News for hackers. Stuff that matters.
Re:Apple, Google and Microsoft Commit to Expanded Support fo... by sdfgdfgbsdfg on Thursday May 05, 2022 @03:26PM (#31277455)
Yes but what the OP is saying is that the TPM does not store the encrypted passkey, rather, the passkey is wrapped with this TPM's public key by another TPM that already trusts this TPM, so this TPM can import a passkey that's been wrapped with its own public key and store it unencrypted. See Apple's circle of trust: https://support.apple.com/guide/security/secure-keychain-syn...
Re:Apple, Google and Microsoft Commit to Expanded Support fo... by jeroenhd on Thursday May 05, 2022 @03:39PM (#31277589)
I understand that, but that's not supported by any current standard as far as I know. We'll need a new TPM standard for this, which probably also means it will take years before every device supports this feature as modern computers can easily last five to seven years if you replace the batteries and don't cheap out. FIDO needs something that works now, or maybe tomorrow.
Re:Apple, Google and Microsoft Commit to Expanded Support fo... by sdfgdfgbsdfg on Thursday May 05, 2022 @03:49PM (#31277690)
Agreed, and that's why I say in my original comment that I don't see it happening in the short term. If we had something that worked now or maybe tomorrow and was acceptable, it would simply be virtual authenticators; an authenticator implemented entirely in software. There's no practical reason why password managers like 1Password can't do that beyond attestation which nobody checks anyway. But in the end, I don't see the big three participating in sharing. The threat model changes so much that especially for Microsoft (in cell phones) and Google (in desktops) that means trusting an adversarial OS they have no control over
Re:Apple, Google and Microsoft Commit to Expanded Support fo... by blibble on Thursday May 05, 2022 @05:27PM (#31278596)
you can do it easily enough with the current TPM operations (2.0, not 1.2)