Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID and Touch ID for the Web

developer.apple.com

Post reply on HN
Print view View original

31–40 of 274 posts

Re: Face ID and Touch ID for the Web

#31

Post by anon102010 »

BiteCode_dev wrote: post #22

Giving my finger and face prints to the browser, the software with the biggest attack surface in the world, connected to internet no less, feels off to me.

That's not how this works on apple. Basically your fingerprint scan is not sent to the browser, just the authenticated result of the scan (ie, yes, the fingerprint was so and so's).

There have been some past complaints here about how Apple used to tie their fingerprint sensor into the secure element (third party folks couldn't substitute them). I actually liked that rule from a security standpoint, but obviously unpopular here. Same approach with faceid / touchID for the web.

Re: Face ID and Touch ID for the Web

#32

Post by crispyporkbites »

rovr138 wrote: post #8
cgb223 wrote: post #4

Earlier quoted context omitted.

We’d need to have a standard HTML element like or something and let the browser handle mapping it to whatever specific hardware the device is using

The issue is that it's just a token that would simply say Passed/Fail. So it's trusting the client/browser.

If the token is signed you could validate it with Apple (or the vendor that implemented the face recognition on the device, eg Samsung, Nokia, pinephone etc).

You just need an open standard, you could even embed the url of the validating api in the token, so anyone could create their own Face ID provider.

Re: Face ID and Touch ID for the Web

#33

Post by bdcravens »

toomuchtodo wrote: post #21
elwell wrote: post #18

1Password users can already have effectively the same experience.

Apple users will get this natively without having to acquire 1Password. If you’ve bought into the Apple ecosystem and don’t have needs outside of it (Windows, Linux), you can eliminate the need for a separate password manager. Similar to how iCloud Files is moving towards (but likely won’t meet, while not needing to) Dropbox parity. This is making a friendly version of Yubikeys (using Apple devices) and password vaul…

I'm more of a fan of buy-in without lock-in.

Re: Face ID and Touch ID for the Web

#35

Post by MetallicCloud »

toomuchtodo wrote: post #26
chanmad29 wrote: post #23

Earlier quoted context omitted.

so one more instance of Apple effectively rendering a third party app useless. As an apple user, I love that I do not need to install an additional app but something does not feel right from an ethical standpoint. Or maybe I'm just being too touchy.

I would rather have a native UX versus Bitwarden, especially if there’s no additional cost (I have to pay for Bitwarden annually or spend time running a server) and an easy way to share creds with my partner (for delegation in the event of my passing). Competition and a free market has perils. May the best solution win.

You can use Bitwarden for free while using their servers.

Re: Face ID and Touch ID for the Web

#36

Post by abrowne »

aaomidi wrote: post #19
zuhayeer wrote: post #17

Interesting, Apple is letting you change your default web browser with this new iOS version, but also adding Face ID and Touch ID to Safari. Why would anyone want to build these features if they're so platform / browser specific? Does anyone know if these auth features might work on other browsers on iPhone?

There isn't a reason it wouldn't work - the browsers all use the same engine anyway.

If Apple lets other browsers using the engine have access to this feature.

Re: Face ID and Touch ID for the Web

#37

Post by toomuchtodo »

MetallicCloud wrote: post #35
toomuchtodo wrote: post #26

Earlier quoted context omitted.

I would rather have a native UX versus Bitwarden, especially if there’s no additional cost (I have to pay for Bitwarden annually or spend time running a server) and an easy way to share creds with my partner (for delegation in the event of my passing). Competition and a free market has perils. May the best solution win.

You can use Bitwarden for free while using their servers.

Not for family plans, unless something has changed in the last year.

Big fan of these feature being native client side. These are features, not products. We should all be a fan of improved security delivered to as many people as possible, with as little effort on their part.

Re: Face ID and Touch ID for the Web

#38

Post by JimDabell »

adamleithp wrote: post #14

The keynote a few days ago failed to mention FaceID used to opening your mac... and this video shows/mentions FaceID on a macOS11 website? Seems they missed a step here with rolling it out, or are withholding the obvious. I'm assuming the latter.

This video shows Touch ID being used with a laptop, not Face ID.

The interface is generic, so it should use Face ID on devices that have Face ID hardware, and Touch ID on devices that have Touch ID hardware.

Re: Face ID and Touch ID for the Web

#39

Post by jiveturkey »

duskwuff wrote: post #13
_jal wrote: post #9

Going to have to give serious thought to where I will and won't use this. There are a lot of implications - no ability to automate and giving others data on you were provably in front of some machine are two big ones.

That's a really interesting point. If this really does allow a web user to prove that a human interacted with the computer, it'd make for a really nice CAPTCHA replacement.

it doesn't do that, since there's no attestation.

Re: Face ID and Touch ID for the Web

#40

Post by [deleted] »

zuhayeer wrote: post #17

Interesting, Apple is letting you change your default web browser with this new iOS version, but also adding Face ID and Touch ID to Safari. Why would anyone want to build these features if they're so platform / browser specific? Does anyone know if these auth features might work on other browsers on iPhone?

[deleted]
Post reply on HN