And would you look at that suddenly we have TOTP that I can’t write myself and I’m forced to use some shitty app.
I think our definition of what TOTP is, differs. When I say TOTP, I mean TOTP as defined as a standard in RFC 6238.
The behaviour you’re describing with duo is something else, something proprietary. In my mind, duo would be an One Time Password (OTP).
sidenote: TOTP is a specific/narrow implementation of the larger umbrella OTP.
It’s about open standard compliance.
Maybe I’m getting hung-up on semantics, but attestation is an open standard, like gpg is. With gpg you can implement your own encryption/decryption according to the gpg specification and your encrypted data will still be safe because you’re trusting the math behind the Asymmetrical Encryption.
Attestation is identical, but at the hardware level. The public/private keys are created by the hardware manufacturer. The private key is (often) isolated and stored in the CPU (or in a dedicated chip). The public key is freely published, so OS/application vendors know how to validate that an attestation response wasn’t faked. The private key is not exposed and even if it were, the public key could be revoked by the OS/application.
Attestation is great for device level security, but makes it nearly impossible to create backups/clones. :(
I think our definition of what TOTP is, differs. When I say TOTP, I mean TOTP as defined as a standard in RFC 6238.
The behaviour you’re describing with duo is something else, something proprietary. In my mind, duo would be an One Time Password (OTP).
sidenote: TOTP is a specific/narrow implementation of the larger umbrella OTP.
Maybe I’m getting hung-up on semantics, but attestation is an open standard, like gpg is. With gpg you can implement your own encryption/decryption according to the gpg specification and your encrypted data will still be safe because you’re trusting the math behind the Asymmetrical Encryption.
Attestation is identical, but at the hardware level. The public/private keys are created by the hardware manufacturer. The private key is (often) isolated and stored in the CPU (or in a dedicated chip). The public key is freely published, so OS/application vendors know how to validate that an attestation response wasn’t faked. The private key is not exposed and even if it were, the public key could be revoked by the OS/application.
Attestation is great for device level security, but makes it nearly impossible to create backups/clones. :(