10.15.20

Gemini version available ♊︎

A FIDO/FIDO2 False Sense of Security for Premium Prices

Posted in Deception, Free/Libre Software, Google, Microsoft, Security at 10:09 am by Dr. Roy Schestowitz

Military-grade nonsense that is proprietary and untrustworthy (monopolised by the likes of Google and Microsoft)

Manifestation against missileSummary: From the attack on software freedom (including Richard Stallman and other leaders/luminaries) we’ve seen a shift to attacks on privacy itself, e.g. auditable encryption; today we discuss the troubling developments in the FIDO/FIDO2 space

THE ESSENCE of Free/libre software is control, liberty, autonomy, independence, security, decentralisation and sometimes privacy too. Those are all just words that convey concepts in English. It’s better understood in the absence of those things (when one lacks or loses freedom). As RMS puts it, to paraphrase a bit, either the user controls the program or the program is an instrument by which some corporation (or government) controls the user. It’s really that simple. To alleviate that unjust leverage of power (developers or developers’ employer) over computer users we need freedom-respecting software that is audited by many and forked if mischief occurs. This helps ensure that the public interest is prioritised, not the bottom line of some business/es. That does not mean that no business can exist; many businesses are based around distributing and supporting Free software. Perfectly moral and ethical business practices are compatible with the Four Freedoms.

“Earlier this year there was a major incident, which saw millions of rogue certificates being issued by Let’s Encrypt…”With all that in mind, we’ve grown cynical if not deeply concerned about the Linux Foundation. The institution itself is a misnomer (it promotes operating systems other than Linux), its biggest players (leadership) are monopolistic proprietary software companies, it advocates mass surveillance, and it works for Microsoft (which in turn works to undermine Linux).

Earlier this year there was a major incident, which saw millions of rogue certificates being issued by Let’s Encrypt, which is connected to the Linux Foundation and hosted/coded on Microsoft servers. These certificates were later revoked, but there was no transparency about what had happened. Can we trust one CA to manage so many certificates? Look at its backers and sponsors. These certificates aren’t free; if they seem to be free, it’s because someone foots the bill to gain something, such as the US government receiving back door access to undermine encryption (by access to private keys or similar). They’re already done that even inside Switzerland, covertly of course! So do we trust Let’s Encrypt? Not really, even less so after that incident. There was never clarity and now even an explanation of what was done, who the culprit was and so on.

But this article isn’t about Let’s Encrypt. It’s about FIDO2. The patterns may be similar, at least some salient points. “I don’t know if you’ve been keeping up with the developments in hardware security tokens,” one reader told us this week, “but I have been very alarmed with the developments that are happening with regards to FIDO2. I feel like this is another attempt to stomp out competition just like TLS CAs did before Let’s Encrypt was a thing.”

“We use GnuPG a great deal here in Techrights. Most of our messages are encrypted.”The reader is a bit of an expert in that domain. Also remember how the founder of Ubuntu originally amassed his wealth. “Right now,” the reader noted, “companies that make products like Yubikey and Titan Security Key are selling obscenely overpriced hardware just because it has a “FIDO2 Certified” logo on it. I feel like hardware security tokens are going to end up in the same situation that happened with TLS CAs where a few bodies monopolise the system and dictate who gets to be a “trusted provider”. A FIDO2 certification costs about $6500 USD, last time I checked. As someone that uses GnuPG and its open ecosystem of hardware, it pains me to see the monopolisation and profiteering that’s happening around the security space.”

We use GnuPG a great deal here in Techrights. Most of our messages are encrypted.

“I hope you can share this message with the right people,” our reader appealed, “to combat the monopolisation and anti-competitive attempts by organisations like FIDO Alliance. There’s nothing open about the FIDO Alliance. The firmware for most of those devices are closed-source and the only reason people are duped into buying them is because of the “FIDO2 Certified” seal on those products. I feel like this is a turning point in cybersecurity history and we need to kill this attempt at monopolisation before we end up with the tragedy that happened with TLS CAs.”

“A mechanism for trust among parties, e.g. encryption, is crucial in a free and democratic society.”How many billions of dollars were washed down the drain because of these? And we ended up with “trusted” CAs that are mostly in bed with the world’s biggest spying operation. Which means they might be worse than useless…

“We decide who to trust with our OpenPGP certificates,” our reader noted. “We don’t let other bodies make that decision for us. Let’s work together to make sure we nip this FIDO nonsense in the bud. We’ve got the platforms and people. The WebAuthn W3C steering members are stuffed with Google, Microsoft, and (surprise) Yubico people. I’m almost certain that they’re using embedded cryptography MCUs in their closed proprietary products and then making a eye-watering profit margin.”

