Re:A Guide to WebAuthn
by dane-pgp on Sunday January 05, 2020 @11:01PM
(#21966331)
You started by saying that if a service required a specific type of hardware to use it then we should boycott it, but now you're saying it happens all the time and you're fine with it.
I accept your point about the protocol being irrelevant, however. One could even say that, if services are going to require specific pieces of hardware, it makes sense that the requirements are communicated and enforced using an open standard protocol, as that does allow a certain degree of interoperability and Free Software implementation.
The counter-argument, though, is that currently there are barriers to sites implementing such policies (due to the cost of issuing these devices and linking them to a specific account/address). If we set the precedent that every site should be using this technology, and reduce the cost of doing so, we bring about a set of dynamics where individual sites can start to introduce incompatibilities, whether with good intentions, or for anti-competitive reasons, or by accident.
Maybe this won't lead to people needing to carry around five dongles and two phones with them, but it could easily lead to having a lot of power concentrated into the hands of a small number of entities, or even just a single one, like the bad old days of "This site works best in Internet Explorer". Moreover, this is not just a theoretical concern, as it has already started to happen, as the link above explained:
"FIDO does not dismiss these worries and their answer, for the moment, is the metadata service (MDS). Essentially this is a unified root store that all sites checking attestation are supposed to use and update from."
I accept your point about the protocol being irrelevant, however. One could even say that, if services are going to require specific pieces of hardware, it makes sense that the requirements are communicated and enforced using an open standard protocol, as that does allow a certain degree of interoperability and Free Software implementation.
The counter-argument, though, is that currently there are barriers to sites implementing such policies (due to the cost of issuing these devices and linking them to a specific account/address). If we set the precedent that every site should be using this technology, and reduce the cost of doing so, we bring about a set of dynamics where individual sites can start to introduce incompatibilities, whether with good intentions, or for anti-competitive reasons, or by accident.
Maybe this won't lead to people needing to carry around five dongles and two phones with them, but it could easily lead to having a lot of power concentrated into the hands of a small number of entities, or even just a single one, like the bad old days of "This site works best in Internet Explorer". Moreover, this is not just a theoretical concern, as it has already started to happen, as the link above explained:
"FIDO does not dismiss these worries and their answer, for the moment, is the metadata service (MDS). Essentially this is a unified root store that all sites checking attestation are supposed to use and update from."