▲ 396 ▼ GitHub to require 2FA on accounts by October 6, 2023 (github.blog) submitted 3 years ago* by Xylight@lemmy.xylight.dev to c/technology@lemmy.ml 125 comments fedilink hide all child comments I personally am fine with this.
[+] xhci@lemmy.ml 5 points 3 years ago (2 children) [deleted] permalink fedilink source parent hideshow 4 child comments replies: [–] voidx@futurology.today 6 points 3 years ago (1 child) Just FYI, your account shows up as a bot. You should change it in your account settings. permalink fedilink source parent hideshow 2 child comments replies: [+] xhci@lemmy.ml 1 point 3 years ago [deleted] permalink fedilink source parent [–] Bitrot@lemmy.sdf.org 2 points 3 years ago (2 children) If your account is frozen they should still be on the device. That would be a good time to change all your passkeys over to a yubikey, or to add one as a secondary token. The keys being locked in a Secure Enclave is generally considered a feature, not a bug. That passkeys sync at all is somewhat concerning. I wouldn’t expect them to be exportable any time soon. permalink fedilink source parent hideshow 4 child comments replies: [+] xhci@lemmy.ml 1 point 3 years ago (1 child) [deleted] permalink fedilink source parent hideshow 2 child comments replies: [–] Bitrot@lemmy.sdf.org 2 points 3 years ago* (last edited 3 years ago) (1 child) Apple actually describes the process for sync in some detail: https://support.apple.com/guide/security/secure-keychain-syncing-sec0a319b35f/web Apple also describes the keychain recovery process in depth (I think this is when you’ve lost all devices?): https://support.apple.com/guide/security/escrow-security-for-icloud-keychain-sec3e341e75d/1/web/1 The Secure Enclave can apparently return the private key. For most keys it is encrypted with a key pair that is permanently stored in the Secure Enclave. For synchronized keys it is apparently encrypted with a key that is also stored in iCloud in such a way that Apple themselves cannot get to it. It does sound like they could potentially enable exporting the passkeys, I think it’s unlikely they would because they provide a method to move them to other devices already and it does introduce more avenues for misuse. I don’t think it’s a huge requirement anyway, most hardware tokens provide no way to export at all by design. Apps that use them for 2FA should provide for enrolling multiple tokens. permalink fedilink source parent hideshow 2 child comments replies: [+] xhci@lemmy.ml 1 point 3 years ago [deleted] permalink fedilink source parent [–] argv_minus_one@beehaw.org 1 point 3 years ago* (1 child) The use of a “secure enclave” for any purpose is a bug at best, because secure enclaves aren't just secure against your adversaries; they're also secure against you. This is intolerable. All machines must obey their owner, and “secure enclaves” by design don't. permalink fedilink source parent hideshow 2 child comments replies: [–] Bitrot@lemmy.sdf.org 1 point 3 years ago Hard disagree. That rules out yubikey, smart cards, and most any other credential storage systems. permalink fedilink source parent
[–] voidx@futurology.today 6 points 3 years ago (1 child) Just FYI, your account shows up as a bot. You should change it in your account settings. permalink fedilink source parent hideshow 2 child comments replies: [+] xhci@lemmy.ml 1 point 3 years ago [deleted] permalink fedilink source parent
[–] Bitrot@lemmy.sdf.org 2 points 3 years ago (2 children) If your account is frozen they should still be on the device. That would be a good time to change all your passkeys over to a yubikey, or to add one as a secondary token. The keys being locked in a Secure Enclave is generally considered a feature, not a bug. That passkeys sync at all is somewhat concerning. I wouldn’t expect them to be exportable any time soon. permalink fedilink source parent hideshow 4 child comments replies: [+] xhci@lemmy.ml 1 point 3 years ago (1 child) [deleted] permalink fedilink source parent hideshow 2 child comments replies: [–] Bitrot@lemmy.sdf.org 2 points 3 years ago* (last edited 3 years ago) (1 child) Apple actually describes the process for sync in some detail: https://support.apple.com/guide/security/secure-keychain-syncing-sec0a319b35f/web Apple also describes the keychain recovery process in depth (I think this is when you’ve lost all devices?): https://support.apple.com/guide/security/escrow-security-for-icloud-keychain-sec3e341e75d/1/web/1 The Secure Enclave can apparently return the private key. For most keys it is encrypted with a key pair that is permanently stored in the Secure Enclave. For synchronized keys it is apparently