Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Passkey

developer.apple.com

Post reply on HN
Print view View original

71–80 of 421 posts

Re: Apple Passkey

#71

Post by tialaramex »

aseipp wrote: post #42
whoisjohnkid wrote: post #2

Woah this is awesome. Does anyone know if this is using web authn under the hood? Or is this a new spec? Would love to see Pub/Priv replace passwords

Yes, it uses WebAuthn under the hood. Passkeys have technically been available to developers for a while I think but very experimental still. I guess they've begun hitting new milestones. This is basically the biggest problem with WebAuthn today: the credentials are tied to the browser -- or really whatever application is using WebAuthn, browser or not, name aside -- which means that if you register for a service wit…

> This is basically the biggest problem with WebAuthn today: the credentials are tied to the browser

That's definitely not true. My Feitian ePass for example (very cheap USB dongle that lives with my house keys) works just fine to sign me into GitHub on this desktop PC w/ Firefox on Linux, it works fine via a USB-C to USB-A adaptor to sign in on my Android phone w/ Chrome, and likewise on the Windows laptop I use for work when I needed to access my personal site briefly at Christmas and that was the only laptop I'd brought with me.

If you have credentials tied up in some proprietary system then, yeah, they're trapped in there, and in Apple's case they've decided to make it possible to move the credentials to another Apple device via iCloud.

Re: Apple Passkey

#72

Post by theshrike79 »

gzer0 wrote: post #27
snowwrestler wrote: post #21

Earlier quoted context omitted.

I think Apple encrypts the pass keys locally on your device, then stores encrypted copies in iCloud, which you can download and decrypt on a new device. On the new device you would be prompted for the passcode of the device you lost or broke, to decrypt and access them.

iCloud (and anything on iCloud) is explicitly not encrypted, though [1]. [1] https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...

Photos need to be encrypted on server so they can be scanned for CSAM. Apple tried to move that bit to the phone so they could encrypt photos on server too, but we all know how that went.

Re: Apple Passkey

#73

Post by MBCook »

cokeandpepsi wrote: post #51
blktiger wrote: post #25

Earlier quoted context omitted.

It's tied to a key stored in your iCloud. So basically as long as you have a device tied to your iCloud you can get in. Presumably, if you lose access to iCloud you will have problems.

What happens when you're not using an apple device?

I saw a screenshot. Somehow a QR code is presented and you scan that with your phone. I’m not entirely sure what happens from there.

But there was a picture of them using it with a Windows machine. So they’ve thought of it.

Re: Apple Passkey

#74

Post by Ajedi32 »

mhoad wrote: post #63

How do I leave the Apple ecosystem if I go all in on this? Sounds like major vendor lock in under a deceptive title of “open standards” but I’m hoping I’m wrong here. Does anybody happen to know yet?

Yeah, that's going to be the next big ecosystem challenge for WebAuthn in my opinion. Ideally platforms would support 3rd party password managers, so you could manage your keys without having to tie your credential database to any one specific platform.

I'm sure as the popularity of WebAuthn grows there'll be more and more demand for cross-platform compatibility until eventually the big players are forced to implement it, but it's going to be kind of rough in the short term until then.

Re: Apple Passkey

#75

Post by sokoloff »

mwcampbell wrote: post #61
e_y_ wrote: post #53

Earlier quoted context omitted.

Looking at how various places do 2FA, it's likely that at least some websites will not support multiple keys even if they ought to. Also, I imagine that many people do not have the luxury of multiple devices. So if you lose your phone, you'll need to buy or at least borrow another iOS device to recover it from iCloud before you could switch to Android.

How common would it be for someone who has just lost their phone to want to immediately switch platforms? Isn't it much more likely that they'd want a new device on the same platform as the one they just lost?

If they were already planning to switch platforms, the loss or destruction of their old device provides a natural moment to make the switch, where buying a new device feels like it's locking yourself in for another couple of years.

Re: Apple Passkey

#76

Post by eddieroger »

mceachen wrote: post #66
epaulson wrote: post #56

I can be onboard with this if Apple opens up an iCloud API for syncing, so I can sync a non-Apple device through iCloud, and if I leave Apple and iCloud behind, my non-Apple devices keep working, even if I never sync through iCloud again.

C'mon. Non-Apple devices aren't _even remotely_ a priority for them. Just look how bad Apple Music is on Android and web.

I'm going to sound like an Apple apologize, but what's wrong with Apple Music on the web? I just launched it (for the second time in a while), and after signing in, was presented with a familiar looking UI and all my playlists, and was playing searched-for music in under a minute. I know Apple prioritizes their platforms first, but this doesn't seem like an example of Apple failing a competing platform.

Re: Apple Passkey

#77

Post by mhoad »

Ajedi32 wrote: post #74
mhoad wrote: post #63

How do I leave the Apple ecosystem if I go all in on this? Sounds like major vendor lock in under a deceptive title of “open standards” but I’m hoping I’m wrong here. Does anybody happen to know yet?

Yeah, that's going to be the next big ecosystem challenge for WebAuthn in my opinion. Ideally platforms would support 3rd party password managers, so you could manage your keys without having to tie your credential database to any one specific platform. I'm sure as the popularity of WebAuthn grows there'll be more and more demand for cross-platform compatibility until eventually the big players are forced to implemen…

Except Apple are kind of notorious about avoiding cross platform compatibility which is why I ask. Find them hard to trust at this point.

I can already hear them making the “we can’t because it will impact users security” argument in my head.

Re: Apple Passkey

#78

Post by [deleted] »

albertgoeswoof wrote: post #23

Does anyone know if this is different to Webauthn? You can already login with touchid/faceid, with the private key stored in apples keychain. Lots of sites support it, I just added it as 2FA to Mailpace ( https://blog.mailpace.com/blog/why-we-use-webauthn-for-2fa/ ), making it passwordless login instead of 2FA is trivial and fully supported by webauthn. What’s different about this?

[deleted]

Re: Apple Passkey

#79

Post by [deleted] »

cokeandpepsi wrote: post #51
blktiger wrote: post #25

Earlier quoted context omitted.

It's tied to a key stored in your iCloud. So basically as long as you have a device tied to your iCloud you can get in. Presumably, if you lose access to iCloud you will have problems.

What happens when you're not using an apple device?

[deleted]

Re: Apple Passkey

#80

Post by floatboth »

tialaramex wrote: post #71
aseipp wrote: post #42

Earlier quoted context omitted.

Yes, it uses WebAuthn under the hood. Passkeys have technically been available to developers for a while I think but very experimental still. I guess they've begun hitting new milestones. This is basically the biggest problem with WebAuthn today: the credentials are tied to the browser -- or really whatever application is using WebAuthn, browser or not, name aside -- which means that if you register for a service wit…

> This is basically the biggest problem with WebAuthn today: the credentials are tied to the browser That's definitely not true. My Feitian ePass for example (very cheap USB dongle that lives with my house keys) works just fine to sign me into GitHub on this desktop PC w/ Firefox on Linux, it works fine via a USB-C to USB-A adaptor to sign in on my Android phone w/ Chrome, and likewise on the Windows laptop I use for…

Yeah, since Apple's (and Google's) soft WebAuthn implementation is designed for syncing across devices, it should also work with many browsers on the same machine.
Post reply on HN