Notice that their stuff is controlled partly by Microsoft and the NSA (in GitHub). So they clearly do not value or grasp basic security.

Our reader noted: “The OpenSK project on GitHub (by Google, I believe) uses an overpriced board and there’s a nice disclaimer at the bottom that OpenSK is not FIDO certified (this is blatant FUD). They aren’t even using the embedded crypto MCUs on the Nordic chip. They have gone with the excuse that their software-driven crypto is “research quality” code. OpenSK is a blatant attempt to spread FUD about uncertified FIDO hardware. Yubico are in on it as well.

“We might be the first site to touch this subject, but there’s more on the way for sure.”“Nitrokey has a FIDO2 product and I think it’s uncertified by the looks of things. I know Nitrokey people are very closely linked to GnuPG devs because I’ve been around GnuPG dev a lot recently. I’m pretty sure the folks at Nitrokey see the dangers of monopolisation but they’re keeping it quiet (probably in fear of the media pull Google et al have). I would also prefer remaining anonymous, thanks for allowing that…”

A mechanism for trust among parties, e.g. encryption, is crucial in a free and democratic society. Those who undermine the encryption basically maintain keys to the castle. They’ve long attempted to put back doors (or back door access, e.g. via third parties) to everything. Sometimes the media describes that as “weakening” encryption, but that actually means breaking; weak means broken.

We might be the first site to touch this subject, but there’s more on the way for sure. “Wanted you to be the first to throw a punch though,” our reader noted, “because people in the community trust you on these things.”

But there’s lots more on the way. Stay tuned.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

DecorWhat Else is New


  1. Phoronix: Microsoft and Phoronix Sponsor (and Close Microsoft Partner) AMD All Over the Place

    When you’re taking massive 'gifts' from AMD (and also some from Microsoft) maybe it’s not surprising that editorial decisions change somewhat…



  2. EPO Has No F-ing Oversight

    Earlier today SUEPO mentioned this new article demonstrating that EPO President António Campinos can very obviously and blatantly violate the Code of Conduct of the Office without facing any consequences; there are translations too, so the report is now available in four languages



  3. [Meme] Linux-Rejecting Foundation

    The Linux Foundation never really leads by example; by default, it uses proprietary software



  4. Linux Foundation Almost Never uses Open Source

    The Linux Foundation uses proprietary software (look where they hire and take money from) and be sure they're probably not even aware of it



  5. Links 17/05/2022: Many More Games on GNU/Linux, YaST Development Report

    Links for the day



  6. Links 17/05/2022: Rocky Linux 8.6 and Budgie Desktop in Fedora

    Links for the day



  7. Patent Examiners Rising Up Against EPO Abuse

    Unhappy with the law-breaking autocracy (the EPO‘s management breaks the law as a matter of routine), fast-deteriorating working conditions and rapidly-decreasing quality of work (or lack of compliance with the law), workers have escalated further, topping off strikes and industrial actions with a large-scale petition



  8. [Meme] What Managers (Really) Mean by Acting Professionally

    The myth of 'professionalism' needs to die along with the façade of conformity as prerequisite for employment (Linus Torvalds can work just fine in a bathrobe in his own home)



  9. Internal Poll: 93% of European Patent Office (EPO) Workers Are Unhappy With the EPO

    On top of strike/s and industrial action/s there are now also petitions; at the EPO, almost all staff is "disgruntled" because of utterly corrupt and defunct leadership



  10. Links 17/05/2022: OpenSUSE Leap 15.4 Release Candidate

    Links for the day



  11. IRC Proceedings: Monday, May 16, 2022

    IRC logs for Monday, May 16, 2022



  12. Links 16/05/2022: FreeBSD 13.1 and Inkscape 1.2 Released

    Links for the day



  13. Archiving Latest Posts in Geminispace (Like a Dated Web Directory But for Gemini)

    Earlier today we saw several more people crossing over from the World Wide Web to Gemini; we're trying to make a decent aggregator and archive for the rapidly-expanding Geminispace, which will soon have 2,500 capsules that are known to Lupa alone



  14. Microsoft Vidal Does Not Want to Listen (USPTO is Just for Megacorporations)

    Microsoft Vidal knows her real bosses. They’re international corporations (multinationals like Microsoft), not American people.



