Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Passkey

developer.apple.com

Post reply on HN
Print view View original

91–100 of 421 posts

Re: Apple Passkey

#91

Post by zippergz »

biztos wrote: post #87
atonse wrote: post #85

My wife signed up for calm.com using Sign in with Apple. Thanks to this, I am not able to occasionally use her login to listen to the wonderful music. There's just no way in hell I'm paying the $60 a year or whatever they're asking to listen to a couple songs every now and then. In a normal setting, she'd add her login to her 1password and I'd be able to use Calm.com, and who knows, I would've grown to love it, and g…

Is that not a use-case for Family Sharing? Apple says you can "download content" bought by other family members[0], but I guess this doesn't work for subscriptions? That's a real missed opportunity. I would expect them to at least allow the app developer to opt in to sharing. Selling two licenses into a household has to be pretty rare, whereas having happy-family customers is great word of mouth. "My wife uses FooApp…

The app developer has to specifically support Family Sharing if they want to allow people to share subscriptions.

Re: Apple Passkey

#92

Post by realityking »

teeray wrote: post #20
howinteresting wrote: post #14

Importantly, if you switch platforms you lose all your auth tokens and have to reauth everywhere. It ultimately is yet another way to do vendor lockin, except it has the FIDO alliance's blessing this time. The competition, password managers like 1password and bitwarden, do not have any sort of vendor lockin. You can freely export your passwords from one manager and into another.

Plus, password managers have fantastic backwards compatibility even on old, crufty sites that will never be updated. We really should be working to allow better, standardized integration with password managers (communicating password length and alphabet requirements, well-known URIs to do zero-touch credential rotation, etc.) rather than trying to do "Log in with BIGCORP" in another way.

There are some efforts to make things easier for password manager. E.g. differentiation new password, old password and 2FA token fields: https://developer.apple.com/documentation/security/password_...

I believe some password managers also look at the regex attribute to understand required or disallowed characters.

For resetting passwords there‘s at least a way to deep link to the right page: https://web.dev/change-password-url/

Re: Apple Passkey

#93

Post by ZetaZero »

atonse wrote: post #85

My wife signed up for calm.com using Sign in with Apple. Thanks to this, I am not able to occasionally use her login to listen to the wonderful music. There's just no way in hell I'm paying the $60 a year or whatever they're asking to listen to a couple songs every now and then. In a normal setting, she'd add her login to her 1password and I'd be able to use Calm.com, and who knows, I would've grown to love it, and g…

> How are they going to solve the totally legitimate sharing use cases?

According to their Terms, there are no legitimate sharing use cases. "You agree that you won’t disclose your Account password to anyone". That said, Calm has a family plan (6 users) for only $30/year more.

Re: Apple Passkey

#94

Post by teeray »

atonse wrote: post #85

My wife signed up for calm.com using Sign in with Apple. Thanks to this, I am not able to occasionally use her login to listen to the wonderful music. There's just no way in hell I'm paying the $60 a year or whatever they're asking to listen to a couple songs every now and then. In a normal setting, she'd add her login to her 1password and I'd be able to use Calm.com, and who knows, I would've grown to love it, and g…

This sounds like exactly the dark pattern Netflix will be clamoring for. “Oh gee, looks like you can’t share passwords anymore…”

Re: Apple Passkey

#95

Post by imwillofficial »

kps wrote: post #90
judge2020 wrote: post #69

Earlier quoted context omitted.

> Also we still need ways of exporting keys and software (like 1password) needs to synchronize them, manage them securely. There's still a long ways to go on that front, which probably won't be handled until stuff like this has settled. That's the point of passkeys here: iCloud Keychain syncs them, and if you want to use your keys on a non-apple device you'll be able to scan a QR code, which initiates a new BLE conne…

I'm writing this on a non-Apple computer that doesn't have any radios. Now what?

You don’t use the feature.

Re: Apple Passkey

#96

Post by tialaramex »

jrockway wrote: post #38
albertgoeswoof wrote: post #23

Does anyone know if this is different to Webauthn? You can already login with touchid/faceid, with the private key stored in apples keychain. Lots of sites support it, I just added it as 2FA to Mailpace ( https://blog.mailpace.com/blog/why-we-use-webauthn-for-2fa/ ), making it passwordless login instead of 2FA is trivial and fully supported by webauthn. What’s different about this?

