Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID and Touch ID for the Web

webkit.org

Post reply on HN
Print view View original

261–270 of 371 posts

Re: Face ID and Touch ID for the Web

#261

Post by derefr »

variaga wrote: post #229
ogre_codes wrote: post #168

Earlier quoted context omitted.

> That may be true today, but their policies are a moving target. Who knows what they'll be like in a year's time? Likewise Google, Facebook, or any site/ API that a developer deals with on a daily basis. I wouldn’t bet my company on any sign in with _____ service. I just feel the trade-offs with Apple’s sign in versus Google/ Facebook to be less bad. With any of the services, I might do something that causes me issu…

This is why (as a customer) I always prefer "yet another web account" vs. "sign-in with ____" - yes, it's a hassle to manage a different account for every different thing I use (although not much of one with a decent password manager), but I get the advantage of not risking losing access to _everything_ because . Single-sign-on means single point of failure.

Is that still true when those accounts are literally just backend-side caches of your shipping+billing address and credit card details?

I had to create an "account" to order a pizza. That account does nothing other than to make ordering pizzas slightly faster. I would be literally not inconvenienced at all if I had to input all that information for each order (because AutoFill.) I would also be literally not inconvenienced in the slightest if I lost access to that account and had to create another one.

To me, that's the type of "account" for which "Sign In With Apple" is a perfect solution. The type of account where it's only the provider insisting on having an account in the first place, and you would be get on just fine without one if they'd let you.

(Or, for an even more annoying example: web forums that you have to "create an account" for to read certain posts, or download attachments on those posts. Thanks for making me take five minutes to verify my email just so I can click a link on a page!)

Re: Face ID and Touch ID for the Web

#262

Post by Dahoon »

syspec wrote: post #236
henryfjordan wrote: post #209

Earlier quoted context omitted.

Your face can easily be mimicked. Biometric data is not stored in the phone, it is stored in you. See: https://www.macrumors.com/2018/12/16/3d-printed-head-android...

This thread is about Apple. From the link: > 3D Printed Head Fools Android Face Recognition, iPhone X 'Impenetrable'

Saying "Android face recognition" is like saying "car security". Just because Ford and Jeep are easy to break into doesn't mean it's easy to break into BMW's and Audi's just because they happen to also be cars.

Re: Face ID and Touch ID for the Web

#264

Post by mr_toad »

tchalla wrote: post #240
qppo wrote: post #136

Earlier quoted context omitted.

I've had an issue with sign-in with Apple where using an autogenerated emails ruins certain support interactions. One of them was cancelling a subscription service that was eventually resolved (they required me to email their customer support, which I couldn't figure out how to do using the autogenerated email address created by "sign-in with Apple").

It would be helpful if you could let us know how you managed to send that e-mail.

You can see the email that Apple generates:

https://support.apple.com/en-us/HT210426

Re: Face ID and Touch ID for the Web

#265

Post by MobileVet »

drexlspivey wrote: post #129

This comes 3 days after a leak that alleged that iPhone 13 will bring back Touch ID via in-screen fingerprinting https://www.techradar.com/uk/news/move-over-iphone-12-apples...

Please please please be true. TouchID is objectively superior to FaceId, by a long shot. It is my soap box... but TouchID RARELY failed and could be activated BEFORE you had the phone in front of you. FaceID fails constantly and MUST be in view to start the unlock process.

TouchID has a single failure mode (and a half) that isn't that common. Wet / dampness. Solution, dry your finger, try again. Gloves are the 'half' mode as what can you expect, you can't access the finger.

FaceID has no less than 3 FREQUENT failures and a myriad of other smaller less frequent ones. Occlusion, distance and light.

Occlusion - Have your face resting on your palm... fail. Have a hat on, fail. Have a mask on...

Distance is an interesting one, but for those of us with terrible eyesight, it is constant. Phone call / text at night? Put the phone up to my face to see... FaceID fail (too close). I have to move it back away so I can't read it to unlock... hoping it did unlock before I move it forward again to read it.

