51–60 of 274 posts
If the web migrates to biometric sensors for authentication, I hope this won't suffer from vendor lock-in. When every new device ships with facial recognition and/or a fingerprint reader, it will be nice to login using my face/fingerprint irrespective of the device I'm on.
I see so many comments mentioning Secure Enclave to any security objection as if it's a panacea. Do you even know what the heck an enclave is and how does it work? It's nuts that when a figure of authority uses a fancy shiny new word to describe some magic black box and the masses follow with no questions asked.
Going to have to give serious thought to where I will and won't use this. There are a lot of implications - no ability to automate and giving others data on you were provably in front of some machine are two big ones.
From the server side, isn't this just a WebAuth integration? How does the server know for sure if the client is on an iOS Safari browser on an iPhone with FaceID or a custom browser on any OS and any non-locked-down hardware being run with Selenium?
Going to have to give serious thought to where I will and won't use this. There are a lot of implications - no ability to automate and giving others data on you were provably in front of some machine are two big ones.
This isn't that revolutionary: LastPass already allows you to use biometric ID to authenticate and it works without any changes to the website.
It also doesn't add any security. Your password can still be guessed or phished. When authenticating with a cryptographic token (U2F/WebAuthn), that vector goes away. (Even OTP can be phished... the phishing site can just ask you for the code.) Password managers do make it more difficult to get phished, since they will not know what password to autofill on phishing.example.com... but on the other hand, password manag…
So roughly speaking this is WebAuthn for a web site, with the iphone acting as the dongle. It's a really good idea. I can see there being a big demand for just simplifying signin - I can easily see a time where it is worth not having the hassle of managing multiple signin processes and just choosing webauth or nothing. Edit: to be clear this won't affect B2C sites whose monetisation is based on getting as many people…
Earlier quoted context omitted.
All of that is managed by the Secure Enclave in exactly the same way that it is for all over auth on Apple devices. The browser doesn't touch it at all.
Oh the almighty Secure Enclave, bow down to the Enclave... Do you even know what the heck an enclave is and how does it work? It's nuts that when a figure of authority uses a fancy shiny new word to describe some magic black box and the masses follow with no questions asked.
1Password users can already have effectively the same experience.
Apple users will get this natively without having to acquire 1Password. If you’ve bought into the Apple ecosystem and don’t have needs outside of it (Windows, Linux), you can eliminate the need for a separate password manager. Similar to how iCloud Files is moving towards (but likely won’t meet, while not needing to) Dropbox parity. This is making a friendly version of Yubikeys (using Apple devices) and password vaul…
Just a happy 1Password user, nut related to them in any way.
I got a Yubikey earlier this year and was disappointed by Apple's implementation of WebAuthn it (doesn't work if there's a PIN on the device) but it looks like they're fixing that as well in iOS 14
Would be nice to have Yubikey replace my password and then allow me to enroll FaceID so I can keep signing back in.
Earlier quoted context omitted.
From the server side, isn't this just a WebAuth integration? How does the server know for sure if the client is on an iOS Safari browser on an iPhone with FaceID or a custom browser on any OS and any non-locked-down hardware being run with Selenium?
Attestation. If a website requests it, the device will provide cryptographic proof that you used a specific vendor’s device to store the resident credential. The proof is a certificate signed with a vendor’s secret attestation key.