Light

Episode #870 Quiz

THAT "PASSKEYS" THING
Date: 2022-05-10 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Android patched actively exploited Linux kernel double-free CVE-2021-22600, enabling privilege escalation from malicious apps. Connecticut’s privacy law now mandates honoring Global Privacy Control without prompts. F5 fixed unauthenticated BIG-IP RCE. Nozomi found predictable DNS transaction IDs in uClibc/uClibc-ng IoT devices. FIDO “passkeys” sync per-site keys across devices, trading hardware-key security for usability.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What specific mechanism did the FIDO Alliance describe for letting a phone act as a roaming authenticator in the new WebAuthn work discussed in the episode?

Question 1

What specific mechanism did the FIDO Alliance describe for letting a phone act as a roaming authenticator in the new WebAuthn work discussed in the episode?

A cloud relay between the phone and the authenticating device A NFC tap between the phone and the authenticating device A Bluetooth protocol between the phone and the authenticating device A QR code exchange between the phone and the authenticating device

Question 2: In the episode's discussion of FIDO Level 3 and so-called passkeys, what problem is cloud synchronization meant to solve?

Question 2

In the episode's discussion of FIDO Level 3 and so-called passkeys, what problem is cloud synchronization meant to solve?

The need to avoid using usernames when authenticating to websites The need to carry a specialized security key for every login The need to re-enroll or recover credentials when moving to a new device The need to prevent websites from storing public keys after registration

Question 3: What did Steve identify as the key weakness in the newly discovered uClibc/uClibc-ng DNS flaw affecting many embedded IoT devices?

Question 3

What did Steve identify as the key weakness in the newly discovered uClibc/uClibc-ng DNS flaw affecting many embedded IoT devices?

A missing DNSSEC validation step in resolver code A failure to randomize the DNS source address across queries A buffer overflow in the resolver's hostname parsing routine A predictable sequential DNS transaction ID generation method

Question 4: Which exact capability did F5's critical BIG-IP vulnerability expose according to the episode's summary of F5's disclosure?

Question 4

Which exact capability did F5's critical BIG-IP vulnerability expose according to the episode's summary of F5's disclosure?

Unauthenticated network access to execute arbitrary system commands Privilege escalation through a compromised web browser session Authenticated console access to modify only local configuration files Remote packet capture on management interfaces without code execution

Question 5: According to the episode, what was the central architectural compromise in the new passkeys approach compared with the original FIDO direction Steve had worked on?

Question 5

According to the episode, what was the central architectural compromise in the new passkeys approach compared with the original FIDO direction Steve had worked on?

It replaced public-key authentication with one-time passwords over email It gave up on requiring a separate hardware authenticator and instead synchronizes credentials across devices It abandoned cloud syncing in favor of purely local hardware tokens It dropped the requirement for phishing resistance and relied on passwords again

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.