Your phone may soon replace many of your passwords

But on topic of the questions in this discussion, allow me to offer an unpopular opinion, just because it sounds like an interesting thing to think about.

> As great as smartphones are, do you want a future where everyone is required to purchase one, an a cell plan to exist in society, to engage in commerce, enjoy shelter, health care and security?

Required to purchase one? How about given one instead? In my country, we have eID cards, which can be used for digitally signing documents and can serve as methods of authenticating against a government site - due to legislation, now everyone gets one, much like people got passports. And yet, nobody questions needing these cards or passports, even though technically if you lose yours, you do have to pay for a new one because "it's government property".

Alternatively, if people would still have to purchase one, force the manufacturers to be open about their production costs and profit margins, mandate certain specs of devices not to exceed certain pricing - much like Chromebooks have already taken over education in many places of the world due to their relatively simplistic nature, i don't see why we couldn't have basic spec Android devices in abundance either.

Better yet, protect phones and being able to use them like one would treat the likes of eID cards and similar:

  - all phones need security updates for 5-10 years from the manufacturer
  - all phones need certain levels of battery life: if a new Nokia 105 can last for a week, i don't see why you couldn't cut down the standby modes of Android phones to do the same
  - all phones need their batteries to be replaceable by the user, should they want to do so, no phone can be sold without them as available replacement parts for purchase
  - all phones need proper permission setups: a passcode for installing apps, and full control over network requests, similar to NetGuard https://netguard.me/
  - all phone OSes need to be open source and open to modification, no more locked bootloaders or other stuff like that (might need a confirmation with the user's code first)
  - all phones need their hardware drivers and all documentation pertaining to those be open source
  - all phones must support custom apps being written, installed and run by the owner, much like a *nix machine doesn't constrain you
  - all phones must support third party app stores, should the user choose to use them, e.g. FOSSHub/Fossdroid
  - to fight malicious usage of the above, have a LED indicate whether a custom ROM is or isn't being loaded and have a checksum or something show up during boot with info about any digital signatures of the ROM

Who knows, maybe eventually the majority of phones would once again become more blocky and more of them would be IP-68 certified, or something like that. In my mind, phones should be dependable computing devices, more like a Raspberry Pi/Arduino with a sturdy case in your pocket, rather than dainty status symbols. Think along the lines of these:

  - https://www.catphones.com/en-us/
  - https://www.ulefone.com/
  - https://us.blackview.store/

I already do, so nothing would change for me. I cannot imagine leaving a phone at home, much like i cannot imagine spending a day without Internet (this is probably a controversial statement, should lend itself to some discussion about how people live nowadays, especially the younger generation). Doing so would be depriving myself not only of a means to communicate and navigate, but also of the ability to look things up, like tutorials, or information about something that i'm interested in. Some might extend those arguments to things like note taking, audio notes included, as well as entertainment. Alternatives exist, of course, but they're rather unwieldy - who wants to drag a notepad, a map and a compass, as well as a voice recorder, maybe a dumb phone or a walkie talkie with them separately?

Edit: probably interesting to compare this with carrying a wallet around - since it has money/bank cards and quite possibly ID and other pieces of information as well. Which could be replaced by a phone. And it's not like you could use it after stealing/robbing it off of someone, since it would be behind a passcode or additional lock mechanisms.

> And for the slippery slope: do you want a future where it's legal to arrest people until their phones can be verified?

I have no illusions about this not being abused if that were ever the case, which kills argumentation in favor of anything like it from the onset. Similarly to how there were various "tests" put in place before voting in US, many of which targeted ethnic minorities. I bet similar excuses could be made about officers "failing" to validate a phone/identity due to "technical issues" and thus depriving people of their freedoms.

That said, i am in favor of means to identify people that actually work for a change - you should not be allowed to start a company on someone's behalf after presenting pieces of information that could easily be found out, like someone's name and any sort of a national identifier. My country basically had the same problem - a national identification number for each person, which many sites still asked for during signup. Due to this value ever leaving the confines of something that holds and uses it as necessary, it's no longer reasonable to rely upon. Consider the eID cards instead - it stores a private key and can only be used to sign things with PIN codes that the user must know/store themselves. The certificates never leave the physical device. We need more of that approach. PII leaking would suddenly become a less harmful thing, because it's not like you could actually do anything with that information.

> To prevent impersonation, maybe chip people like dogs so that they can be reliably matched to their phones, and make it a crime (maybe "attempted impersonation") to tamper with the chip or to help someone tamper with the chip?

Pretty dystopian, admittedly. Some people already do, to enjoy the benefits of RFID chips. Personally, for the most part, i'd prefer to stick with fingerprints for opening biometric locks with phone apps and such acting as alternatives. Then again, if i were writing a dystopian novel (you know, more dystopian than real life, where every action that we take online is catalogued and can be looked up by the powers that be) it'd be curious to explore the benefits and drawbacks of having everyone have chips in them. If the society were ruled by a benevolent AI? Probably less crime and strong application of the law. If the society were ruled by regular people? Probably blackmailing and discrimination like you cannot even imagine.

