Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID and Touch ID for the Web

webkit.org

Post reply on HN
Print view View original

51–60 of 371 posts

Re: Face ID and Touch ID for the Web

#51

Post by saagarjha »

dwaite wrote: post #36
yegle wrote: post #33

Earlier quoted context omitted.

"Sign in with Apple" requires a developer account with Apple. Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". (FWIW, the only 2fa with "Sign in with Apple", if you don't own any Apple hardware, is SMS.)

Apple did not terminate Epic's SiwA account, and several journalists have sources within Apple that say that Apple never sent the message Epic claimed to receive that said access was going away.

Tim Sweeney produced a letter saying that Apple would terminate their access: https://twitter.com/TimSweeneyEpic/status/131134525357683097...

Re: Face ID and Touch ID for the Web

#52

Post by DaiPlusPlus »

dlivingston wrote: post #44
jjcm wrote: post #28

These all seem to be examples that use faceID/touchID as a password. That’s not what biometrics should be though, they should be the username. I hope that this is supported as a flow as well. Identify who you are with biometrics, and prove your access with a correlated password.

Maybe (probably) I’m just ignorant of the actual state of the industry, but it seems to me that biometrics have always been about providing full user authentication. I’m not personally aware of any instance where an alphanumeric password is still required as a secondary authenticator to biometrics.

> I’m not personally aware of any instance where an alphanumeric password is still required as a secondary authenticator to biometrics.

It's straightforward to configure Active Directory / Group Policy to require biometric and password factors for interactive authentication.

The main reason not to allow _only_ biometrics is to disincentivize chopping fingers off (well, it's more because [it's still surprisingly easy to fool biometric systems](https://www.theguardian.com/technology/2014/dec/30/hacker-fa...)).

Re: Face ID and Touch ID for the Web

#53

Post by tshaddox »

yegle wrote: post #33
blintz wrote: post #13

So happy Apple decided to go with an open standard here rather than something proprietary. This is good news for the FIDO2 ecosystem and I hope this leads to far greater support for FIDO2 authenticators of all types. There is another world in which Apple just pushed 'Sign in with Apple' and created yet another federated identity provider rather than true, 'secure element'-based FIDO2 authentication.

"Sign in with Apple" requires a developer account with Apple. Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". (FWIW, the only 2fa with "Sign in with Apple", if you don't own any Apple hardware, is SMS.)

Even if you don’t like Apple’s actions in the whole Epic drama, one thing that’s clear from it is that Apple probably won’t terminate your developer account like this unless you beg them to as part of a major PR stunt.

Re: Face ID and Touch ID for the Web

#54

Post by yegle »

otterley wrote: post #38
yegle wrote: post #33

Earlier quoted context omitted.

"Sign in with Apple" requires a developer account with Apple. Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". (FWIW, the only 2fa with "Sign in with Apple", if you don't own any Apple hardware, is SMS.)

> Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". If you don't renege on your agreements with Apple as part of a public pissing contest, and you aren't in the business of misleading customers and creating deceptive apps, it's unlikely they'll revoke your developer account.

There's an explicit list of websites that are not allowed to integrate with "Sign in with Apple". https://developer.apple.com/sign-in-with-apple/usage-guideli... Nothing stops Apple from adding more requirements in the future, even if you don't start a feud with Apple.

Re: Face ID and Touch ID for the Web

#55

Post by JoeAltmaier »

dustinmoris wrote: post #49
jjcm wrote: post #28

These all seem to be examples that use faceID/touchID as a password. That’s not what biometrics should be though, they should be the username. I hope that this is supported as a flow as well. Identify who you are with biometrics, and prove your access with a correlated password.

That doesn't make sense. Username + Password is a cumbersome workaround because (so far) machines couldn't use biometrics to authenticate a user. Now they can, so we can let go of that very problematic and often insecure model. Think like this, when you go to visit your grandmother and knock on her door you don't have to provide a password. You don't have to provide anything, because the human brain is capable of det…

Biometrics fails every test for a password.

1) A password is secret

2) You don't leave copies of it lying around everywhere

3) You can change it periodically

4) If discovered, it can't be traced back to you

No, biometrics can only be a username. It can never be an acceptable password.

Re: Face ID and Touch ID for the Web

#56

Post by thefounder »

tshaddox wrote: post #53
yegle wrote: post #33

Earlier quoted context omitted.

"Sign in with Apple" requires a developer account with Apple. Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". (FWIW, the only 2fa with "Sign in with Apple", if you don't own any Apple hardware, is SMS.)

Even if you don’t like Apple’s actions in the whole Epic drama, one thing that’s clear from it is that Apple probably won’t terminate your developer account like this unless you beg them to as part of a major PR stunt.

>> Apple probably won’t terminate your developer account

Or probably they will terminate it if they don't like your business

Re: Face ID and Touch ID for the Web

#57

Post by yegle »

tshaddox wrote: post #53
yegle wrote: post #33

Earlier quoted context omitted.

"Sign in with Apple" requires a developer account with Apple. Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". (FWIW, the only 2fa with "Sign in with Apple", if you don't own any Apple hardware, is SMS.)

Even if you don’t like Apple’s actions in the whole Epic drama, one thing that’s clear from it is that Apple probably won’t terminate your developer account like this unless you beg them to as part of a major PR stunt.

But they can expand the prohibited uses clause in the future if they see fit. https://developer.apple.com/sign-in-with-apple/usage-guideli...

Re: Face ID and Touch ID for the Web

#58

Post by ezekg »

Has anybody ever thought about how Face ID is pretty much a backdoor into your iPhone? Think back a few years to when Apple refused to open a felon's iPhone for the US government, because "they couldn't." If that happened now, they wouldn't even have to ask Apple, given the felon has Face ID enabled.

Edit: I'm kind of surprised by the downvotes, given I thought HN was pretty big on personal privacy. Just thought I'd stir up the discussion, that's all.

Edit 2: I personally think U2F is the way forward here, not Face ID or Touch ID or other biometrics.

Re: Face ID and Touch ID for the Web

#60

Post by yegle »

krtkush wrote: post #50
yegle wrote: post #33

Earlier quoted context omitted.

"Sign in with Apple" requires a developer account with Apple. Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". (FWIW, the only 2fa with "Sign in with Apple", if you don't own any Apple hardware, is SMS.)

> I would definitely stay away from any "Sign in with Apple". I would stay away from any "Sign in with.." service as a user and as a product owner. You're affectively giving away a major control of your users to a third party.

I think "Sign in with Apple" is unique that Apple allows the users to hide their email address https://support.apple.com/en-us/HT210425 which makes it extremely hard to migrate away, unlike other federated login system where you can at least get users' email addresses, allowing you to create a proper email+password login later on.
Post reply on HN