Reading the linked page, it certainly looks very similar. I've also implemented WebAuthn from scratch and the term "relying party" is burned into my brain, and this document also uses that term. It's a reasonable term to use in any authentication context, though, so not a smoking gun I guess. WebAuthn continues to work great on iOS and Mac OS, so I'm not sure there's a good reason to add some other new standard. (Tho…

Relying Party is the jargon for the entity that gets to rely on the fancy cryptographic technology to determine something that would otherwise be difficult / expensive / unreliable. They're relying on the maths working, and on certain other parties doing their jobs correctly.

Everybody here is a Relying Party when they use HTTPS. The Web PKI promises that this is really news.ycombinator.com to you, the HN reader, so long as the math works (RSA, Elliptic Curve Cryptography and likely AES) and so long as your browser vendor did their job, and the Issuing CA (DigiCert) did their job.

Relying Parties should ideally know why their trust is well-founded. For example, in the Web PKI examining this cryptography is the job of the Internet Research Task Force (related to the IETF), the browser vendors are responsible to you directly, and the Root CAs are overseen by m.d.s.policy, run by Mozilla on behalf of their users and everybody else's users.

Re: Apple Passkey

#97

Post by stetrain »

mhoad wrote: post #77
Ajedi32 wrote: post #74

Earlier quoted context omitted.

Yeah, that's going to be the next big ecosystem challenge for WebAuthn in my opinion. Ideally platforms would support 3rd party password managers, so you could manage your keys without having to tie your credential database to any one specific platform. I'm sure as the popularity of WebAuthn grows there'll be more and more demand for cross-platform compatibility until eventually the big players are forced to implemen…

Except Apple are kind of notorious about avoiding cross platform compatibility which is why I ask. Find them hard to trust at this point. I can already hear them making the “we can’t because it will impact users security” argument in my head.

For normal passwords they currently seem to support third party password managers just fine, including direct integration in Safari and the iOS keyboard.

You can also export everything from iCloud Keychain to use with another password manager.

They could always use Passkeys as an opportunity to lock things down but it would be in direct contrast to what they have been doing with password management recently.

Re: Apple Passkey

#98

Post by blamestross »

throwaway92394 wrote: post #89

Does anyone know how this/FIDO/Webauthn affect privacy? How well supported are alt accounts? Are they easy to tell they're from the same signer? I figure privacy is fine as long as the implementations allow you to select which account to login with. Is this currently a thing? From everything I read it seems like the current implementations are only meant to support one identity? EDIT: These are great responses, also…

FIDO/WebauthN are generally "the good guys" when it comes to privacy bc "bring your own secure hardware key" is always an option. I'm kinda torn over the "use your cellphone as a key" approaches as not privacy friendly but we can't actually prevent them (you can always simulate a key).

Re: Apple Passkey

#99

Post by Someone1234 »

biztos wrote: post #87
atonse wrote: post #85

My wife signed up for calm.com using Sign in with Apple. Thanks to this, I am not able to occasionally use her login to listen to the wonderful music. There's just no way in hell I'm paying the $60 a year or whatever they're asking to listen to a couple songs every now and then. In a normal setting, she'd add her login to her 1password and I'd be able to use Calm.com, and who knows, I would've grown to love it, and g…

Is that not a use-case for Family Sharing? Apple says you can "download content" bought by other family members[0], but I guess this doesn't work for subscriptions? That's a real missed opportunity. I would expect them to at least allow the app developer to opt in to sharing. Selling two licenses into a household has to be pretty rare, whereas having happy-family customers is great word of mouth. "My wife uses FooApp…

Most IAPs and non-Apple subscriptions don't work with Family Sharing, and the few that do there's no way to tell before you buy.

Family Sharing is set up in such a way that you're punished for creating child Apple accounts as Apple recommends, because you'll need to repurchase MOST IAPs several times over.

Apple's subscriptions are the exception rather than the rule, but they like to promote it in such a way as you'd think all Subscriptions/IAPs are shared when they're not.

Re: Apple Passkey

#100

Post by jml7c5 »

floatboth wrote: post #88
mhoad wrote: post #63

How do I leave the Apple ecosystem if I go all in on this? Sounds like major vendor lock in under a deceptive title of “open standards” but I’m hoping I’m wrong here. Does anybody happen to know yet?

Just add more authenticators to every RP (site you auth into). From the point of view of an RP, "your account in the Apple ecosystem" here is the exact same thing as "one of your Yubikeys", basically.

That seems like an enormous pain if you have dozens or hundreds of services. It could take hours to do this one at a time. (I'm assuming one minute per service, though that depends on how hard it is to find the "add another authenticator" page for each service.)

It's possible I'm unaware that there is a simple protocol for this. Am I incorrect here?

Post reply on HN