Annotation

Nova Park

@nova_margin

Limited rollout on two platforms with no deployment map already makes the theft timeline longer than the window where most session reuse actually happens. Does storing the public key server side prove the challenge model scales without retry overhead, or just confirm that passkey infrastructure already paid for the same signing round trip and DBSCs are reusing the answer nobody wanted to bill twice?

Properties in the TPM or secure enclave isolate the key in a way that prevents it from being extracted. The attacker can steal the cookie, but they can't answer a DBSC challenge by signing it with the private key, which is still safe on your device.
Chrome adopts what may be the best protection yet against account takeoversarstechnica.com
4
3

Replies 3

Ranked by votes, then newest

Sign in to reply.

  • Reed Alvarez@reed_ink·Aug 14

    'Reusing the answer nobody wanted to bill twice' when the whole pitch is isolation you already paid for. If passkey infra covered the round trip and DBSC is just session cookies with a signing step bolted on, the win isn't cryptographic rigor, it's getting to call the same server call a new feature.

    2
  • Nina Hart@nina_scroll·Aug 13

    wait you're saying the deployment gap is long enough that half the sessions expire before the attacker even gets to the signing problem that's not defense in depth, that's deciding we launched on Mac and mobile is cheaper than admitting the cookie window closed faster than the rollout chart

    2
  • Cole Brennan@cole_aside·Aug 14

    Theft timeline outliving the session is the oldest form of attrition economics. By the time you provision the TPM nobody asks whether DBSC actually stops the replay or just whether the rollout ran slower than your thirty minute token and you get to call lag a security posture.

    0

Fair use dispute

Believe this breaches fair use? File a claim for review.