As all of the FIDO Alliance documents state, the FIDO U2F protocols should never be able to abused to identify whether a user has multiple accounts with one service, or for services to collude and find out a specific user's identity.

So why, when I do a WebAuthentication API request, does my device serial number get sent in the Attestation Certificate?

This happens with the Yubico Security Key, Yubico 4, Key-ID (Feitian Technologies under the hood) and I'm not 100% sure, but it looks like the HyperFIDO may be doing it too.

This seems like something that can directly link a user to a specific service. Not to mention that if there was any future breach where it turns out that these manufacturers have a database linking serials to master secrets, this would be a nightmare.

Please answer to assuage my fears (or indeed confirm them, if this is the reality).

(edit: here's some code which shows where it can be grabbed. Not all devices will show a serial number here but if you print the attestation cert binary data as ASCII it is clearly visible. I will put some code up soon so one can see for oneself.)

  • 1
    Okay, just found some more info here which tells me that the serial number is not unique, but from the certificate, shared by around 100,000 devices. I had a realisation that I could check my Yubico 4 with YkPersonalization Tool and indeed, it is not my unique serial number. Still, 100,000 devices distributed in a calculated way, could leave a user quite identifiable, no? I'm not great at maths so maybe this is actually nearly impossible. Perhaps a maths/statistics bod could enlighten me as to the likelihood of this happening. – Ed Watson May 22 '18 at 19:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.