interest.
The first sentence > HTTP cookies were never intended for session management Seems odd. IIRC that's exactly what they were meant for. State management for http which is stateless. Am I missing some history here?
The faster we get an antitrust breakup of Google from Chrome and Android, the better.
Earlier quoted context omitted.
You can run a software TPM if you browse within a VM.
~~~~But your VM TPM won't be signed during manufacturing by a trusted root. No attestation.~~~~ OK I take it back, privacy is one of their specified goals: > Note that the certificate chain for the TPM is never sent to the server. This would allow very precise device fingerprinting, contrary to our privacy goals. Servers will only be able to confirm that the browser still has access to the corresponding private key.…
If you cared about security you would let me authenticate with ssh key signatures. GitHub does this, if you can manage to talk to an HSM you can manage to talk to the openssh agent.
Earlier quoted context omitted.
~~~~But your VM TPM won't be signed during manufacturing by a trusted root. No attestation.~~~~ OK I take it back, privacy is one of their specified goals: > Note that the certificate chain for the TPM is never sent to the server. This would allow very precise device fingerprinting, contrary to our privacy goals. Servers will only be able to confirm that the browser still has access to the corresponding private key.…
[flagged]
Session cookies have zero correlation to fingerprinting.
Earlier quoted context omitted.
What negative effects are you thinking DBSC will cause?
The very next step they will take is that they will only give devices session credentials that pass remote attestation, preferably to the browser level. Than you won't be able to use alternative clients or extension google doesn't deem acceptable.
What's preventing alternative clients from doing that?
Earlier quoted context omitted.
This inexplicable overreaction to genuinely valuable security improvements is getting ridiculous. Computer security is a complete dumpster fire right now and we need things like this.
> valuable security improvements Valuable to who, exactly?