Light - This really shows up when outdoors in the sun. The IR sensor gets washed out and can't work. It isn't that bad, but it does happen frequently enough to notice.

The other thing that is SO annoying about FaceID is that is has no idea WHEN you want to use it... see a face 'I must SCAN IT!' Oh, that is someone else, now you are locked out and need your password. Pick up your phone, SCAN! Oh, that is your pocket, now you need your password. The latter can be turned off, the former, not so much.

I ALMOST bought an 8 instead of a Xs when I finally upgraded, but OLED pushed me over the edge. I do love the screen, but I scorn FaceID daily and was hoping for TouchId to return to the 12. Fingers crossed for the 13, lol.

Re: Face ID and Touch ID for the Web

#266

Post by sneak »

StavrosK wrote: post #197
rektide wrote: post #21

Earlier quoted context omitted.

I dunno. I mean, I do, it feels good. But it also is a very different kind of FIDO2 than what we've seen before. In a way that FIDO was designed for, that we hoped would happen. But it's still not entirely joy & mirth that we're here for me. It feels like a little like the first day we start to understand how "Big Tent" (in the OpenStack sense) FIDO2 ecosystem is. You can do whatever, make anything, and call it FIDO2…

So what exactly is the concrete downside here, apart from the icky word "platform", that, in this context, means "a security chip that's not removable", ie as opposed to a Yubikey or such.

Websites will, at their option, be able to require Apple hardware to use them.

Re: Face ID and Touch ID for the Web

#267

Post by Rafert »

mrwnmonm wrote: post #254
Polylactic_acid wrote: post #252

Earlier quoted context omitted.

Your phone holds the passwords for the websites but they passwords never get presented to the user. FaceID is just used to unlock the password store. You would have to steal a phone and trick faceid on the phone to gain access to someones account.

Sorry, I still don't see the improvement here, doesn't that already happen using chrome for example, or Touch ID with 1password? (I think IOS has that too)

That's correct, but 1Password stores a static secret (the password) and this may be re-used by less security-minded folks as you probably know. WebAuthn servers only store a public key which is useless in case the server gets compromised. WebAuthn also is phsihing proof by having browsers verify the domain the credentials are used for.

See more at https://webauthn.guide/

Re: Face ID and Touch ID for the Web

#268

Post by sneak »

BHSPitMonkey wrote: post #188
dzhiurgis wrote: post #130

Earlier quoted context omitted.

Sure works when you have only one computer in your life (aka almost nobody). It’s especially bad with Apple with 3 different usb standards. Contactless is the future.

What's stopping you from linking more than just one physical FIDO-enabled device to a particular site/service? Most MFA implementations I've seen already allow this, and it seems especially important if you want to minimize the pain of losing/damaging that one sacred card.

AWS, for example, only permits one MFA device per IAM user account. I have four computers and four tokens. :/

Re: Face ID and Touch ID for the Web

#269

Post by mrwnmonm »

Rafert wrote: post #267
mrwnmonm wrote: post #254

Earlier quoted context omitted.

Sorry, I still don't see the improvement here, doesn't that already happen using chrome for example, or Touch ID with 1password? (I think IOS has that too)

That's correct, but 1Password stores a static secret (the password) and this may be re-used by less security-minded folks as you probably know. WebAuthn servers only store a public key which is useless in case the server gets compromised. WebAuthn also is phsihing proof by having browsers verify the domain the credentials are used for. See more at https://webauthn.guide/

Thanks for the link <3

Re: Face ID and Touch ID for the Web

#270

Post by theluketaylor »

mrwnmonm wrote: post #258
notatoad wrote: post #253

Earlier quoted context omitted.

You can think of a private key like a really long, complicated password. Like, thousands of characters. But you don't have to type it in every time, you just let your phone store it for you and fill it in for you in apps (and now, websites). To log into a website, your iPhone checks to see if your face is your face, and if it is then unlocks your private key to send it to the website. If it can't identify your face,…

So does my phone has a different private key for every website?

Yes, it’s a unique for each site which makes webauthn extremely phishing resistant. Even on look alike domains the origin doesn’t match and your phone has nothing to send.
Post reply on HN