Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID and Touch ID for the Web

developer.apple.com

Post reply on HN
Print view View original

191–200 of 274 posts

Re: Face ID and Touch ID for the Web

#191

Post by dwaite »

sirn wrote: post #97
cactus2093 wrote: post #92

Earlier quoted context omitted.

How does this work if you need to sign in to a site on a borrowed computer while traveling or something? Is the private key derivable from a master password or something?

Similar to how you would sign in on devices/browsers without WebAuthn support or don't have physical token (Yubikey/etc.) with you: use a fallback method provided by a website. This is usually TOTP or a scratch code. The website need to implement it though. One thing to keep in mind is this is not supposed to be the only factor required to sign in. It should be used as a 2nd factor in the similar way to TOTP (but wit…

Web Authentication does support being the only authentication mechanism, since it is in itself multi factor (in this case, physical possession of the phone and biometric confirmation)

Re: Face ID and Touch ID for the Web

#192

Post by macintux »

pram wrote: post #186
philsnow wrote: post #160

Earlier quoted context omitted.

ios/macos already let you copy/paste between them if you have bluetooth enabled on both sides and are signed in the same icloud account on both. I wonder if they're planning to let me authenticate/webauthn on macos using my phone as a platform authenticator?

The magical cross device copy and paste is one of my favorite unsung features.

Unfortunately it’s been a little finicky for me, but when it works, it’s a great tool.

Re: Face ID and Touch ID for the Web

#194

Post by xvector »

loljabab wrote: post #183
xvector wrote: post #68

I think it's pretty ridiculous that Apple pours time and effort into stuff like this but apps have been able to steal from your clipboard for years. It reminds me of the phenomenon when researchers and engineers don't work on something that's useful for everyday users, instead prioritizing what they find exciting and cool. The security team is so busy dealing with absurd edge cases like nation-states attacking your e…

They just pushed clipboard usage detection as a feature in the new iOS... I think this addresses pasteboard concerns in a decent way, no?

Not at all. Detection doesn't stop the compromise once it has occurred. And given that many major apps use this functionality, it's not like users can really do anything about it even if they get that notification.

Re: Face ID and Touch ID for the Web

#195

Post by modeless »

monocasa wrote: post #147
Dahoon wrote: post #136

Earlier quoted context omitted.

They could encrypt everything and not have the keys. So not really.

The whole point of the backup is that you'll be able to access it even if you your device and it's keystore are destroyed.

And end-to-end encryption doesn't have to break that: https://security.googleblog.com/2018/10/google-and-android-h...

Re: Face ID and Touch ID for the Web

#196

Post by xvector »

_fzslm wrote: post #139
xvector wrote: post #68

I think it's pretty ridiculous that Apple pours time and effort into stuff like this but apps have been able to steal from your clipboard for years. It reminds me of the phenomenon when researchers and engineers don't work on something that's useful for everyday users, instead prioritizing what they find exciting and cool. The security team is so busy dealing with absurd edge cases like nation-states attacking your e…

i don't want to focus too much on why i think you're being downvoted but i would say it's probably because your message came across as quite reductive. > engineers don't work on something that's useful for everyday users, instead prioritizing what they find exciting and cool i get this, to some extent. i really do. but i don't think WebAuthn, sign in with apple, ios 14's recent microphone and camera usage indicators,…

> i don't think WebAuthn, sign in with apple, ios 14's recent microphone and camera usage indicators, etc. are not huge steps forward in terms of mobile privacy & security.

For sure, but they are far less needed than the described issues. You see, the problem is that these holes have existed in iOS for a long time and affect the practical security of the everyday users.

WebAuthn is definitely the future of the web, but why can't we fix the giant holes in the ground before building upon it?

This goes back to the problem of researchers focusing on things that are exciting and will be the future, but not focusing on the needs of the everyday customer. This was the downfall of RCA back in the day.

> Apple is in the business of juggling user experience and privacy. it's quite difficult, because you don't want to get in the way of the user's intents

I understand this struggle. Still, most users are horrified when they learn that everything they've ever copied has been shared with the apps they are using. Even the layperson would gladly give up some trivial auto-paste feature if they knew this.

I would understand Apple's slowness to respond if this was a recent issue, a newly-discovered hole in privacy. But this is a big thing. It's been around for years. And many others have too.

Apple has engineers, they have PMs, and those engineers and PMs are working in the same problem space with these holes. But new features that won't matter for years are being prioritized over major issues that have existed for years, and that's not cool, not when you are yelling that you care about privacy from a mountaintop.

Re: Face ID and Touch ID for the Web

#197

Post by monocasa »

modeless wrote: post #195
monocasa wrote: post #147

Earlier quoted context omitted.

The whole point of the backup is that you'll be able to access it even if you your device and it's keystore are destroyed.

And end-to-end encryption doesn't have to break that: https://security.googleblog.com/2018/10/google-and-android-h...

That's not end to end encryption, the key is stored in a HSM in Google's data center in that case. They can be subpoenaed for it.

Re: Face ID and Touch ID for the Web

#198

Post by greggman3 »

jodrellblank wrote: post #101
mathisonturing wrote: post #74

Earlier quoted context omitted.

It's funny how much bashing Google gets for monopoly with Android, pushing users to use Chrome, Play Store and whatnot. While all of that is relevant, Apple's stranglehold seems much more and worse.

Apple sells between 10-20% of smartphones per quarter[1], that implies Android makes up 80+% and Windows/Blackberry a neglible amount. How can Apple be a monopolist from such a small position, or have a "stranglehold" when they are outsold 4-8x by the competition? [1] https://www.statista.com/statistics/216459/global-market-sha...

Monopolies have nothing to with world markets. There is no world government.

Apple has a 49-60% share in the USA. Their next biggest competitor is Samsung with less than 1/2 of that.

Re: Face ID and Touch ID for the Web

#199

Post by greggman3 »

acdha wrote: post #44
elwell wrote: post #18

1Password users can already have effectively the same experience.

Not as securely or cheaply: using 1Password this way either requires less secure TOTP codes (which are easily phished) or a separate token. Having this available to every Apple user on the web is huge, especially when you look at the network benefits of the Apple feature pushing all of the slackers (hi, every large financial company!) to implement secure MFA.

How are TOTP codes more phishable? Seems like the same phishability to me

Re: Face ID and Touch ID for the Web

#200

Post by bfulgham »

tialaramex wrote: post #132
EGreg wrote: post #103

What exactly does attestation do vs not having it? Can someone here explain clearly?

The attestation is a signed (digital) document saying basically "We are $manufacturer and we made this $product and we promise it has these desirable security properties". In WebAuthn the design is that a batch of (at least 1000 but usually far more) authenticator products should have such a document which Javascript can optionally request (together with proof they didn't just knock it off from another authenticator)…

The point of the video was that when using the device as the authenticator, attestation reveals details of the phone (such as the unique private key used to prove the phone is valid to a manufacturer). The anonymous attestation authority here allows Apple to be assert to the qualities of the device without the device having to reveal identifiers externally.

This is akin to a batch of identifiers the size of all Apple products, while still allowing the device owner (or Apple) to disavow a particular device if it is lost or stolen.

The implementation also ensures that the same device creating multiple identities for the same website will have no signing characteristics linking one account to the other.

Post reply on HN