Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

fidoalliance.org

Post reply on HN
Print view View original

461–470 of 525 posts

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#461

Post by dane-pgp »

judge2020 wrote: post #459
nybble41 wrote: post #419

Earlier quoted context omitted.

The user-hostile part of the TPM is the built-in key signed by the manufacturer which shows that it's an "approved" TPM which won't—for example—release any of the keys stored inside to the device's owner. This is what allows the TPM to be used as part of a DRM scheme. If it weren't for that small detail then I would agree that TPMs can be useful for secure key storage and the like, working for the device's owner and…

It enables it, but that's just because both you, the device user, and M$ and the rest of the media industry, need to ensure the TPM inside the processor is genuinely from the manufacturer. You wouldn't want to use a TPM if an attack vector is one where China (who is a large part of the supply chain) can poison a large amount of TPM shipments with their own key that can be used to export or otherwise access internally…

If your threat model is "China has backdoored your TPM" then making the TPM more opaque and unauditable doesn't improve the situation. How would you know if your TPM is lying and pretending to still have the original key when actually it has a replacement Chinese one?

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#462

Post by lxgr »

zozbot234 wrote: post #439
lxgr wrote: post #430

Earlier quoted context omitted.

The backup issue is solved by using an external authenticator for initial provisioning of new devices. In a compliant implementation, you can add a new external authenticator from an existing trusted device, and a new trusted device from an existing external authenticator. > while also adding to privacy concerns. What concerns are you thinking about here? > TPMs are essentially a misfeature given the existence of sma…

> In a compliant implementation, you can add a new external authenticator from an existing trusted device, and a new trusted device from an existing external authenticator. You can kinda sorta do this with WebAuthn if the service you're enrolling into allows for multiple authenticators (the spec recommends this, but some services don't allow more than one). But then you have to repeat that enrollment step with all de…

To securely store device-specific authentication credentials such as WebAuthN those used by WebAuthN/FIDO, for example.

> The only uses I can think for it are nefarious, i.e. allowing outside services to track the user and violate their privacy.

A smartcard would be one of the worst or at least most complicated ways to implement tracking: It can communicate with the rest of the system only through an extremely limited interface and can strictly only ever answer requests sent by the host, never initiate requests on its own.

To do anything nefarious, it would need a privileged companion service on your computer – which doesn't gain anything from being able to talk to the smartcard.

As an aside: Even TPMs are an extremely passive technology. The only thing that arguably makes them "evil" is the fact that they can perform measurements for device attestation, but it can still never transmit these on its own. That evil is pretty indirect, in that some service providers might only allow users to use TPM-enabled and sufficiently attested clients to access their services, and exclude open hardware and software.

That's coincidentally exactly what DRM is, and it's already here, and not at all limited to TPMs. I'm cautiously optimistic though that it's possible to strike a compromise and limit attestation to properly sandboxed parts of the system, e.g. only the parts of the GPU relevant to display copyrighted movies, without getting undue access to the rest of the system.

The smartcard part of TPMs is about as capable of evil (as far as your computer and your data on it is concerned) as a USB-connected mug warmer.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#463

Post by judge2020 »

dane-pgp wrote: post #461
judge2020 wrote: post #459

Earlier quoted context omitted.

It enables it, but that's just because both you, the device user, and M$ and the rest of the media industry, need to ensure the TPM inside the processor is genuinely from the manufacturer. You wouldn't want to use a TPM if an attack vector is one where China (who is a large part of the supply chain) can poison a large amount of TPM shipments with their own key that can be used to export or otherwise access internally…

If your threat model is "China has backdoored your TPM" then making the TPM more opaque and unauditable doesn't improve the situation. How would you know if your TPM is lying and pretending to still have the original key when actually it has a replacement Chinese one?

The actual attestation process protects against this:

program generates random bytes->ask tpm to sign it->on signature return, program asks TPM for its public key->program verifies public key matches that of the signature->verify the public key is cross-signed by the manufacturer's certificate authority. The only attack here would be if Intel or AMD's PKI is compromised, which would certainly be leveraged against enterprise customers before any consumer customers got hit.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#464

Post by [deleted] »

aftbit wrote: post #148

Are there any FIDO security keys that explicitly support backing up and restoring their master secrets? I would love to move from Username + Password + TOTP but my current workflow requires that I am able to regain access to my digital accounts using nothing but a few page paper backup including core service passwords & exported TOTP secrets.

