Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID and Touch ID for the Web

developer.apple.com

Post reply on HN
Print view View original

61–70 of 274 posts

Re: Face ID and Touch ID for the Web

#61

Post by derefr »

thowawaymom wrote: post #52

Oh the almighty Secure Enclave, bow down to the Enclave... I see so many comments mentioning Secure Enclave to any security objection as if it's a panacea. Do you even know what the heck an enclave is and how does it work? It's nuts that when a figure of authority uses a fancy shiny new word to describe some magic black box and the masses follow with no questions asked.

> Do you even know what the heck an enclave is and how does it work?

It's a isolated smart-card-like KMS core within the SoC, that has most smart-card guarantees (e.g. no side-channel attacks; tamper-resistance.)

Re: Face ID and Touch ID for the Web

#63

Post by [deleted] »

blintz wrote: post #53
thephyber wrote: post #42

Earlier quoted context omitted.

From the server side, isn't this just a WebAuth integration? How does the server know for sure if the client is on an iOS Safari browser on an iPhone with FaceID or a custom browser on any OS and any non-locked-down hardware being run with Selenium?

Attestation. If a website requests it, the device will provide cryptographic proof that you used a specific vendor’s device to store the resident credential. The proof is a certificate signed with a vendor’s secret attestation key.

[deleted]

Re: Face ID and Touch ID for the Web

#64

Post by orf »

mtgp1000 wrote: post #49
empath75 wrote: post #11

Earlier quoted context omitted.

it never leaves your phone.

Yeah, and my personal data never left Equifax's servers either. You can't change your biometrics when they are inevitably hacked. If you even find out.

I quite rightly trust Apple more than I trust Equifax.

Re: Face ID and Touch ID for the Web

#65

Post by monocasa »

masklinn wrote: post #56
lifeisstillgood wrote: post #7

So roughly speaking this is WebAuthn for a web site, with the iphone acting as the dongle. It's a really good idea. I can see there being a big demand for just simplifying signin - I can easily see a time where it is worth not having the hassle of managing multiple signin processes and just choosing webauth or nothing. Edit: to be clear this won't affect B2C sites whose monetisation is based on getting as many people…

Is it webauthn or is it once again proprietary tech?

It's webauthn from what I can see.

Re: Face ID and Touch ID for the Web

#66

Post by amluto »

Siira wrote: post #60
blintz wrote: post #53

Earlier quoted context omitted.

Attestation. If a website requests it, the device will provide cryptographic proof that you used a specific vendor’s device to store the resident credential. The proof is a certificate signed with a vendor’s secret attestation key.

Can't the key get stolen if it's on the client?

Yes, but it’s probably stored in the Secure Enclave, so it’ll be hard work.

Re: Face ID and Touch ID for the Web

#67

Post by orf »

thowawaymom wrote: post #50
brandonhorst wrote: post #28

Earlier quoted context omitted.

All of that is managed by the Secure Enclave in exactly the same way that it is for all over auth on Apple devices. The browser doesn't touch it at all.

Oh the almighty Secure Enclave, bow down to the Enclave... Do you even know what the heck an enclave is and how does it work? It's nuts that when a figure of authority uses a fancy shiny new word to describe some magic black box and the masses follow with no questions asked.

Do you know how it works?

Re: Face ID and Touch ID for the Web

#68

Post by xvector »

I think it's pretty ridiculous that Apple pours time and effort into stuff like this but apps have been able to steal from your clipboard for years.

It reminds me of the phenomenon when researchers and engineers don't work on something that's useful for everyday users, instead prioritizing what they find exciting and cool. The security team is so busy dealing with absurd edge cases like nation-states attacking your enclave that they don't seem to care to address egregious and obvious holes in the security model like this.

It's not that WebAuthn and passwordless isn't exciting or useful, it's just that there are much bigger fish to fry (clipboard paste, terrible permissions management, non-shitty VPN support, trackers in apps) that Apple seems completely uninterested in addressing.

There really is no excuse, at least not when you're tooting the privacy/security horn so loudly, but let stuff like this pass by.

Edit: have y'all thought of an actual counterargument instead of just downvoting? Is it really too much to ask security engineers at Apple to focus on actual major privacy holes in their OS than things like this?

Re: Face ID and Touch ID for the Web

#69

Post by bjelkeman-again »

WA wrote: post #58
toomuchtodo wrote: post #21

Earlier quoted context omitted.

Apple users will get this natively without having to acquire 1Password. If you’ve bought into the Apple ecosystem and don’t have needs outside of it (Windows, Linux), you can eliminate the need for a separate password manager. Similar to how iCloud Files is moving towards (but likely won’t meet, while not needing to) Dropbox parity. This is making a friendly version of Yubikeys (using Apple devices) and password vaul…

For interested readers: 1Password does a few more things. For example, you can add 2FA to 1Password logins, so that 1Password replaces Google Authenticator with the immense advantage that you don’t have to setup 2FA again if you get a new device. Just a happy 1Password user, nut related to them in any way.

Thanks I didn’t know this.

Re: Face ID and Touch ID for the Web

#70

Post by monocasa »

mtgp1000 wrote: post #49
empath75 wrote: post #11

Earlier quoted context omitted.

it never leaves your phone.

Yeah, and my personal data never left Equifax's servers either. You can't change your biometrics when they are inevitably hacked. If you even find out.

For all Apple's faults, they're pretty open about how their Secure Enclave works. I think they consider privacy to be a key differentiator, particularly when compared to Android and Windows. you can see this in how they didn't open a phone even given an FBI request.
Post reply on HN