Earlier quoted context omitted.
All of that is managed by the Secure Enclave in exactly the same way that it is for all over auth on Apple devices. The browser doesn't touch it at all.
Oh the almighty Secure Enclave, bow down to the Enclave... Do you even know what the heck an enclave is and how does it work? It's nuts that when a figure of authority uses a fancy shiny new word to describe some magic black box and the masses follow with no questions asked.
Face ID and Touch ID for the Web
111–120 of 274 posts
Re: Face ID and Touch ID for the Web
#112Earlier quoted context omitted.
All of that is managed by the Secure Enclave in exactly the same way that it is for all over auth on Apple devices. The browser doesn't touch it at all.
Oh the almighty Secure Enclave, bow down to the Enclave... Do you even know what the heck an enclave is and how does it work? It's nuts that when a figure of authority uses a fancy shiny new word to describe some magic black box and the masses follow with no questions asked.
pretty straightforward to understand: https://support.apple.com/guide/security/secure-enclave-over...
Re: Face ID and Touch ID for the Web
#113This really is just bringing WebAuthn to Safari. I've been using it via chrome w/ TouchID for our corporate okta SSO and it has been working great. WebAuthn is really just a way to make public-key/private-key crypto scale. The user never really knows about or interacts with the keys. The website doesn't store a password, they store a public key. The user doesn't know about the private key (paired to the public key) t…
To think we could have had this a decade+ ago with TLS client certificates, if web browsers weren't perpetually stuck in the past.
You have the blame misattributed: almost nobody used client certificates because they cost money ($100+/year). That meant there was little demand outside of a few spaces like government and absent usage there was not much pressure on the UI improvements.
Client certificates are also worse for privacy and phishing resistance: with a certificate, if I can convince you to click on a link I get your identity. From the site's perspective, I don't have any way to tell whether the person with the certificate is the same person I saw or the person who compromised their computer or convinced a CA to issue a cert for someone else. Requiring key storage to be on a hardware enclave significantly reduces that risk, allows for the stronger attestation requirements mentioned, and also means that you're changing things from “trust anyone who can get a CA certificate” to “trust anyone who can do signatures from a previously-registered hardware key”.
Re: Face ID and Touch ID for the Web
#114I miss touch id. Face ID is one of my least favorite things apple has done
Re: Face ID and Touch ID for the Web
#115Earlier quoted context omitted.
Apple users will get this natively without having to acquire 1Password. If you’ve bought into the Apple ecosystem and don’t have needs outside of it (Windows, Linux), you can eliminate the need for a separate password manager. Similar to how iCloud Files is moving towards (but likely won’t meet, while not needing to) Dropbox parity. This is making a friendly version of Yubikeys (using Apple devices) and password vaul…
so one more instance of Apple effectively rendering a third party app useless. As an apple user, I love that I do not need to install an additional app but something does not feel right from an ethical standpoint. Or maybe I'm just being too touchy.
You feel that way because it's ethically corrupt behaviour on the part of Apple. They are aggressively pushing out others.
Re: Face ID and Touch ID for the Web
#116My company recently started using Okta. This is the first time I've heard of webAuthn. Is there any relationship between Okta and WebAuthn?
Re: Face ID and Touch ID for the Web
#117Earlier quoted context omitted.
Do you know how it works?
That's the point , not many do
This might help: https://www.blackhat.com/docs/us-16/materials/us-16-Mandt-De...
Re: Face ID and Touch ID for the Web
#118Earlier quoted context omitted.
For all Apple's faults, they're pretty open about how their Secure Enclave works. I think they consider privacy to be a key differentiator, particularly when compared to Android and Windows. you can see this in how they didn't open a phone even given an FBI request.
They didn't develop the capability to backdoor phones at the FBI's request. They are generally happy to hand over iCloud backups, which they did in that case and the FBI "lost" them IIRC. It was also an iPhone 5c, the last iPhone without a Secure Enclave, I believe they were able to get in with GrayKey.
> They are generally happy to hand over iCloud backups
That one they legally have to do when given a subpoena.
Re: Face ID and Touch ID for the Web
#119Earlier quoted context omitted.
Client certificates suck in a bunch of ways that WebAuthn, specifically designed to solve this problem, does not. Example: If the certificate used to sign into Hacker News as "sneak" is also used to sign into PornHub then I can correlate that to discern that "sneak" on HN uses PornHub. Whereas you can't do that with WebAuthn credentials - a separate credential is spun up for every single registration, it's completely…
There's no reason a browser couldn't have generated a new self-signed client certificate for each site, though; the fact that they don't offer that as an option is just a browser design decision.
...which means a login is now tied to a browser, and you have to come up with a way to securely export or sync private key (bad idea?) or a way to link another browser to a login. Also user losing access to all their websites by accidentally uninstalling a browser doesn't sounds very user friendly.
Re: Face ID and Touch ID for the Web
#120Earlier quoted context omitted.
For interested readers: 1Password does a few more things. For example, you can add 2FA to 1Password logins, so that 1Password replaces Google Authenticator with the immense advantage that you don’t have to setup 2FA again if you get a new device. Just a happy 1Password user, nut related to them in any way.
Is it really 2FA if your password and your token are on the same device?
Yes. 2FA protects, among other things, against compromised passwords. Having both on the same device does not reduce this protection.