There's surprising support here for the faceid stuff, despite it's clearly made to normalize using biometric data for everything and make one step towards the survelliance state. But let's pretend we are more concerned with security of this approach: how is it better than a ring with a chip you'd wear and use for auth? If this identity is compromised, you could just get another ring. And you wouldn't need to give your real identity to apple.
Face ID and Touch ID for the Web
221–230 of 274 posts
Re: Face ID and Touch ID for the Web
#222Face or finger data is akin a login name... What is the password in that case? Because if you cant change your password, that could be a problem
The biometric data never leaves your device. Your biometric is only used to unlock a private key stored in the secure enclave of your phone. This private key is then used to sign a server-sent challenge. The phone sends this signed challenge back to the server, where the server can validate it using the public key.
The public/private key gets generated by the phone upon first registration with the server.
Re: Face ID and Touch ID for the Web
#223There's surprising support here for the faceid stuff, despite it's clearly made to normalize using biometric data for everything and make one step towards the survelliance state. But let's pretend we are more concerned with security of this approach: how is it better than a ring with a chip you'd wear and use for auth? If this identity is compromised, you could just get another ring. And you wouldn't need to give you…
All biometric processing happens locally. You aren't sending your fingerprint or face, they simply unlock the private key in the enclave.
Re: Face ID and Touch ID for the Web
#224There's surprising support here for the faceid stuff, despite it's clearly made to normalize using biometric data for everything and make one step towards the survelliance state. But let's pretend we are more concerned with security of this approach: how is it better than a ring with a chip you'd wear and use for auth? If this identity is compromised, you could just get another ring. And you wouldn't need to give you…
> How is it better than a ring with a chip you'd wear and use for auth?
Normal people would actually use it. And this is in fact not different. The phone IS the ring. You just unlock it using your biometrics (and of course, the data is NOT given to Apple)
Re: Face ID and Touch ID for the Web
#225Earlier quoted context omitted.
Webauthn actually fully supports this model as "platform authenticators", ie hardware security modules built into the client system. You see this on the windows side too where "Windows Hello" integrates with the TPM and acts as a platform authenticator as well. No need to speak roughly.
* you don't need the TPM for Windows Hello to act as your security key. I can't enable BitLocker because there's no TPM yet I have Hello enrolled as a key for GH.
You can use BitLocker with just a password, not sure why you're implying you need a TPM.
Re: Face ID and Touch ID for the Web
#226I wonder how these face detection algorithms work for transgender folks...
Have transgender people had issues with FaceID?
Re: Face ID and Touch ID for the Web
#227Earlier quoted context omitted.
Yeah, and my personal data never left Equifax's servers either. You can't change your biometrics when they are inevitably hacked. If you even find out.
For all Apple's faults, they're pretty open about how their Secure Enclave works. I think they consider privacy to be a key differentiator, particularly when compared to Android and Windows. you can see this in how they didn't open a phone even given an FBI request.
This personally identifying data is forever one forced update away from abuse. The fact that it's "normal" to take such a risk for such a minor convenience does not mean that it's a good idea.
But I recognize that not everyone is so paranoid. Though in the current political climate, where corporations are clearly choosing sides, you probably should be.
Re: Face ID and Touch ID for the Web
#228So roughly speaking this is WebAuthn for a web site, with the iphone acting as the dongle. It's a really good idea. I can see there being a big demand for just simplifying signin - I can easily see a time where it is worth not having the hassle of managing multiple signin processes and just choosing webauth or nothing. Edit: to be clear this won't affect B2C sites whose monetisation is based on getting as many people…
I can't find docs - but I assume one can authenticate with only their laptop. Most new ones have fingerprint already and likely they will bring FaceID to mac os soon
Re: Face ID and Touch ID for the Web
#229FaceID is one of the most important technology invented. Imagine if Apple somehow was open to license it and make it universal like Bill Gates wanted to make PCs universal. It can make driver licenses, passports, credit cards, student IDs, insurance IDs - all of these can be things of past. You go to grocery store and simply pay using your face. You want to pay online? Simply look at FaceID device that is now standard with all new computers sold. This is 100s of billions worth of business to make so much legacy gone. Security and identity is now (hopefully) solved but unfortunately still all behind walled garden.
Re: Face ID and Touch ID for the Web
#230FaceID is one of the most important technology invented. Imagine if Apple somehow was open to license it and make it universal like Bill Gates wanted to make PCs universal. It can make driver licenses, passports, credit cards, student IDs, insurance IDs - all of these can be things of past. You go to grocery store and simply pay using your face. You want to pay online? Simply look at FaceID device that is now standar…
Why did fingerprinting never catch on in that way? That tech has existed for ages. Way cheaper to implement as well. Seems like it would also be less prone to false positives compared to facial recognition, but that’s just speculation on my part.