(note: none of these views are exactly held strongly, just something fun to ramble about)

If the batteries die and you need to get inside, you need to have a physical key or an alternative ingress.

    Paula: "...what's that?"
    Blank Reg: "It's a book!"
    Paula: "Well, what's that?"
    Blank Reg: "It's a non-volatile storage medium.
                It's very rare. You should have one."

- Go to the supermarket (you can ask a friend with a phone to help you order online)

- Take a taxi (usually, depends on the driver)

- Eat at a restaurant

- (Basically, enter any place of business)

- Go to the hospital

- Travel to another province

- Visit any scenic area or large public park

- Get a Covid test

- Visit your friend’s apartment (usually)

What if your battery dies? Super-reliance on cell phones means this is a solved this problem: it’s trivial to rent a charger anywhere there’s a convenience store.

To be clear, I also see this as an anti-pattern. The presence or absence of an expensive connected device should not restrict what a person can do in meat space. A person not carrying a mobile phone is still a person.

But I don’t see how you actually do contact tracing at scale without this. In the beginning of the pandemic, entering a supermarket meant writing your contact info (including ID number!) on a paper ledger at the entrance. Fuck that.

No one remembers that, because it didn't happen. It was misreported, but the correction never went as viral.

I kinda liked smartcards for authentication: https://en.wikipedia.org/wiki/Chip_Authentication_Program

This stuff is simple, works offline and is hard to hack.

I understand it still has some shortcomings, such as permitting MITM attacks.

I hope the new FIDO standard gets a variety of implementations, including dumb keys, etc.

I don't see it as a slippery slope argument because almost everything will eventually move to being online-based, and if "having a phone" becomes the standard for authN, then someone without a phone is excluded from participating in all of those things.

Kinda hard to with a phone that's out of charge...

Is something really more convenient/better if it doesn’t work when you need it most?

I do think society needs to take a proactive role in deciding how it wants to interact with technology though. There’s a certain laissez faire, almost defeatist attitude that you see from a lot of the tech crowd, that goes something like “technology will do what it does, and it will change our lives how it sees fit, and we are powerless to stop it.” But if that was the case, we couldn’t have gun control laws, or environmental protection laws, or restrictions on nuclear technology. Technology may continue to develop, but it’s still up to us how we choose to use it.

You don't even need cellphones. Just issue people hard to forge documentation and set up checkpoints. It's the difference between a fence and a shock collar.

Your dream seems to be to set up the infrastructure for universal command and control, then expect it to choose to regulate itself.

Especially when one particular form factor leads to surveillance of your location.

Some people don't want any technology at all. What happens to them in your future?

I grew up without any of this mobile or home computing technology, and I don't see anything essential today that I cannot do without it. It's all about convenience.

Having something you know (a password) is more secure because something in your memory that you don't share can't be taken from you by any means. Passwords aren't perfect (you can be tricked into sharing it, or tortured into giving it up) but there are solutions for being forced to hand over a password, and neither tokens or biometrics solve the problem of people being tricked.

No one can murder you in an alley, and drag your lifeless corpse to an ATM and clean out your bank account because the murderers have your face, and fingerprints, even your cell phone, but not your pin. Good security should always require a secret that you know.

Not having a password would be fine for logging into low risk sites like this website, where at worst someone might get your account banned or post comments under your username, but any site or transaction where the risk is greater should just always require a password.

Yes, I know uses FIDO under the hood. But the there are very few ELIA5's for FIDO either. One's that start with "It starts with a super secret private key the FIDO device creates and never leaves the device, so no one ever can learn it. In fact, the security and cost effectiveness of the system rests on the fact that it's near impossible to extract that secret from a piece of cheap silicon. The system works because it's possible for the device to prove it knows that one thing only it could know, without ever revelling what the secret is. ..." From there it goes on to explain the techniques use to ensure despite using the same secret for every server, no two servers (from different domains) will know the same key was used to log into each. And on it goes with mutal auth, and immunity to MITM attacks and on and on. Now I think about it, maybe 5 is a little too young.

Then people say disturbing things about Passkey, like https://www.hanko.io/blog/on-passkeys : "Passkeys = (synced) WebAuthn credentials". Hang on. Is that saying this super secret key never escaped the FIDO token is now synced???

And were is this super secret key stored on the phone? Storing it in a hardware token that receive a backdoor'ed firmware upgrade is one thing. Storing it in a device that accepts firmware upgrades, when governments such as Australia's have passed laws allowing them to compel manufacturers to backdoor firmware upgrades is quite another. But storing that secret on an Android or iOS phone, that are so complex they have proved impossible to make them secure, which we know because many can still be root'ed today - surely that's insanity?

But who knows maybe that's all been thought of and mitigated. Given Google's involvement, that almost seems likely. But you could never learn if it was true from dumbed down to the point of uselessness "hey! we've invented (ye another) replacement for passwords" press releases I've seen so far.

anyway the point is not to go back to soldiers riding horses, but to not reduce the authentication options, because it also reduces security.

After all we still use keys to unlock doors and not our phones (because it would be stupid)

That purpose wasn't doing pike-and-lance charges into panzer lines. Just like most motorized units, WWI and WWII cavalry didn't fight from horseback - it would use horses to get to where they were going to fight, and dismount to fight.

