Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID and Touch ID for the Web

developer.apple.com

Post reply on HN
Print view View original

261–270 of 274 posts

Re: Face ID and Touch ID for the Web

#261

Post by jacobr1 »

raxxorrax wrote: post #235
jacobr1 wrote: post #82

This really is just bringing WebAuthn to Safari. I've been using it via chrome w/ TouchID for our corporate okta SSO and it has been working great. WebAuthn is really just a way to make public-key/private-key crypto scale. The user never really knows about or interacts with the keys. The website doesn't store a password, they store a public key. The user doesn't know about the private key (paired to the public key) t…

I think some unlikely security scenarios are neglected though. You trust you platform to keep your private keys safe and it requires you to trust is. A vulnerability here would compromise your whole identity if private keys can be extracted. I don't yet believe that to be impossible. Will solve common problems like fishing though.

It probably isn't impossible, but it is made much harder with use of separate hardware, be that a physical key or secure enclave. A fully compromised laptop still can't get the private keys in a "perfect" system. Of course, the hardware might have design defects, or some debug feature to get private keys that shouldn't have been shipped in production build, or government mandated backdoor, etc ... But it now requires a compromise of both the client system AND their hardware keystore.

Re: Face ID and Touch ID for the Web

#262

Post by ViViDboarder »

vbezhenar wrote: post #106
zuhayeer wrote: post #17

Interesting, Apple is letting you change your default web browser with this new iOS version, but also adding Face ID and Touch ID to Safari. Why would anyone want to build these features if they're so platform / browser specific? Does anyone know if these auth features might work on other browsers on iPhone?

Last time I checked, efficient ad blocking worked only in Safari. If that did not change, it's another reason to stay on Safari.

How do you mean? I use Focus and Safari is configured to use Focus as its content blocker. Is there some way Safari uses Focus better than Focus does?

Re: Face ID and Touch ID for the Web

#263

Post by modeless »

monocasa wrote: post #251
modeless wrote: post #241

Earlier quoted context omitted.

I don't think you understand what the HSM does. By design, the HSM's secret keys cannot be extracted. Not by the physical possessor of the HSM, nor the manufacturer, nor designer. That is the whole point of using an HSM for this. A subpoena cannot compel the impossible.

Nearly all HSMs that store an arbitrary number of keys can be compelled to dump those keys via a special firmware update from the manufacturer of the HSM, or at very least remove checks to allow it to be used as a decryption oracle. Apple was able to say no, because they weren't in physical possession of the HSM, which meant that they couldn't be subpoenaed for information that wasn't actually in their possession, bu…

The firmware on these chips erases the keys before applying firmware updates. I encourage you to read the detailed information available rather than just making assumptions about it, or even just the short blog post I linked which states this explicitly.

In the San Bernadino case the FBI had physical possession of the HSM, so Apple could have attacked it physically. That's not related to the reasons why the FBI gave up on that case.

Re: Face ID and Touch ID for the Web

#264

Post by monocasa »

modeless wrote: post #263
monocasa wrote: post #251

Earlier quoted context omitted.

Nearly all HSMs that store an arbitrary number of keys can be compelled to dump those keys via a special firmware update from the manufacturer of the HSM, or at very least remove checks to allow it to be used as a decryption oracle. Apple was able to say no, because they weren't in physical possession of the HSM, which meant that they couldn't be subpoenaed for information that wasn't actually in their possession, bu…

The firmware on these chips erases the keys before applying firmware updates. I encourage you to read the detailed information available rather than just making assumptions about it, or even just the short blog post I linked which states this explicitly. In the San Bernadino case the FBI had physical possession of the HSM, so Apple could have attacked it physically. That's not related to the reasons why the FBI gave…

> The firmware on these chips erases the keys before firmware updates. I encourage you to read the detailed information available rather than just making assumptions about it, or even just the short blog post I linked which states this explicitly.

I read the blog post _and_ the third party security audit. The audit only documents that rogue actors within Google would leave a attestation trail if they tried to push malicious firmware and be noticed by Google proper. My concern isn't rogue actors but Google itself. Additionally the Titan chip in my pixel has received firmware updates without wiping it's storage.

> In the San Bernadino case the FBI had physical possession of the HSM, so Apple could have attacked it physically. That's not related to the reasons why the FBI gave up on that case.

Right, so the legal distinction between "we want a piece of information in your possession that you have decided to lock from yourself" versus "we want your help receiving information that we have in our possession but can't access" is a very very big difference from a warrant perspective.

Re: Face ID and Touch ID for the Web

#265

Post by monocasa »

EE84M3i wrote: post #232
monocasa wrote: post #41

Earlier quoted context omitted.

Webauthn actually fully supports this model as "platform authenticators", ie hardware security modules built into the client system. You see this on the windows side too where "Windows Hello" integrates with the TPM and acts as a platform authenticator as well. No need to speak roughly.

Is this how passwords.google.com prompts me with my Android phone lock when I want to access a password in plaintext? I've always wondered that.

I think that's a custom pathway but built on the same primitives. That being said, I'm not 100% on that.

Re: Face ID and Touch ID for the Web

#266

Post by gmantg »

threentaway wrote: post #223
gmantg wrote: post #221

There's surprising support here for the faceid stuff, despite it's clearly made to normalize using biometric data for everything and make one step towards the survelliance state. But let's pretend we are more concerned with security of this approach: how is it better than a ring with a chip you'd wear and use for auth? If this identity is compromised, you could just get another ring. And you wouldn't need to give you…

All biometric processing happens locally. You aren't sending your fingerprint or face, they simply unlock the private key in the enclave.

