Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID and Touch ID for the Web

webkit.org

Post reply on HN
Print view View original

121–130 of 371 posts

Re: Face ID and Touch ID for the Web

#121

Post by JoeAltmaier »

coder543 wrote: post #72
JoeAltmaier wrote: post #55

Earlier quoted context omitted.

Biometrics fails every test for a password. 1) A password is secret 2) You don't leave copies of it lying around everywhere 3) You can change it periodically 4) If discovered, it can't be traced back to you No, biometrics can only be a username. It can never be an acceptable password.

You don't seem to be aware of what is under discussion here. You just raised a huge strawman. Websites are not receiving your biometrics in this context, and your biometrics would be meaningless to the website if captured and somehow provided. Your biometric signature is stored solely inside the Secure Enclave in the Apple device. If and only if the Secure Enclave recognizes you via your biometrics will the Enclave u…

That's sophistry. The fact is, the laptop is 'secured' by biometrics, which can be spoofed. Having a key-to-the-key is not safe if the biometrics are not safe.

Re: Face ID and Touch ID for the Web

#122

Post by Spivak »

DaiPlusPlus wrote: post #52
dlivingston wrote: post #44

Earlier quoted context omitted.

Maybe (probably) I’m just ignorant of the actual state of the industry, but it seems to me that biometrics have always been about providing full user authentication. I’m not personally aware of any instance where an alphanumeric password is still required as a secondary authenticator to biometrics.

> I’m not personally aware of any instance where an alphanumeric password is still required as a secondary authenticator to biometrics. It's straightforward to configure Active Directory / Group Policy to require biometric and password factors for interactive authentication. The main reason not to allow _only_ biometrics is to disincentivize chopping fingers off (well, it's more because [it's still surprisingly easy…

I mean you're referencing an article from 2014 about a relatively unsophisticated biometric auth system. It's like saying "TSA locks are stupidly easy to pick."

There are extremely high-security biometric auth systems that you would have a much harder time fooling. The high-res retina scanners that take a 3d map of your eye and detect blood flow would be a much better assessment of what's possible.

Re: Face ID and Touch ID for the Web

#123

Post by floatingatoll »

dwaite wrote: post #48
ArchOversight wrote: post #32

Earlier quoted context omitted.

Apple didn't just roll their own though, they improved upon it by allowing them to easily revoke attestation for a particular implementation without affecting all other devices out there. So if an attacker tampers with the physical device, they can revoke the key for that particular device so that it is no longer trusted (the way I am reading it) vs yubikey where if an attacker has messed with one key, there is no go…

> So if an attacker tampers with the physical device, they can revoke the key for that particular device so that it is no longer trusted (the way I am reading it) vs yubikey where if an attacker has messed with one key, there is no good way to revoke attestation for that one device. Attestation is a statement that the hardware and firmware are genuine, with the trust model being based on genuine hardware/software. Yo…

Can this Attestation be safely issued from macOS running on Apple Silicon, conditional on whether the user has disabled various hardware/software security features on the Mac?

Re: Face ID and Touch ID for the Web

#124

Post by JoeAltmaier »

Spivak wrote: post #103
JoeAltmaier wrote: post #55

Earlier quoted context omitted.

Biometrics fails every test for a password. 1) A password is secret 2) You don't leave copies of it lying around everywhere 3) You can change it periodically 4) If discovered, it can't be traced back to you No, biometrics can only be a username. It can never be an acceptable password.

You're missing the point of biometrics. Something you are is a form of authentication that only you can use. Your face, fingerprints, blood, retinas are all public but try as you might you can't make another living human with the same features. If your view of fingerprint auth is "a picture of your face is the password" then of course it sounds stupid. It's actually "a face with the correct features attached to an al…

That's trivially refutable. Fingerprints are left everywhere, and can be lifted and reproduced with common household substances (tape, glue etc). A face can be photographed, printed and presented trivially.

And so far, biometrics falls far short of a 4/5 digit lock passcode. The entropy in most fingerprint sensors is a few bits. They are famously defeatable.

Nothing will change the fact that you cannot keep your face and fingerprints secret, cannot/won't change them, and they are always, always traceable to you. Using them to secure a 'better' key is not security at all.

Re: Face ID and Touch ID for the Web

#125

Post by coder543 »

JoeAltmaier wrote: post #121
coder543 wrote: post #72

Earlier quoted context omitted.

You don't seem to be aware of what is under discussion here. You just raised a huge strawman. Websites are not receiving your biometrics in this context, and your biometrics would be meaningless to the website if captured and somehow provided. Your biometric signature is stored solely inside the Secure Enclave in the Apple device. If and only if the Secure Enclave recognizes you via your biometrics will the Enclave u…

That's sophistry. The fact is, the laptop is 'secured' by biometrics, which can be spoofed. Having a key-to-the-key is not safe if the biometrics are not safe.

