Live data from Hacker News

Face ID and Touch ID for the Web

webkit.org

241–250 of 371 posts

Re: Face ID and Touch ID for the Web

#241

Earlier quoted context omitted.

> You could say that about anything -- nothing is completely static 1. Contracts are a thing. You can draft a contract with your vendor that guarantees certain terms for a certain duration. 2. You should be wary of wandering into commitments (including de facto commitments e.g. "vendor lock-in")--there are plenty of good reasons to do so, but one should make sure to properly consider the cost. The problem is that doi…

It is more of an monopsony[1] than a monopoly. If you are looking to buy a smartphone there are still options. If you are looking to sell software for smart phones, Apple is by far the most lucrative platform and they have a lock on publishing software for iOS. It is very difficult in the US to survive as a software developer for Android only. The anti-trust frameworks in the US are based largely on monopolies and th…

Perhaps I should have said “anti-competitive”. As you note, it’s very difficult to survive as an app developer on other platforms, and that’s bad for users ultimately.

I would like to see the US crack down on anti-competitive behavior in general, but especially in cases where companies are deriving value by gate-keeping some large network. To this effect, I think Apple is a relatively minor problem compared to social media networks. Consumers have no meaningful choice (hopefully I don’t need to elaborate on why Facebook vs Twitter is a false choice) and it allows social media companies to get away with all kinds of awful behavior, but especially the ability to steer the course of democracy (by determining at scale who is exposed to which ideas and at what potency) and then selling that as a service to the highest bidder or even serving as an attack vector for other states to steer our democracy (or other democracies for that matter). A monopoly over the flow of speech is intolerable for a democracy, and at least in America where conservatives are concerned about censorship of conservative speech by Silicon Valley progressives and liberals are concerned about Russian manipulation, it seems like a naturally bipartisan concern.

Edit: genuinely wondering what downvoters are objecting to in particular? Do you not believe that social media companies have a monopoly over their own networks? Do you disagree that they can and do steer public opinion and thus public policy? Do you disagree that this is a bad outcome? Perhaps it’s a bad outcome but regulation is an ineffective solution (e.g., libertarianism)? Educate me.

Re: Face ID and Touch ID for the Web

#242
post #33
post #13

So happy Apple decided to go with an open standard here rather than something proprietary. This is good news for the FIDO2 ecosystem and I hope this leads to far greater support for FIDO2 authenticators of all types. There is another world in which Apple just pushed 'Sign in with Apple' and created yet another federated identity provider rather than true, 'secure element'-based FIDO2 authentication.

"Sign in with Apple" requires a developer account with Apple. Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". (FWIW, the only 2fa with "Sign in with Apple", if you don't own any Apple hardware, is SMS.)

Why don't sites start supporting multiple federated identities? It shouldn't be too hard to keep the "sign in with X" links on the account settings page, right?

Re: Face ID and Touch ID for the Web

#243
post #71
post #50

Earlier quoted context omitted.

> I would definitely stay away from any "Sign in with Apple". I would stay away from any "Sign in with.." service as a user and as a product owner. You're affectively giving away a major control of your users to a third party.

As a product owner, why wouldn't I want to piggyback on the millions of dollars of R&D + security that the big companies have put in? And as a user, why would I trust my password to the website that rolled their own authentication over the big companies?

Mainly to prevent the big companies from knowing every website you’ve ever visited.

Re: Face ID and Touch ID for the Web

#244
post #36

Earlier quoted context omitted.

Apple did not terminate Epic's SiwA account, and several journalists have sources within Apple that say that Apple never sent the message Epic claimed to receive that said access was going away.

Tim Sweeney produced a letter saying that Apple would terminate their access: https://twitter.com/TimSweeneyEpic/status/131134525357683097...

That’s a pretty misleading interpretation of what Apple said or even what Tim Sweeney said in the tweet...

Re: Face ID and Touch ID for the Web

#245

Earlier quoted context omitted.

It isn’t productive to establish defense against an arbitrary future that turns on you. Spend those brain cycles focusing on your user and building a great product. Choosing Sign in with Apple is great for Apple users.

It absolutely can be productive. So many people have done as you said and had the rug ripped out from under them by $ARBITRARY_PLATFORM_DECISION (cough cough YouTube) that if they had thought the risk they were taking on by going with one platform they might still be in business.

I heard a guy died getting struck by lightning once. I am _never_ leaving my house during a storm again.

Re: Face ID and Touch ID for the Web

#246

Earlier quoted context omitted.

Tim Sweeney produced a letter saying that Apple would terminate their access: https://twitter.com/TimSweeneyEpic/status/131134525357683097...

That’s a pretty misleading interpretation of what Apple said or even what Tim Sweeney said in the tweet...

How so?

Re: Face ID and Touch ID for the Web

#247
post #77

You can change a password but you can't change your fingerprint / palm / etc. Am I missing something? How is Face / Touch ID more secure that user + pass? What happens when biometric data is leaked?

you're right that using biometric data for authentication is bad, but that's not what's happening here. faceid/touchid stores a private key on your device, and uses your biometrics to unlock that private key. it's the same idea as using a yubikey or something where you have to press the button on the 2fa dongle to prove it's physically in your posession and unlock the private key stored within it, but it goes beyond…

I know very little about security. Could you please explain it in simpler way?

So, does my iPhone create a private key (which my Face ID data) on the phone itself, then the browser ask the phone to do something to authenticate the user? I am lost here.

Re: Face ID and Touch ID for the Web

#248

Earlier quoted context omitted.

It isn’t productive to establish defense against an arbitrary future that turns on you. Spend those brain cycles focusing on your user and building a great product. Choosing Sign in with Apple is great for Apple users.

Maybe so. But how is this different than saying, "I have nothing to hide, so I'm not worried about having my car searched?" It's a somewhat pragmatic point of view but I wonder if it is a good idea in the limit.

So what are you saying then? We shouldn't agree to a system that allows our car to be searched because under some limit it might be bad for us? What are we comparing this to in the Apple case? What is the equivalent of the "car search"?

Re: Face ID and Touch ID for the Web

#249
post #235
post #33

Earlier quoted context omitted.

"Sign in with Apple" requires a developer account with Apple. Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". (FWIW, the only 2fa with "Sign in with Apple", if you don't own any Apple hardware, is SMS.)

Except the 2FA is kinda stupid. I have devices logged into my iCloud account at a datacenter, that end up getting my 2FA for my other devices. I have a iPhone, iPad, Macbook, do you think any device I actually use all the time gets the 2FA code ? Sometimes, the same computer i’m using to login gets the code which is kinda pointless. I have to always use SMS to get my code because of this.

Every single device on your iCloud account gets the 2FA prompt. You then choose which device you want to confirm the request on. The prompt does not go to just a single device, but every single device on said iCloud account.

Re: Face ID and Touch ID for the Web

#250
Honest question, Why I feel I have to be an advanced programmer to understand all of that?

I see a lot of confusion in the comments, so it is not just me. Why the article couldn't be simpler?

Maybe I am just stupid, I don't know.

Post reply on HN