Re:Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a...
by fuckyouriotshit on Friday May 14, 2021 @10:28AM
(#27154699)
Manufacturers don't necessarily have to rotate the keys on older devices; they could rotate the keys on newer devices such that it's difficult to reliably tell what batch/generation a newer device is from, because it could be using a newer or older key.
Such behavior would require some way of revoking old keys from newer devices to prevent a situation where a compromised and blacklisted old key is selected and causes the CAPTCHA to fail, seemingly at random.
Re:Cloudflare’s CAPTCHA replacement with FIDO2/WebAuthn is a...
by md_ on Sunday May 16, 2021 @10:42AM
(#27174041)
I don't totally follow. The key is baked into each device, so if you sold a mix of devices where some had the old key and some the new, revocation of the old key would brick the new devices with that old key.
- To my (limited) knowledge, yes, you are right that keys will get more unique over time. That's a very good point. Keys are not rotated nor (generally) are they rotatable; they are usually read-only. If you are using a very old FIDO device and worried it has too much entropy now--like, if it's a "rare" or "vintage" device!--then you should buy a new one, I guess?
(I honestly have not thought about your second point before, but I am not really deep in the FIDO stuff. So take my answer with a grain of salt.)