Does anyone know if iOS devices support multiple users/bio metrics per device and could log a specific user in when they are using a shared device? I'm wondering if this could be used for a shared iPad on a factory floor to log users into their own account on our web app.
Face ID and Touch ID for the Web
81–90 of 274 posts
Re: Face ID and Touch ID for the Web
#82This really is just bringing WebAuthn to Safari. I've been using it via chrome w/ TouchID for our corporate okta SSO and it has been working great.
WebAuthn is really just a way to make public-key/private-key crypto scale. The user never really knows about or interacts with the keys.
The website doesn't store a password, they store a public key.
The user doesn't know about the private key (paired to the public key) they just know how to unlock the private key via the yubikey or biometric device.
The site sends some data to the user to sign, and they do so with the private key, then the site verifies the data was signed by the private key, boom: authenticated.
Re: Face ID and Touch ID for the Web
#83Earlier quoted context omitted.
Yeah, and my personal data never left Equifax's servers either. You can't change your biometrics when they are inevitably hacked. If you even find out.
For all Apple's faults, they're pretty open about how their Secure Enclave works. I think they consider privacy to be a key differentiator, particularly when compared to Android and Windows. you can see this in how they didn't open a phone even given an FBI request.
They didn't develop the capability to backdoor phones at the FBI's request.
They are generally happy to hand over iCloud backups, which they did in that case and the FBI "lost" them IIRC.
It was also an iPhone 5c, the last iPhone without a Secure Enclave, I believe they were able to get in with GrayKey.
Re: Face ID and Touch ID for the Web
#84Does anyone know if iOS devices support multiple users/bio metrics per device and could log a specific user in when they are using a shared device? I'm wondering if this could be used for a shared iPad on a factory floor to log users into their own account on our web app.
It's not really supported for Face ID - you can create an "alternate appearance" for Face ID but it doesn't work well if the people look very different. With TouchID you can register fingers from different people and it works fairly well, but again not really supported.
Re: Face ID and Touch ID for the Web
#85Oh the almighty Secure Enclave, bow down to the Enclave... I see so many comments mentioning Secure Enclave to any security objection as if it's a panacea. Do you even know what the heck an enclave is and how does it work? It's nuts that when a figure of authority uses a fancy shiny new word to describe some magic black box and the masses follow with no questions asked.
Re: Face ID and Touch ID for the Web
#86Interesting, Apple is letting you change your default web browser with this new iOS version, but also adding Face ID and Touch ID to Safari. Why would anyone want to build these features if they're so platform / browser specific? Does anyone know if these auth features might work on other browsers on iPhone?
It appears to be the WebAuthn standard (based on a quick look at the video so far) and so implementing it would enable you to leverage other Webauthn targets as well, not just on iPhone but on Windows devices and more.
Re: Face ID and Touch ID for the Web
#87So roughly speaking this is WebAuthn for a web site, with the iphone acting as the dongle. It's a really good idea. I can see there being a big demand for just simplifying signin - I can easily see a time where it is worth not having the hassle of managing multiple signin processes and just choosing webauth or nothing. Edit: to be clear this won't affect B2C sites whose monetisation is based on getting as many people…
Is it webauthn or is it once again proprietary tech?
The video explicitly mentioned it is WebAuthn Platform Authenticator (1:54)[1].
[1]: https://www.w3.org/TR/webauthn/#platform-authenticators
Re: Face ID and Touch ID for the Web
#88Going to have to give serious thought to where I will and won't use this. There are a lot of implications - no ability to automate and giving others data on you were provably in front of some machine are two big ones.
From the server side, isn't this just a WebAuth integration? How does the server know for sure if the client is on an iOS Safari browser on an iPhone with FaceID or a custom browser on any OS and any non-locked-down hardware being run with Selenium?
The question is more along the lines of: does this provide more security than passwords for real users?
Stealing a password is probably more easily done than stealing a private key that is never transmitted. The primary threat model is protecting the credentials of real users rather than protecting against fraudulent users (though some considerations have been made for that too).
Re: Face ID and Touch ID for the Web
#89This really is just bringing WebAuthn to Safari. I've been using it via chrome w/ TouchID for our corporate okta SSO and it has been working great. WebAuthn is really just a way to make public-key/private-key crypto scale. The user never really knows about or interacts with the keys. The website doesn't store a password, they store a public key. The user doesn't know about the private key (paired to the public key) t…
To think we could have had this a decade+ ago with TLS client certificates, if web browsers weren't perpetually stuck in the past.
Re: Face ID and Touch ID for the Web
#90I got a Yubikey earlier this year and was disappointed by Apple's implementation of WebAuthn it (doesn't work if there's a PIN on the device) but it looks like they're fixing that as well in iOS 14
I'm hoping it works with NFC and not just the lightning one. Would be nice to have Yubikey replace my password and then allow me to enroll FaceID so I can keep signing back in.
The current Yubikey works with NFC on iOS, it just doesn't work if you add a PIN to it (which Windows Hello requires). They mention that they added PIN support in the changelog