Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID and Touch ID for the Web

developer.apple.com

Post reply on HN
Print view View original

41–50 of 274 posts

Re: Face ID and Touch ID for the Web

#41

Post by monocasa »

lifeisstillgood wrote: post #7

So roughly speaking this is WebAuthn for a web site, with the iphone acting as the dongle. It's a really good idea. I can see there being a big demand for just simplifying signin - I can easily see a time where it is worth not having the hassle of managing multiple signin processes and just choosing webauth or nothing. Edit: to be clear this won't affect B2C sites whose monetisation is based on getting as many people…

Webauthn actually fully supports this model as "platform authenticators", ie hardware security modules built into the client system. You see this on the windows side too where "Windows Hello" integrates with the TPM and acts as a platform authenticator as well.

No need to speak roughly.

Re: Face ID and Touch ID for the Web

#42

Post by thephyber »

_jal wrote: post #9

Going to have to give serious thought to where I will and won't use this. There are a lot of implications - no ability to automate and giving others data on you were provably in front of some machine are two big ones.

From the server side, isn't this just a WebAuth integration?

How does the server know for sure if the client is on an iOS Safari browser on an iPhone with FaceID or a custom browser on any OS and any non-locked-down hardware being run with Selenium?

Re: Face ID and Touch ID for the Web

#43

Post by throw03172019 »

aaomidi wrote: post #19
zuhayeer wrote: post #17

Interesting, Apple is letting you change your default web browser with this new iOS version, but also adding Face ID and Touch ID to Safari. Why would anyone want to build these features if they're so platform / browser specific? Does anyone know if these auth features might work on other browsers on iPhone?

There isn't a reason it wouldn't work - the browsers all use the same engine anyway.

There are some differences between Safari and WKWebView. Some features are blocked.

Re: Face ID and Touch ID for the Web

#44

Post by acdha »

elwell wrote: post #18

1Password users can already have effectively the same experience.

Not as securely or cheaply: using 1Password this way either requires less secure TOTP codes (which are easily phished) or a separate token.

Having this available to every Apple user on the web is huge, especially when you look at the network benefits of the Apple feature pushing all of the slackers (hi, every large financial company!) to implement secure MFA.

Re: Face ID and Touch ID for the Web

#45

Post by marinhero »

EGreg wrote: post #25

Just to state the obvious... Biometric data must always stay on your personal device in order to be secure from replay attacks, not to mention finding out more about you. https://amp.theguardian.com/world/2019/sep/04/smile-to-pay-c... Of course, in Apple’s implementation, the data never leaves the device. Which is far better than, say, how facial recognition is used in China for payment where the merchant is the one…

The video mentions the data never leaves the device and that the transaction is performed in the secure enclave of the phone.

Re: Face ID and Touch ID for the Web

#47

Post by Tepix »

jiveturkey wrote: post #39
duskwuff wrote: post #13

Earlier quoted context omitted.

That's a really interesting point. If this really does allow a web user to prove that a human interacted with the computer, it'd make for a really nice CAPTCHA replacement.

it doesn't do that, since there's no attestation.

Did you watch the video?

Re: Face ID and Touch ID for the Web

#48

Post by acdha »

theboat wrote: post #2

If the web migrates to biometric sensors for authentication, I hope this won't suffer from vendor lock-in. When every new device ships with facial recognition and/or a fingerprint reader, it will be nice to login using my face/fingerprint irrespective of the device I'm on.

This isn't biometric authentication: it's WebAuthn, which is a public-key based system implemented by all major browsers (https://webauthn.io/). This particular implementation uses biometrics to unlock it but other implementations use a contact sensor (Yubikeys) or PIN, and the target website doesn't need to know anything about which particular mechanism was used to unlock the keystore.

Re: Face ID and Touch ID for the Web

#49

Post by mtgp1000 »

empath75 wrote: post #11
mtgp1000 wrote: post #10

No way this biometric data could possibly be abused, right? I'll stick to taping over my cameras, thanks.

it never leaves your phone.

Yeah, and my personal data never left Equifax's servers either.

You can't change your biometrics when they are inevitably hacked. If you even find out.

Re: Face ID and Touch ID for the Web

#50

Post by thowawaymom »

brandonhorst wrote: post #28
BiteCode_dev wrote: post #22

Giving my finger and face prints to the browser, the software with the biggest attack surface in the world, connected to internet no less, feels off to me.

All of that is managed by the Secure Enclave in exactly the same way that it is for all over auth on Apple devices. The browser doesn't touch it at all.

Oh the almighty Secure Enclave, bow down to the Enclave...

Do you even know what the heck an enclave is and how does it work? It's nuts that when a figure of authority uses a fancy shiny new word to describe some magic black box and the masses follow with no questions asked.

Post reply on HN