Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID and Touch ID for the Web

developer.apple.com

Post reply on HN
Print view View original

161–170 of 274 posts

Re: Face ID and Touch ID for the Web

#161

Post by barbegal »

jrockway wrote: post #30
barbegal wrote: post #16

This isn't that revolutionary: LastPass already allows you to use biometric ID to authenticate and it works without any changes to the website.

It also doesn't add any security. Your password can still be guessed or phished. When authenticating with a cryptographic token (U2F/WebAuthn), that vector goes away. (Even OTP can be phished... the phishing site can just ask you for the code.) Password managers do make it more difficult to get phished, since they will not know what password to autofill on phishing.example.com... but on the other hand, password manag…

Security seems roughly equivalent, there is always a fallback method of authentication in case the user changes their device or forgets their password. Even biometrics on an iPhone can fall back to a 4 digit pin code.

I agree there are advantages to using public key crypto but the reality is that it's more difficult to get right (and therefore not implemented) compared to a simple hashing function for a password.

Re: Face ID and Touch ID for the Web

#162

Post by gorgoiler »

Isn’t this a classic example of the fragility of biometrics?

If I move to a new device, iOS should be required to give up whatever secret key my face translates to, so I can log into websites.

Simplistically, if iOS silently turned my face into the web password “g0rG0il3r”, when I eventually migrate from iOS to something new, I’ll have to be able take my face password with me, thus exposing that my face was only ever equivalent to a password in the first place?

Re: Face ID and Touch ID for the Web

#163

Post by lstamour »

BillinghamJ wrote: post #159
lstamour wrote: post #153

Earlier quoted context omitted.

WebAuthn is generally about device authentication with credentials that can’t leave the device, though that could change depending on where and how the hardware gets/stores it’s tokens. Or if you rely on a third-party, like Apple, to store the tokens for you and use OAuth with an mfa indicator in the attestation? General advice: If worried about losing a device, try to register more than one. Even iCloud Keychain req…

Not really a problem for me - I keep a set of six CTAP2 keys registered on everything with careful labelling etc. But for normal people, we do need to get more of the balance into the usability side I think. The thing with iCloud Keychain is it can comfortably be recovered without breaking the end-to-end encryption with only a single remaining device, and many Apple users have as many as 3-4 devices in the circle of…

I agree, but it sounds like we’re trying to get the web browser to simplify and implement OAuth2 and OpenID Connect via WebAuthn ... If we already have OpenID Connect, the only advantage to end users under that scenario is a login-with-Apple ease-of-use improvement. Seems more likely that we’ll continue using OAuth2 and OIDC server side for this, for now... but maybe we’ll end up standardizing the ways MFA is requested and presented by providers...

Re: Face ID and Touch ID for the Web

#164

Post by snuxoll »

gorgoiler wrote: post #162

Isn’t this a classic example of the fragility of biometrics? If I move to a new device, iOS should be required to give up whatever secret key my face translates to, so I can log into websites. Simplistically, if iOS silently turned my face into the web password “g0rG0il3r”, when I eventually migrate from iOS to something new, I’ll have to be able take my face password with me, thus exposing that my face was only ever…

WebAuthN is not supposed to be the only way you log into a service. The credentials are permanently tied to your Authenticator of choice, which can be lost or stolen at any time.

If you change devices you just provision the new one for your account after signing in with a traditional username/password(/2nd-factor).

Re: Face ID and Touch ID for the Web

#165

Post by aarongray »

A fingerprint can be a personal password or it can be a government ID, but it can’t be both. Since the U.S. government already has something like 200 million fingerprints on file, and many foreign governments collect fingerprints whenever you travel, these fingerprints are sometimes leaked en masse (https://en.wikipedia.org/wiki/Office_of_Personnel_Management...), and because they can never be changed, biometrics aren't my personal choice for a secure method of authentication.