Sure, at this point Apple's solution likely works this way: they care about their reputation. But even a secure faceid opens the Pandora box: today it's just iPhone users, 5 years later it's everywhere, including in solutions from Huawei and 10 years later it's the law. Afaik, Delta airlines already trying to use faceid. And once faceid is required to buy gas and groceries, your complete and nuanced dossier will be available for sale on all these data exchange brokerages. In this beautiful future, faceid is needed to unlock any car and it would play you ads for 3 mins while it's starting.

Re: Face ID and Touch ID for the Web

#267

Post by modeless »

monocasa wrote: post #264
modeless wrote: post #263

Earlier quoted context omitted.

The firmware on these chips erases the keys before applying firmware updates. I encourage you to read the detailed information available rather than just making assumptions about it, or even just the short blog post I linked which states this explicitly. In the San Bernadino case the FBI had physical possession of the HSM, so Apple could have attacked it physically. That's not related to the reasons why the FBI gave…

> The firmware on these chips erases the keys before firmware updates. I encourage you to read the detailed information available rather than just making assumptions about it, or even just the short blog post I linked which states this explicitly. I read the blog post _and_ the third party security audit. The audit only documents that rogue actors within Google would leave a attestation trail if they tried to push ma…

The audit report does not explicitly state that the keys are erased on firmware update, but malicious firmware updates were specifically in scope for the audit, and this specific attack was not raised as an issue, and the blog post explains why. The Titan chip in your Pixel is not running the mentioned custom firmware that erases the keys on update (and malicious firmware updates to the HSM in the phone were not in scope for the audit).

It is not at all clear that the FBI would have lost if they had continued to pursue Apple in the San Bernadino case. The distinction you are drawing is not as clear cut as you think it is.

Re: Face ID and Touch ID for the Web

#268

Post by monocasa »

modeless wrote: post #267
monocasa wrote: post #264

Earlier quoted context omitted.

> The firmware on these chips erases the keys before firmware updates. I encourage you to read the detailed information available rather than just making assumptions about it, or even just the short blog post I linked which states this explicitly. I read the blog post _and_ the third party security audit. The audit only documents that rogue actors within Google would leave a attestation trail if they tried to push ma…

The audit report does not explicitly state that the keys are erased on firmware update, but malicious firmware updates were specifically in scope for the audit, and this specific attack was not raised as an issue, and the blog post explains why. The Titan chip in your Pixel is not running the mentioned custom firmware that erases the keys on update (and malicious firmware updates to the HSM in the phone were not in s…

When a core piece of their security model isn't backed up by the third party audit that they literally are presenting as "don't trust us, we have a audit covering this" (and the auditors did look at how google protects against malicious firmware updates, hence their attestation comments), _and_ when that would leave them being unable to update these modules without wiping everyone's backups, _and_ the auditors found security bugs that required a firmware update, _and_ literally the same chips are updated without wiping when against a threat model that has a better argument for wipes on update, I'm sorry I just don't believe the blog post.

Bringing this back to the original point though, just using an HSM doesn't automatically mean that the manufacturer of the HSM can't access the keys.

Re: Face ID and Touch ID for the Web

#269

Post by jodrellblank »

greggman3 wrote: post #219
jodrellblank wrote: post #215

Earlier quoted context omitted.

Monopolies have nothing much to do with government, they're about being the only provider in a market. If Apple controls less than half, they're not the only provider even within the US, and that only makes it weird for you to say - effectively - only the US matters, other countries don't. Google controls Android which Samsung use, and the terms on which they're allowed to use it if they still want to allow Google ap…

It is not Google vs Apple. No court would take that case. Google hardly has any market share of phones (Pixel) and Apple doesn't sell OSes Apple and Samsung are in direct competition. Apple has >50% of the smartphone market in the USA. Samsung has less then 25%, every one else has even less. Google has The rest of the world has its own markets. If the UK wants to sue Apple or Google for being a monopoly they only car…

I don't understand why you're trying to pick Samsung out. If Google strongarm Samsung and Motorola and LG and say "you can't put Google apps, Google Maps, Google play store on your phones anymore and can't get Android updates from Google unless you XYZ" that has a greater reach than Samsung alone has, doesn't it? And that is a reach that Google can have, and Samsung, Motorola, LG alone cannot have, right?

And by reaching over multiple Android phone sellers, that has at least a similar, but likely much greater reach than anything Apple can do, doesn't it?

Whether a company can be sued for being a monopoly in a given jurisdiction isn't so interesting to me, as whether they can influence ~80% of the worldwide smartphone market; If they can do that but you can't sue them for being a monopoly in Tuvalu that has no bearing on anything interesting.

Re: Face ID and Touch ID for the Web

#270

Post by sneak »

sirn wrote: post #119
ryukafalz wrote: post #109

Earlier quoted context omitted.

There's no reason a browser couldn't have generated a new self-signed client certificate for each site, though; the fact that they don't offer that as an option is just a browser design decision.

...which means a login is now tied to a browser, and you have to come up with a way to securely export or sync private key (bad idea?) or a way to link another browser to a login. Also user losing access to all their websites by accidentally uninstalling a browser doesn't sounds very user friendly.

This is exactly the same situation as software WebAuthn keys, if they are used as a single factor.
Post reply on HN