encrypted with a key that is also stored in iCloud in such a way that Apple themselves cannot get to it. It does sound like they could potentially enable exporting the passkeys, I think it’s unlikely they would because they provide a method to move them to other devices already and it does introduce more avenues for misuse. I don’t think it’s a huge requirement anyway, most hardware tokens provide no way to export at all by design. Apps that use them for 2FA should provide for enrolling multiple tokens. permalink fedilink source parent hideshow 2 child comments replies: [+] xhci@lemmy.ml 1 point 3 years ago [deleted] permalink fedilink source parent [–] argv_minus_one@beehaw.org 1 point 3 years ago* (1 child) The use of a “secure enclave” for any purpose is a bug at best, because secure enclaves aren't just secure against your adversaries; they're also secure against you. This is intolerable. All machines must obey their owner, and “secure enclaves” by design don't. permalink fedilink source parent hideshow 2 child comments replies: [–] Bitrot@lemmy.sdf.org 1 point 3 years ago Hard disagree. That rules out yubikey, smart cards, and most any other credential storage systems. permalink fedilink source parent
[+] xhci@lemmy.ml 1 point 3 years ago (1 child) [deleted] permalink fedilink source parent hideshow 2 child comments replies: [–] Bitrot@lemmy.sdf.org 2 points 3 years ago* (last edited 3 years ago) (1 child) Apple actually describes the process for sync in some detail: https://support.apple.com/guide/security/secure-keychain-syncing-sec0a319b35f/web Apple also describes the keychain recovery process in depth (I think this is when you’ve lost all devices?): https://support.apple.com/guide/security/escrow-security-for-icloud-keychain-sec3e341e75d/1/web/1 The Secure Enclave can apparently return the private key. For most keys it is encrypted with a key pair that is permanently stored in the Secure Enclave. For synchronized keys it is apparently encrypted with a key that is also stored in iCloud in such a way that Apple themselves cannot get to it. It does sound like they could potentially enable exporting the passkeys, I think it’s unlikely they would because they provide a method to move them to other devices already and it does introduce more avenues for misuse. I don’t think it’s a huge requirement anyway, most hardware tokens provide no way to export at all by design. Apps that use them for 2FA should provide for enrolling multiple tokens. permalink fedilink source parent hideshow 2 child comments replies: [+] xhci@lemmy.ml 1 point 3 years ago [deleted] permalink fedilink source parent
[–] Bitrot@lemmy.sdf.org 2 points 3 years ago* (last edited 3 years ago) (1 child) Apple actually describes the process for sync in some detail: https://support.apple.com/guide/security/secure-keychain-syncing-sec0a319b35f/web Apple also describes the keychain recovery process in depth (I think this is when you’ve lost all devices?): https://support.apple.com/guide/security/escrow-security-for-icloud-keychain-sec3e341e75d/1/web/1 The Secure Enclave can apparently return the private key. For most keys it is encrypted with a key pair that is permanently stored in the Secure Enclave. For synchronized keys it is apparently encrypted with a key that is also stored in iCloud in such a way that Apple themselves cannot get to it. It does sound like they could potentially enable exporting the passkeys, I think it’s unlikely they would because they provide a method to move them to other devices already and it does introduce more avenues for misuse. I don’t think it’s a huge requirement anyway, most hardware tokens provide no way to export at all by design. Apps that use them for 2FA should provide for enrolling multiple tokens. permalink fedilink source parent hideshow 2 child comments replies: [+] xhci@lemmy.ml 1 point 3 years ago [deleted] permalink fedilink source parent
[–] argv_minus_one@beehaw.org 1 point 3 years ago* (1 child) The use of a “secure enclave” for any purpose is a bug at best, because secure enclaves aren't just secure against your adversaries; they're also secure against you. This is intolerable. All machines must obey their owner, and “secure enclaves” by design don't. permalink fedilink source parent hideshow 2 child comments replies: [–] Bitrot@lemmy.sdf.org 1 point 3 years ago Hard disagree. That rules out yubikey, smart cards, and most any other credential storage systems. permalink fedilink source parent
[–] Bitrot@lemmy.sdf.org 1 point 3 years ago Hard disagree. That rules out yubikey, smart cards, and most any other credential storage systems. permalink fedilink source parent