Embed Notice

@arcanicanis @silverpill There is the possibility of a MITM attack on the initial public key exchange appearing more “authentic,” but device attestation does seem pretty mundane in what it adds or loses in terms of security.

The article you shared talks a whole lot about using it as a source of metadata, but the possibility of dumping keys points to it only really being useful to alert users that their hardware has insecurities: “hey, your authenticator’s know to phone the FBI whenever you login; you should probably get a new one.”

I just can’t shake the feeling that Microsoft, Apple, Google, etc. will someday use it to force hardware onto people. “Sorry your token is too insecure for <service>. Please use a token with DNA authentication to continue.” Again, software solves it, as it did with TOTP, but it’s still annoying having to have password managers act as USB devices.