Sometimes it feels like I'm the only one that doesn't trust biometric sensors. I mean it's basically magic. If for any reason the face detection algorithm doesnt match your face anymore you have the equivalent problem of losing the master password to your entire password store.
Face ID and Touch ID for the Web
211–220 of 274 posts
Re: Face ID and Touch ID for the Web
#212The last I read, if you wanted security then Face ID and Touch ID definitely weren't the way to go. I'd rather see Apple pick up something like SQRL[0] than continue down this path of pseudo-security. They work, but it's like having a half-blind doorman who can't tell if you're wearing a mask or if it's your real face. 0: https://www.grc.com/sqrl/sqrl.htm
On Android any way you've set up to unlock the device can be used to also authenticate locally for unlocking the key material (stored inside a TEE): swipe pattern, finger print, PIN code, password, etc. Once that is done the key material is used with WebAuthn protocol which is fairly straightforward public key crypto operations that have been well vetted.
Based on this video we don't know exactly if Apple allows that to be done as well, but it seems within the realm of possibility based on how Apple Pay works (which AFAIK can use a passcode).
Either way discarding the entire protocol because of one implementation is silly. With Apple joining Google, Microsoft and many other companies supporting WebAuthn (a W3C standard) there's a lot of support for it to make logging in easier and more secure. SQRL never got any real traction.
Re: Face ID and Touch ID for the Web
#213Earlier quoted context omitted.
Webauthn actually fully supports this model as "platform authenticators", ie hardware security modules built into the client system. You see this on the windows side too where "Windows Hello" integrates with the TPM and acts as a platform authenticator as well. No need to speak roughly.
Yup. A site can even say "I want a platform authenticator" or "I specifically don't want a platform authenticator" during registration using the Javascript API. Most sites should just not care, but it's an option if you've determined there's a specific reason it matters in your application.
> A site can even say "I want a platform authenticator" or "I specifically don't want a platform authenticator" during registration using the Javascript API.
Websites should not depend on JavaScript for something that should be able to be done declaratively.
(Amongst other things - we shouldn't need to use `fetch`/`XMLHttpRequest` when a would work just-as-well - but if only let us use more than just GET and POST, and supported more types of serialization, and supported asynchronous form submission - and bring back !).
Re: Face ID and Touch ID for the Web
#214Earlier quoted context omitted.
It also doesn't add any security. Your password can still be guessed or phished. When authenticating with a cryptographic token (U2F/WebAuthn), that vector goes away. (Even OTP can be phished... the phishing site can just ask you for the code.) Password managers do make it more difficult to get phished, since they will not know what password to autofill on phishing.example.com... but on the other hand, password manag…
WebAuthn is less phishing resistant than it should be. The original intent was that WebAuthn + token binding would ensure that, even if an attacker obtained a fraudulent certificate for a victim site and had an MITM position on the network, the attacker still couldn’t steal a WebAuthn protected session. Alas, Chrome removes its token binding implementation, and WebAuthn no longer has this property. If you authenticat…
AFAIK Microsoft added token binding back in the Edge version based on Chromium. As other commenters pointed out, token binding is still part of the WebAuthn spec.
Re: Face ID and Touch ID for the Web
#215Earlier quoted context omitted.
Apple sells between 10-20% of smartphones per quarter[1], that implies Android makes up 80+% and Windows/Blackberry a neglible amount. How can Apple be a monopolist from such a small position, or have a "stranglehold" when they are outsold 4-8x by the competition? [1] https://www.statista.com/statistics/216459/global-market-sha...
Monopolies have nothing to with world markets. There is no world government. Apple has a 49-60% share in the USA. Their next biggest competitor is Samsung with less than 1/2 of that.
Monopolies have nothing much to do with government, they're about being the only provider in a market. If Apple controls less than half, they're not the only provider even within the US, and that only makes it weird for you to say - effectively - only the US matters, other countries don't.
Google controls Android which Samsung use, and the terms on which they're allowed to use it if they still want to allow Google apps. That means it's not Samsung vs Apple, it's Google vs Apple, especially when my reply was to someone comparing Google to Apple, not Samsung to Apple.
Re: Face ID and Touch ID for the Web
#216I wonder how these face detection algorithms work for transgender folks...
Re: Face ID and Touch ID for the Web
#217Unfortunately Face ID has become much less useful since many of us began using face masks. I wish I had touch ID back on my iPhone.
Re: Face ID and Touch ID for the Web
#218Sometimes it feels like I'm the only one that doesn't trust biometric sensors. I mean it's basically magic. If for any reason the face detection algorithm doesnt match your face anymore you have the equivalent problem of losing the master password to your entire password store.
It's a little different, I think.
You could have it set up where your face is the one-and-only thing that identifies you, but that doesn't seem to be the case in practice.
Instead, we have the multipart authentication used in many places today: something you know (password), something you are (biometric fingerprint/face), and something you have (your physical device, your email account, your phone number).
Any one of these has downsides (stolen password, biometric misidentification or duplication, redirected phone number) but in combination with the others makes it much harder to circumvent authentication.
Almost all systems have some kind of fallback that rely on a 'something you know' like a master password, and can optionally only be changed if you have other authentication methods (like physically having the device in your hands).
Having multipart authentication allows for a better user experience (look at your phone and it unlocks) with an acceptable amount of risk (you have to have your phone and be you in order to unlock it), with systems to fallback to if something fails (get the super secret password off that slip of paper you hid in your mother-in-laws garden shed behind the loose brick in the wall). The typcial authentication flows are both more secure and more convenient, and the user is responsible for the security of the backup.
Re: Face ID and Touch ID for the Web
#219Earlier quoted context omitted.
Monopolies have nothing to with world markets. There is no world government. Apple has a 49-60% share in the USA. Their next biggest competitor is Samsung with less than 1/2 of that.
Monopolies have nothing much to do with government, they're about being the only provider in a market. If Apple controls less than half, they're not the only provider even within the US, and that only makes it weird for you to say - effectively - only the US matters, other countries don't. Google controls Android which Samsung use, and the terms on which they're allowed to use it if they still want to allow Google ap…
It is not Google vs Apple. No court would take that case. Google hardly has any market share of phones (Pixel) and Apple doesn't sell OSes
Apple and Samsung are in direct competition. Apple has >50% of the smartphone market in the USA. Samsung has less then 25%, every one else has even less. Google has The rest of the world has its own markets. If the UK wants to sue Apple or Google for being a monopoly they only care about the UK market, not how it's selling in Indonesia. In other words it doesn't matter one wit if some company has a large market share in the world, monopolies are only enforced in a specific country for that country's market, not the world market. You quote iOS has only have 20%, but as that is a world wide number it's entirely irrelevant and pointless. If iOS had 100% market share in Singapore but only 5% marketshare in the world it would be Singapore suing because of the Singapore market. There is no one who can sue on behalf of the world.
Re: Face ID and Touch ID for the Web
#220Earlier quoted context omitted.
With passwords, the "proof" or "attestation" is that nobody knows my secret password. In practice this tends to be weak. Some reasons this is so includes: - the password is low-entropy/complexity, so it is guessable or brute-forcible. - the password is typed into the system, so keyloggers might observe it - the password might be stored insecurity by the server - the password is transmitted over the network and might…
Sure but how is that different from JUST logging in with touchID or faceID? Without attestation?
If you don't have attestation, then I can write some JavaScript code that "return true" for the authentication callback, and log into any and every account.