Re: Face ID and Touch ID for the Web

#166

Post by the_gipsy »

lifeisstillgood wrote: post #7

So roughly speaking this is WebAuthn for a web site, with the iphone acting as the dongle. It's a really good idea. I can see there being a big demand for just simplifying signin - I can easily see a time where it is worth not having the hassle of managing multiple signin processes and just choosing webauth or nothing. Edit: to be clear this won't affect B2C sites whose monetisation is based on getting as many people…

FYI, fingerprint for WebAuthn already worked on Android, I tried it with my pixel phone.

Re: Face ID and Touch ID for the Web

#167

Post by snuxoll »

sirn wrote: post #107
sneak wrote: post #89

Earlier quoted context omitted.

To think we could have had this a decade+ ago with TLS client certificates, if web browsers weren't perpetually stuck in the past.

How would you do the signing part though? Given that most CA don't do client certificate at all, nor it issue certificates with signing flags. Even if CA does sign client certificate, and website is expected to store its public key, it expose some privacy concerns since a public key is now Personally Identifiable. If a website must provide its own self-signed CA and require user to provide a CSR when registering for…

You don’t need a public CA to do client certificate authentication. Hell, your computer doesn’t even need to trust the CA that signed the key - it’s the server on the other end that cares about that.

This is precisely how WebAuthN works - but we figured out that we actually don’t need to go through the headache of getting CAs and signing involved at all. Just store a public key attached to a user after they’ve signed in via traditional means and let the browser/security token manage the keys.

Re: Face ID and Touch ID for the Web

#168

Post by hn_throwaway_99 »

aarongray wrote: post #165

A fingerprint can be a personal password or it can be a government ID, but it can’t be both. Since the U.S. government already has something like 200 million fingerprints on file, and many foreign governments collect fingerprints whenever you travel, these fingerprints are sometimes leaked en masse ( https://en.wikipedia.org/wiki/Office_of_Personnel_Management... ), and because they can never be changed, biometrics a…

But I think you missed the point about the second factor, because there are really 2 factors here:

1. Something you have (e.g. your phone, in this case the Secure Enclave that stores the private key).

2. Something you 'know', e.g. your fingerprint.

Just having the fingerprint itself is not sufficient.

Re: Face ID and Touch ID for the Web

#169

Post by LockAndLol »

jmull wrote: post #149
LockAndLol wrote: post #127

The last I read, if you wanted security then Face ID and Touch ID definitely weren't the way to go. I'd rather see Apple pick up something like SQRL[0] than continue down this path of pseudo-security. They work, but it's like having a half-blind doorman who can't tell if you're wearing a mask or if it's your real face. 0: https://www.grc.com/sqrl/sqrl.htm

> The last I read, if you wanted security then Face ID and Touch ID definitely weren't the way to go. Sounds vague and overly general. I don't think anyone can take this seriously without some more information.

You are but a duck-search away

Face ID defeated with glasses and tape https://appleinsider.com/articles/19/08/08/face-id-security-...

Touch ID defeated by lifted fingerprints

2013: https://arstechnica.com/information-technology/2013/09/defea...

2016: https://appleinsider.com/articles/13/09/22/apples-touch-id-a...

2019: https://www.forbes.com/sites/daveywinder/2019/11/02/smartpho...

Biometric "security" on phones is a gimmick.

Re: Face ID and Touch ID for the Web

#170

Post by bfulgham »

jacobr1 wrote: post #82

This really is just bringing WebAuthn to Safari. I've been using it via chrome w/ TouchID for our corporate okta SSO and it has been working great. WebAuthn is really just a way to make public-key/private-key crypto scale. The user never really knows about or interacts with the keys. The website doesn't store a password, they store a public key. The user doesn't know about the private key (paired to the public key) t…

You should pay special attention to the section about attestation, which is not something that is done in a privacy-focused way without an anonymous attestation authority (which is part of the iOS 14 feature)
Post reply on HN