It is not sophistry, and sophistry is not a word I've ever seen used in a genuine conversation, so I immediately doubt your sincerity in this conversation.

If someone wants to fake biometrics on an iPhone, they have a very limited window of time to do so, and the user can lock out the biometrics in less than 3 seconds just by "squeezing" the phone. (power button + either volume key, 2 seconds later the biometrics are locked out.)

It's much harder to fake the biometrics in that very brief window of time (maximum 48 hours) than it is to shoulder surf a password.

Unless your threat model includes State Level Actors, biometric bypass is a very remote concern.

If your threat model includes State Level Actors, you're probably screwed either way, since they can easily afford to shoulder surf you.

For everyone else, the main concern is that someone not physically present will manage to acquire your password and log into your services. Passwords suck at this threat model. FIDO2 makes this scenario impossible without that remote person managing to execute a Secure Enclave 0day on your personal device... and even then, it's still way harder than acquiring your password. Not even the website you're authenticating against receives your FIDO2 key... websites always receive your password, which is awful for security.

Some related info here: https://news.ycombinator.com/item?id=24830642

Re: Face ID and Touch ID for the Web

#126

Post by dwaite »

0xCMP wrote: post #81
fullstop wrote: post #24

If I can use FIDO2 on my yubikeys in more places, it would be fantastic.

You can already use NFC and Lightning yubikeys on your iPhone. On iPad Pro there are issues using USB-C still in my experience. Being able to use FaceID on there now will be nice.

There are three methods on iPhone: 1. NFC 2. USB - this is actually how it works with the lightning connector on iPhone in Safari - the Yubico model with a lightning port is working as a lightning to USB adapter in this case. 3. MFI (Made for iPhone) - some third party browsers can use the external accessory framework to talk to the Yubico model over the lightning port. Safari does not support this, but luckily can just use these keys as USB keys.

I believe there is a hardware limitation that the MFI protocol only works over the lightning port and not the USB-C port, so they work for third party browsers on iPhone and not iPad Pro or the new iPad Air.

Re: Face ID and Touch ID for the Web

#127

Post by yegle »

reaperducer wrote: post #63
yegle wrote: post #54

Earlier quoted context omitted.

There's an explicit list of websites that are not allowed to integrate with "Sign in with Apple". https://developer.apple.com/sign-in-with-apple/usage-guideli... Nothing stops Apple from adding more requirements in the future, even if you don't start a feud with Apple.

There's an explicit list of websites that are not allowed to integrate with "Sign in with Apple". I don't think anyone is crying over Apple not wanting to handle authentication for web sites offering "Illegal drugs or non-legally prescribed controlled substances." The rest of the list is similar. And yes, with that list Apple has once again affirmed it's not interested in helping normalize pornography. That's its cho…

Sure, but at the end of the page:

> Apple reserves the right to disable Sign in with Apple on a website or app for any reason at any time.

Re: Face ID and Touch ID for the Web

#128

Post by dividuum »

xfalcox wrote: post #118
dividuum wrote: post #113

I toyed around with this on https://passwordless.dev/usernameless on iOS 14 and now I have two test users to choose from on the 'Do you want to sign in www.passwordless.dev" using a saved account?' prompt. I have yet to find a way to remove those test accounts again.

Removing is covered in the article: > Credentials can only be cleared for all via Safari > History > Clear History… on Mac Safari or Settings > Safari > Clear History and Website Data on iOS & iPadOS.

Thanks for the quick response. I thought I tried that and just made sure I did. The following did not work for me: Settings > Safari > Clear History and Website Data > Searching for "passwordless.dev" > Edit > Removing the "passwordless.dev" row. The two accounts are still there when reopening passwordless.dev and clicking on "Sign in". I'm probably missing something obvious.

Edit: Oh. I guess the "for all" in the article mean that this only works if I clear the complete history for all sites? I did not try that.

Edit2: Cleared all website data. The two test accounts are still there.

Re: Face ID and Touch ID for the Web

#130

Post by dzhiurgis »

anuila wrote: post #114
dzhiurgis wrote: post #94

Cmon apple, just add NFC to macbooks already. Fido cards are the most obvious solution to this.

I don’t know what I’m talking about, but isn’t the Secure Enclave already a solution to this? Fido cards just sound like an external solution that all iPhones and new MacBooks already have integrated (T2)

Sure works when you have only one computer in your life (aka almost nobody). It’s especially bad with Apple with 3 different usb standards. Contactless is the future.
Post reply on HN