Page 2 / 2

So now you have to worry about hardware keyloggers snooping the wire. Or kernel-mode keyloggers listening to the drivers. The latter is easier to handle: limit what kinds of drivers can be installed through something like Windows Defender Application Control. The former though?

Not a lot you can do to protect from hardware keyloggers. To truly protect this whole stack you need dedicated hardware that guarantees nothing is listening to the electrical signals. That's hard even with specialized hardware. It's impossible for general purpose systems.

All of this adds up to a particularly complicated mess that is hard to fit into your head and harder to defend. Surely there are better options here?

Smart card form factors

This is why we've been pushing passwordless. Sure, it's partly a marketing thing, but it's also a line in the sand. Passwords just genuinely suck. We can do better and we want to do better.

So we have smart cards. These were our first go at passwordless 20 years ago. They are more secure than passwords for a few good reasons...

First, they rely on asymmetric crypto (passwords = symmetric), which means you split the key into two separate pieces: a secret (private) key and a public key. You can share the public key with anyone, but you keep the private key to yourself.

To authenticate the user you ask them to perform an operation that only the holder of the private key can perform, which is then verified against the public portion.

This turns out to be an incredibly useful property. With smart cards you can store the private key in a tiny integrated circuit embedded into a piece of plastic. When you need to authenticate you plug it in to a reader which lets the computer ask the IC to perform operations.

This makes the key portable and also prevents you from copying the key off the IC, since the IC is hardened to protect against that sort of thing (in theory).

There's an obvious problem here: anyone can steal the card and use it. So we introduce PINs that unlock the card. You type a PIN into your computer, which is sent to the card and if it's correct that tells the card that it's safe to perform the requested operation.

So smart cards for everyone!! Except, they didn't really take off. Why? Well, a few reasons.

They require dedicated readers.
They're expensive to manufacture.
They're easy to lose.
They're easy to break.
The standards bodies were...insane.

Over time these issues were overcome. We got better form factors, the manufacturing costs went down, the standards bodies mostly came to their senses.

Alas, the standards still kind of aren't great and making changes to them is hard to do.

But there's also another more insidious problem with them in that we're back to typing secrets (your PIN) into a keyboard that translates into electrical signals across a wire into the kernel and

Always evolving we built Windows Hello. The simplest way to describe Windows Hello is you take a smart card and embed it into your computer. We store you private key on your hard drive, encrypted to a key derived from your TPM and something else.

When you want to use this private key to perform an operation, say to log in, you take that "something else", combine it with the TPM and out comes your private key. That "something else" could be a PIN you type in, or a biometric template from your face or fingerprint.

This solves so many fundamental problems with smart cards.

Nothing to physically lose.
Nothing to break.
Doesn't require a dedicated reader (ish).
Manufacturing costs are low(er).
Infinitely easier to use.

But there are tradeoffs. The credential isn't portable anymore. This is a positive and a negative. On the one hand you can't steal the private key and use it elsewhere. On the other hand you have to register yourself on every machine you use.

The cryptographic operations occur in the OS. Therefore you can snoop on the "something else" path and collect the PIN or parts of the biometric template. In a theoretical sense that's potentially very bad. Way way way waaaaay harder to attack than passwords, but still.

This was solved through some serious collaboration between hardware vendors and Windows folks and culminated in something called Windows Hello Enhanced Sign-in Security. Windows Hello Enhanced Sign-in Security | Microsoft Docs

The gist of this is relatively simple: move all the important security (crypto) operations that occur in the normal world OS into VSM. Easy, right? Well no. This was a hard problem to solve. 😂

But now it's incredibly difficult to snoop any data between the hardware sensors through the kernel to VSM and back into LSA. There are no extensibility points that let you touch the raw creds. Now that first order high value cred is seriously protected.

Combine it with Credential Guard and now all you're left with is low value credentials. Not bad.

But we're back to the problem of portability. You need to register the credentials on each machine you use. To register credentials you need another high value credential AND you need MFA.

Did I mention that smart cards and Windows Hello are MFA? They are. They're something you have (card or PC) and something you know or are (PIN or face/fingerprint). You're not going to get a super-high value credential out of just a password, so you need to go the extra step.

FIDO keys

Some folks don't like to recognize Windows Hello as MFA. They're wrong, it is MFA. However, it may not fit their requirements *for* MFA creds because you require separation of the credentials from the machine. Sure, that's fine.

So portability is critical here. Which is why we have this thing called FIDO. It's an industry consortium and set of standards that allow different parties to agree on the form of credentials used as well as their relative security worthiness or credibility.

The net product is this security key, which is kinda sorta like a smart card in that is stores a private key, and you have to unlock it before you can ask it to perform operations against that key.

What makes it special and better than smart cards is the implementation. The protocol is simpler, the metadata is structured for specific scenarios (SCs are generic and require things called middleware to interpret functions), and you can store many identities on a single key.

But most importantly the ability to unlock the key has multiple predefined mechanisms. You can use a PIN typed into your computer, or you can use a key-specific mechanism like using a fingerprint reader built into the key. Getting that to work with smart cards is...non-standard.

Actually, another important thing is that these keys are rated for security levels and those levels are imprinted on the authentication. With a smart card all the party knows is a certificate was used. With FIDO you know a hardware key certified to a certain level was used.

AND ANOTHER THING... smart cards expose certificates, which can be used for any number things (a good thing for sure), whereas FIDO exposes specific authentication protocols. When I log into a website with a smart card I'm using TLS client cert auth. FIDO is higher in the stack.

Plugging into the TLS transport stack is expensive and complicated and potentially leads to uuuuugly vulnerabilities. Moving the authentication to the application layer is architecturally more sound. It's safer and easier to implement.

Dangit, and another thing! FIDO isn't just about external keys. It's about abstracting away authentication methods. With FIDO and webauthn you can log into a website with your security key or with Windows Hello. Windows Hello IS a FIDO and webauthn key.

I guess I went off on a tangent there. Anyway...

So you see why passwords are pretty lousy, and why we don't think they should be the predominant method of authenticating people. /fin

Page 2 / 2