Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID and Touch ID for the Web

developer.apple.com

Post reply on HN
Print view View original

101–110 of 274 posts

Re: Face ID and Touch ID for the Web

#101

Post by jodrellblank »

mathisonturing wrote: post #74
throw03172019 wrote: post #43

Earlier quoted context omitted.

There are some differences between Safari and WKWebView. Some features are blocked.

It's funny how much bashing Google gets for monopoly with Android, pushing users to use Chrome, Play Store and whatnot. While all of that is relevant, Apple's stranglehold seems much more and worse.

Apple sells between 10-20% of smartphones per quarter[1], that implies Android makes up 80+% and Windows/Blackberry a neglible amount.

How can Apple be a monopolist from such a small position, or have a "stranglehold" when they are outsold 4-8x by the competition?

[1] https://www.statista.com/statistics/216459/global-market-sha...

Re: Face ID and Touch ID for the Web

#102

Post by jacobr1 »

cactus2093 wrote: post #92
jacobr1 wrote: post #82

This really is just bringing WebAuthn to Safari. I've been using it via chrome w/ TouchID for our corporate okta SSO and it has been working great. WebAuthn is really just a way to make public-key/private-key crypto scale. The user never really knows about or interacts with the keys. The website doesn't store a password, they store a public key. The user doesn't know about the private key (paired to the public key) t…

How does this work if you need to sign in to a site on a borrowed computer while traveling or something? Is the private key derivable from a master password or something?

A few options if you want to maintain MFA:

For my Okta account, they support push notification to their app on my phone as an alternative authentication measure.

Another approach is a bluetooth (or NFC) enabled device (like your phone) that actually caries the private key. When using a borrowed computer, the signed attestation data is shared with the borrowed system, but that can only be used once, since the private key is never transmitted.

So basically you can either have a side-channel to another MFA method, or a relay where you don't need to trust the intermediary beyond the current session.

Re: Face ID and Touch ID for the Web

#104

Post by tialaramex »

sneak wrote: post #89
jacobr1 wrote: post #82

This really is just bringing WebAuthn to Safari. I've been using it via chrome w/ TouchID for our corporate okta SSO and it has been working great. WebAuthn is really just a way to make public-key/private-key crypto scale. The user never really knows about or interacts with the keys. The website doesn't store a password, they store a public key. The user doesn't know about the private key (paired to the public key) t…

To think we could have had this a decade+ ago with TLS client certificates, if web browsers weren't perpetually stuck in the past.

Client certificates suck in a bunch of ways that WebAuthn, specifically designed to solve this problem, does not. Example:

If the certificate used to sign into Hacker News as "sneak" is also used to sign into PornHub then I can correlate that to discern that "sneak" on HN uses PornHub. Whereas you can't do that with WebAuthn credentials - a separate credential is spun up for every single registration, it's completely useless everywhere except the one site it was issued for and can't be correlated to other credentials except via a cryptographic attack on the underlying primitives (ie breaking WebAuthn itself).

Re: Face ID and Touch ID for the Web

#105

Post by Skunkleton »

sirn wrote: post #97
cactus2093 wrote: post #92

Earlier quoted context omitted.

How does this work if you need to sign in to a site on a borrowed computer while traveling or something? Is the private key derivable from a master password or something?

Similar to how you would sign in on devices/browsers without WebAuthn support or don't have physical token (Yubikey/etc.) with you: use a fallback method provided by a website. This is usually TOTP or a scratch code. The website need to implement it though. One thing to keep in mind is this is not supposed to be the only factor required to sign in. It should be used as a 2nd factor in the similar way to TOTP (but wit…

With Okta (since gp mentioned it), you would sign in with a password, then click the "yes its me" button on your phone, or you could use TOTP, or even a yubikey.

Re: Face ID and Touch ID for the Web

#106

Post by vbezhenar »

zuhayeer wrote: post #17

Interesting, Apple is letting you change your default web browser with this new iOS version, but also adding Face ID and Touch ID to Safari. Why would anyone want to build these features if they're so platform / browser specific? Does anyone know if these auth features might work on other browsers on iPhone?

Last time I checked, efficient ad blocking worked only in Safari. If that did not change, it's another reason to stay on Safari.

Re: Face ID and Touch ID for the Web

#107

Post by sirn »

sneak wrote: post #89
jacobr1 wrote: post #82

This really is just bringing WebAuthn to Safari. I've been using it via chrome w/ TouchID for our corporate okta SSO and it has been working great. WebAuthn is really just a way to make public-key/private-key crypto scale. The user never really knows about or interacts with the keys. The website doesn't store a password, they store a public key. The user doesn't know about the private key (paired to the public key) t…

To think we could have had this a decade+ ago with TLS client certificates, if web browsers weren't perpetually stuck in the past.

How would you do the signing part though? Given that most CA don't do client certificate at all, nor it issue certificates with signing flags.

Even if CA does sign client certificate, and website is expected to store its public key, it expose some privacy concerns since a public key is now Personally Identifiable. If a website must provide its own self-signed CA and require user to provide a CSR when registering for an account, then it becomes a huge overhead for both website and user to just login.

I work with enterprise and the requirement usually requires client certificate. I never had a good experience setting it up even with a limited number of parties.

Re: Face ID and Touch ID for the Web

#108

Post by untog »

playpause wrote: post #93
aaomidi wrote: post #19

Earlier quoted context omitted.

There isn't a reason it wouldn't work - the browsers all use the same engine anyway.

This isn't really true any more. Apple requires their competitors' browser apps to use a 'webview' to display websites, and Safari does not use this. The iOS webview may share a layout/paint engine with Safari, but it is heavily restricted in other ways. Apps with webviews (like Chrome for iOS) can't have extensions, for example. But the subtlest, cleverest restriction is that webviews are forced to use an older and…

> But the subtlest, cleverest restriction is that webviews are forced to use an older and slower JavaScript engine.

AFAIK that hasn't been true for years. WKWebView (as opposed to the old UIWebView) lets you use the full speed JS engine.

Re: Face ID and Touch ID for the Web

#109

Post by ryukafalz »

tialaramex wrote: post #104
sneak wrote: post #89

Earlier quoted context omitted.

To think we could have had this a decade+ ago with TLS client certificates, if web browsers weren't perpetually stuck in the past.

Client certificates suck in a bunch of ways that WebAuthn, specifically designed to solve this problem, does not. Example: If the certificate used to sign into Hacker News as "sneak" is also used to sign into PornHub then I can correlate that to discern that "sneak" on HN uses PornHub. Whereas you can't do that with WebAuthn credentials - a separate credential is spun up for every single registration, it's completely…

There's no reason a browser couldn't have generated a new self-signed client certificate for each site, though; the fact that they don't offer that as an option is just a browser design decision.

Re: Face ID and Touch ID for the Web

#110

Post by ThePowerOfFuet »

BiteCode_dev wrote: post #22

Giving my finger and face prints to the browser, the software with the biggest attack surface in the world, connected to internet no less, feels off to me.

You're not giving them to the browser!

https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/app...

Post reply on HN