  15. Links 16/05/2022: China Advances on GNU/Linux and Maui 2.1.2 is Out

    Links for the day



  16. Jim Zemlin: Chief Revenue Officer in 'Linux' Seat-Selling Foundation

    Board seats in the Linux Foundation are basically a product on sale, based internal documents



  17. Reminder: Linux Foundation's Last IRS Filing is Very Old (Same Year the CFO Left)

    People really need to ask the Linux Foundation, directly, why its filings are years behind; this seems like a sensitive subject



  18. Linux Foundation Does Not Speak for GNU/Linux Users

    There's a serious problem in the "Linux" world as the so-called 'Linux' Foundation claims to speak for us (the GNU/Linux community) while in fact speaking against us (on the payroll of those looking to extinguish us)



  19. IBM's Lennart Poettering on Breaking Software for Pseudo Novelty

    Recently-uploaded ELCE 2011 clip shows a panel with Linus Torvalds, Alan Cox, Thomas Gleixner, Paul McKenney, and Lennart Poettering (relevant to novelty or perceived novelty that mostly degrades the experience of longtime users, e.g. Wayland and systemd)



  20. IRC Proceedings: Sunday, May 15, 2022

    IRC logs for Sunday, May 15, 2022



  21. Links 15/05/2022: Linux 5.18 RC7 and Calls for More Mass Surveillance

    Links for the day



  22. Audio: Mark Shuttleworth Marketed to Young Males, With Sexy Pictures

    The Web is rotting away, old links become broken links within months or years, so I’ve decided to encode a 3-minute segment of the whole as Ogg



  23. What a Difference Half a Decade Makes (When Linux Foundation is 'Having Fun')

    Media shaming campaigns may have taken their toll on the founder of Linux, who is now bossed by someone who rejects Linux and is married to a Microsoft booster. Like Richard Stallman under FSF guidance (and conditions for return, mostly for fear of further media assaults and attack dogs), he has become a more publicity-shy and private person. The Linux Foundation has in effect reduced the founder of what it’s called after (Linux) into a weekly release manager and mascot, whose brand it is gradually diluting/cheapening.



  24. Links 15/05/2022: GNU libiconv 1.17

    Links for the day



  25. [Meme] Unitary Patent and Unified Patent Court (UPC) Cannot Be Reconciled With the Law

    Unitary Patent and Unified Patent Court (UPC)? Impossible. But Team UPC counts on an endless torrent of fake news managing to convince you (and more importantly politicians) otherwise.



  26. Even Team Battistelli is Sometimes Admitting -- Out in Public! -- That Unified Patent Court (UPC) is Neither Legal Nor Desirable

    Daniel X. Thomas and other people who are “too old to punish” (consequences to their career profoundly minimised owing to seniority) are among those who push back against the Unitary Patent or Unified Patent Court (UPC); any sane person — not a career-climbing litigation zealot — can identify the pertinent facts and realise that what’s going on here is an injustice of unprecedented proportions in the patent discipline



  27. [Meme] Common Sense at EPO

    The European examiners who deal with patents prefer a system that works for science, for Europe, not for foreign megacorporations that amass millions of low-quality patents and weaponise these to discourage competition



  28. Patent Granting at the EPO Has Collapsed by 24% Owing to Much-Needed Industrial Action

    Seeing that the EPO’s management routinely violates the law and even the very legal basis of the EPO’s existence (it is a monopoly in Europe; no body has the authority to compete against it), the EPO’s examiners have embarked on a ‘Work-to-Rule’ campaign — working in compliance with the rules as defined 49 years ago and revised over the decades — and the European Patent Convention (EPC) takes priority over unlawful demands from middle and upper management; this is proving highly effective so far and it will carry on until demands are met, i.e. until the law is obeyed and staff is treated with respect/dignity



  29. [Meme] Milan is a Suburb in London

    As long as Italy is not the UK and London means London “proper” (not the French town called London) the UPCA is invalid and no matter how much Team UPC (and its puppets in EPO management) may plead, this whole system is bound to implode



  30. The Latest Propaganda Tactics of Team UPC: Pretending Unified Patent Court Already Exists and Unitary Patents Are Default When If Fact None Even Exists

    8 years ago Benoît Battistelli said that the UPC was imminent; now, after 4 years of António Campinos, it’s still not here and Team UPC speculators say it won’t happen this year, either; just like the EPO constantly lies (both to the public and to its very own staff) Team UPC continues to lie to itself (self-delusion) and to us; both also routinely break the law, engage in deliberate violations of longstanding conventions, and scrap constitutions, which in turn becomes a breaking point for the EU’s credibility and the legal profession


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts