News for hackers. Stuff that matters.

A comment on Passkey technology is elegant, but it's most definitely not usable security. Parent comment

Re:Passkey technology is elegant, but it's most definitely n... by amluto on Monday December 30, 2024 @11:17AM (#42550646)
In order to attack a CTAP token, I can tap it against an ordinary phone or a Proxmark or any PN532 device attached to a computer with some fairly straightforward software. There isn’t any authentication! It could be ECDH or SnakeOil-102400-super unbreakable for all an attacker cares: the attacker can just speak the protocol as specified.

edit: Okay, I found the pinToken mechanism in the spec. It is, to put it politely, not a PAKE. It has a trivial DoS attack by design allowing anyone nearby to destroy an authenticator. It looks vulnerable to an attack in which someone taps a malicious token against a phone or other reader, triggering the phone to try to authenticate, and thus captures the PIN, hashed but not even salted.

Oh, and I’ve personally never been prompted to set a PIN, and the UX looks miserable.

[ Parent | on HN ]
Re:Passkey technology is elegant, but it's most definitely n... by lxgr on Monday December 30, 2024 @11:26AM (#42550735)
That's why you either use authenticators as a second factor only (i.e. you require a password entry first), or you require user verification (which is usually a PIN entry verified by the authenticator). Both solve this problem.
[ Parent | on HN ]