[deleted]

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#465

Post by pabs3 »

Ajedi32 wrote: post #352

This is huge! It sounds like they're finally going implement cross-device synced credentials; a move I've been advocating now for the last two and a half years[1]. Widespread support for this feature is, in my opinion, the last thing needed to make WebAuthn viable as a complete replacement for passwords on the web. The white paper is here: https://media.fidoalliance.org/wp-content/uploads/2022/03/Ho... Seems like the…

Isn't it better to have one key per device that never leaves the device?

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#466

Post by toastal »

mjevans wrote: post #310
throwaway52022 wrote: post #199

Earlier quoted context omitted.

For web apps/services, the browser needs to be involved here too, right? (And maybe the OS?) How can I tell Chrome on my desktop to use my "software token" instead of Chrome looking for a hardware token over USB or finding it via NFC, so the remote service can ultimately interact with my (virtual) token? (I don't even want to think about how to tell Mobile Safari on my iPhone how to find my key) EDIT: My ideal setup,…

I do NOT want to use my phone. It cannot be considered to be a secure device given the 'network' baseband control chipset will never be owned by the phone's buyer and has full access to the device.

For me the biggest anti-phone argument is that they break and that is very common. They also run out of power. Hardware keys offload this to something that can go through the washing machine or ride in monsoon rains on my motorbike's keychain.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#467

Post by makeitdouble »

judge2020 wrote: post #450
makeitdouble wrote: post #440

Earlier quoted context omitted.

I went through the white paper, yet still don’t completely understand how it is supposed to work cross device, granted I’m new to Fido. Let’s say I have the same key synched between my laptop, smartphone and tablet. When I wake up in the morning, will there be a ceremony of unlocking my phone (standard non Fido way I guess?) then unlock my tablet from my phone, then the laptop from one of unlocked devices ? With some…

Sync in this situation means that the actual private key being used to sign in with the website is stored in a password manager as if it were a password, and the service vendor (iCloud Keychain[0] for example) is the one that syncs the key to other devices utilizing that password management service. But this 'passwordless' trend is more about signing into websites - If they do implement singing into other devices, I…

Thanks, it makes it a lot clearer.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#468

Post by aborsy »

dividedbyzero wrote: post #244
rootusrootus wrote: post #153

Earlier quoted context omitted.

I haven't run into any like that, but I'm with you -- if I could only store one webauthn key, I wouldn't use it at all. Too risky.

I believe AWS root accounts don't support more than one key to be added.

Right. But you could create new users, not root but with admin rights, and enroll new keys.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#469

Post by Ajedi32 »

pabs3 wrote: post #465
Ajedi32 wrote: post #352

This is huge! It sounds like they're finally going implement cross-device synced credentials; a move I've been advocating now for the last two and a half years[1]. Widespread support for this feature is, in my opinion, the last thing needed to make WebAuthn viable as a complete replacement for passwords on the web. The white paper is here: https://media.fidoalliance.org/wp-content/uploads/2022/03/Ho... Seems like the…

Isn't it better to have one key per device that never leaves the device?

"Security at the expense of usability comes at the expense of security."

Technically yeah, device-bound keys are "more secure", but not if that results in people continuing to just use passwords instead because updating your credentials on dozens of sites every time you get a new phone or security key is too difficult.

Synced WebAuthn credentials are at least as secure as a properly-used password manager, way more usable, and a lot more secure than passwords, which is what they're replacing. Besides, there's still the option of using separate device-bound keys for situations where even higher levels of security are required.

Re: Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard

#470

Post by NorwegianDude »

Imagine a world where Apple, Google and Microsoft allowed users to use whatever identity provider they wanted.

You would select the provider you want, or be your own provider. Then you would be able to enable 2FA, use hardware keys and whatever else with ease and higher security.

No more passwords, as the provider basically replaces a password manager.

I wish something like OpenID will be the go to solution some day.

Post reply on HN