Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID and Touch ID for the Web

webkit.org

Post reply on HN
Print view View original

111–120 of 371 posts

Re: Face ID and Touch ID for the Web

#111

Post by floatingatoll »

yegle wrote: post #33
blintz wrote: post #13

So happy Apple decided to go with an open standard here rather than something proprietary. This is good news for the FIDO2 ecosystem and I hope this leads to far greater support for FIDO2 authenticators of all types. There is another world in which Apple just pushed 'Sign in with Apple' and created yet another federated identity provider rather than true, 'secure element'-based FIDO2 authentication.

"Sign in with Apple" requires a developer account with Apple. Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". (FWIW, the only 2fa with "Sign in with Apple", if you don't own any Apple hardware, is SMS.)

It's weird to see you using this example, given that Apple specifically went out of their way to continue operating Sign in with Apple for all of Epic's users. Can you talk more about why you would stay away from it when developing for Apple platforms?

Re: Face ID and Touch ID for the Web

#112

Post by ezekg »

mcpherrinm wrote: post #104
ezekg wrote: post #58

Has anybody ever thought about how Face ID is pretty much a backdoor into your iPhone? Think back a few years to when Apple refused to open a felon's iPhone for the US government, because "they couldn't." If that happened now, they wouldn't even have to ask Apple, given the felon has Face ID enabled. Edit: I'm kind of surprised by the downvotes, given I thought HN was pretty big on personal privacy. Just thought I'd…

The risks of forced unlocking with FaceID have been discussed, including in court: https://appleinsider.com/articles/19/01/14/face-id-touch-id-... The main alternative to biometric ID is a PIN. Those are seldomly changed, and are relatively easily shoulder-surfed. I've seen children who can't even read yet learn their parent's iPad PINs. If you're afraid of the police, surveillance needs to be your threat model. Ther…

I didn't know you could disable face ID by squeezing your phone. Thanks for the info, and for the court case as well.

I think a strong password on my phone is important, rather than a simple PIN, given it's my second factor for nearly everything.

Re: Face ID and Touch ID for the Web

#114

Post by anuila »

dzhiurgis wrote: post #94

Cmon apple, just add NFC to macbooks already. Fido cards are the most obvious solution to this.

I don’t know what I’m talking about, but isn’t the Secure Enclave already a solution to this? Fido cards just sound like an external solution that all iPhones and new MacBooks already have integrated (T2)

Re: Face ID and Touch ID for the Web

#115

Post by ezekg »

dwighttk wrote: post #90
ezekg wrote: post #58

Has anybody ever thought about how Face ID is pretty much a backdoor into your iPhone? Think back a few years to when Apple refused to open a felon's iPhone for the US government, because "they couldn't." If that happened now, they wouldn't even have to ask Apple, given the felon has Face ID enabled. Edit: I'm kind of surprised by the downvotes, given I thought HN was pretty big on personal privacy. Just thought I'd…

possibly, but they have to be quick about it: >To use Face ID, you must set up a passcode on your device. >You must enter your passcode for additional security validation when: >The device has just been turned on or restarted. >The device hasn’t been unlocked for more than 48 hours. >The passcode hasn’t been used to unlock the device in the last six and a half days and Face ID hasn't unlocked the device in the last 4…

I wasn't aware of some of these. Thanks for sharing.

Re: Face ID and Touch ID for the Web

#116

Post by floatingatoll »

wayneftw wrote: post #61
yegle wrote: post #54

Earlier quoted context omitted.

There's an explicit list of websites that are not allowed to integrate with "Sign in with Apple". https://developer.apple.com/sign-in-with-apple/usage-guideli... Nothing stops Apple from adding more requirements in the future, even if you don't start a feud with Apple.

Wow, you can’t even use sign in with Apple if you “Show Apple or its products in a false or derogatory light.” Who decides what’s false or derogatory?

A court of law.

Re: Face ID and Touch ID for the Web

#118

Post by xfalcox »

dividuum wrote: post #113

I toyed around with this on https://passwordless.dev/usernameless on iOS 14 and now I have two test users to choose from on the 'Do you want to sign in www.passwordless.dev" using a saved account?' prompt. I have yet to find a way to remove those test accounts again.

Removing is covered in the article:

> Credentials can only be cleared for all via Safari > History > Clear History… on Mac Safari or Settings > Safari > Clear History and Website Data on iOS & iPadOS.

Re: Face ID and Touch ID for the Web

#119

Post by mcpherrinm »

young_unixer wrote: post #92
reaperducer wrote: post #75

Earlier quoted context omitted.

Apple has my face and fingerprint? I haven't heard this before and Google turns up nothing. Any source?

You put your fingerprint into a black box and that black box phones home to Apple servers. From a security standpoint, we must assume that they have your fingerprint unless there's a way to prove that they don't. iOS is closed source so we can't prove that. From an epistemological point of view: I don't know if they have it. From a security point of view: they have your fingerprint.

Just because something's closed source doesn't mean we can't learn about it. The field of reverse engineering has been around for a long time, and the iPhone and Mac are two of the most studied devices around.

Ultimately you do have to trust your platform if you're going to use a platform authenticator to some degree.

But the alternative in the FIDO2/webauthn space is something like a Yubikey which has no biometrics; it just takes a simple tap. And can be easily removed from your computer. So in that comparison, the fingerprint is purely additive security. Even if it's adding nothing to a serious adversary, it's still dramatically reducing risk to a less-skilled local attacker.

Post reply on HN