The Eastern Front had a lot of terrain that was not conductive to wheeled travel.

Cavalry is also far more cost-efficient at hunting down partisans, and terrorizing civilians. It doesn't need petrol, you can just steal horsefeed directly from the people you are occupying.

Cavalry still had a huge role to play in WW2. You didn't ride them into battle (you didn't do that in WW1 either), but they were used for transport. Germany and Russia used 6 million of them.[1]

[1]: https://en.wikipedia.org/wiki/Horses_in_World_War_II

You do notice the irony, right?

I too prefer offline-first tools, but the market doesn't, and people are trained to sign up with an email account and password so for the masses "this is just how it is".

I don't want to be a pessimist, but examples of user respecting systems are mainly commonplace in certain corners of the highly technical FLOSS world, it's certainly not the experience of the average person.

TOTP being a notable exception.

You must have zero trust in a device where 3rd parties have full access to change whatever they want at any time and for any reason without your knowledge or consent. That's not happening for the linux server in my closet. It's probably happening for the windows 10 system in the living room, and it's absolutely the case for the phone next to me.

I'm sure you're thinking something along the lines of "Android has an SELinux sandbox that prompts for permissions." You can run this on normal desktop Linux too though (I forget the command, it's a python script in the SELinux tools (or so) repo.) No one bothers because the distro repos are relatively free of malware and installing non-free software requires a small amount of understanding. This is, of course, considered "bad UX" for non-free software but that is in practice where most of the malware comes from on other OSes. (On Linux most f it comes from sloppy language specific package managers with a free-for-all mentality like node.js or PyPi but no amount of OS design can fix stupid devs without making their work impossible.)

> Bellovin and others say one potentially tricky scenario in this new passwordless authentication scheme is what happens when someone loses their mobile device, or their phone breaks and they can’t recall their iCloud password.

and Google ignores the authentication question and just assumes a new, charged phone follows every human being wherever they go (and presumably the same goes without saying for backup codes):

> Google says that even if you lose your phone, “your passkeys will securely sync to your new phone from cloud backup, allowing you to pick up right where your old device left off.”

There's an easy way to make passwords usable only by people with password managers: instead of letting the user set a password, generate it for them.

I didn't know the details about different scopes and had always assumed the sites would obtain at least the name and email address, because all I ever saw was the prompt "To continue, Google will share your name, email address, language preference, and profile picture with <site>."

I wish for a completely local mechanism where a phone with a hardware security module could act like a token via completely local communication with the browser, both for enrollment and later login with any relying parties. For general users, I do like the idea of being able to backup/restore the token seeds to allow replacement of hardware without manually re-enrolling redundant keys with all relying parties.

But, I don't see why the cloud-assist should interpose between the user agent and the security device, nor why a cloud-assist should interpose between the user agent and the relying party. How is this cloud-assist different than the other vendors like Duo and Okta, interposed in enterprise client login attempts and organizing MFA options which can include authenticator apps on phones?

I feel like platform vendor lock-in has been gratuitously introduced into this plan. Couldn't a token backup/restore service be offered to users without interposing anything new service between the phone-as-token, the user agent communicating with the token, and the relying party service? Or, couldn't the token standards be amended with some sort of web-of-trust concept to allow a token to announce additional peer/backup token keys during enrollment. so that one enrollment task can simultaneously enroll the present token and offline backup token(s) with the same relying party?

This, in my view, is the problem with FIDO.

They shouldn't be able to make that choice.

I still use a flip phone and don't want apps. I want a phone only.

Yes - doesn't the article suggest that this would use FIDO? "According to the FIDO Alliance, users will be able to sign in to websites through the same action that they take multiple times each day to unlock their devices"

I was pointing out that this model - FIDO or some other version - does make sense. Even if the drawbacks of forcing people to use it on phones are obvious.

> There is about eight years of hardware in the market you can use rather than your phone.

If there are dedicated hardware solutions that's great! It seemed from the article like they were requiring phones - which was the source of my concern.

Right now my bank requires my phone to get a 2fa code for anything important. I can only have a single device at a time, if I lose my phone, I can of course reset it if I'm in the country and go to a branch. Of course with Covid that was difficult when I last lost my phone, so I had to download a form sign it and fax it to be able to set up my 2fa on my new phone. It took 2 weeks before I could access my bank account.

Can you be potentially tracked across the internet with your single public key in the FIDO system. If my understanding is correct you have a private key no one knows and you provide the public key to authenticate yourself. If you only have one private key and one public key surely your open yourself up to tracking/privacy related stuff? I might be wrong due to my ignorance.

Probably things like needing a (google/apple) smartphone for mandated vaccine passports / coming digital ID's, digital currency etc.

Oh wait, example.com sends me a encrypted key, that I decrypt and then use? That sounds ... odd.

I mean, why not just keep the same encrypted data on my local phone ? The attack surface seems much smaller.

It is so much less humiliating to put my hand on the sensor than when I have to touch my head to the cash register each time I want to pay for something.