Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Passkey

developer.apple.com

Post reply on HN
Print view View original

141–150 of 421 posts

Re: Apple Passkey

#141

Post by zozbot234 »

zamalek wrote: post #117
jml7c5 wrote: post #100

Earlier quoted context omitted.

That seems like an enormous pain if you have dozens or hundreds of services. It could take hours to do this one at a time. (I'm assuming one minute per service, though that depends on how hard it is to find the "add another authenticator" page for each service.) It's possible I'm unaware that there is a simple protocol for this. Am I incorrect here?

You are 100% correct that you need to add it to each service. This is a consequence of an intentional decision (keys cannot be duplicated). Streamlining it would definitely be an improvement. That being said, it's not a problem in the real-world because FIDO is so sparsely supported. Hopefully PassKey speeds things along.

The relevant WebAuthn standard actually supports keys regardless of whether they can be duplicated. Even "virtual", software-only keys are supported. It's up to each individual service whether they allow the user to enroll such keys.

Re: Apple Passkey

#142

Post by gwbas1c »

mhoad wrote: post #63

How do I leave the Apple ecosystem if I go all in on this? Sounds like major vendor lock in under a deceptive title of “open standards” but I’m hoping I’m wrong here. Does anybody happen to know yet?

As long as your account is tied to your email address, there should be something similar to a password reset.

Re: Apple Passkey

#143

Post by pvg »

yieldcrv wrote: post #111

I think we need a browser level or OS level notification about which passwordless service we used last time. Did we use Gmail, Twitter, Signin with Apple, Github, Linkedin, or do I actually have something stored in my password manager associated with an email and if so, did I store it in the browser's password manager, the OS's password manager, or my third party password manager?

The browser and the OS credentials managers essentially obsolete the third party password manger so that part is sort of 'solved'. Integration between the browser and OS one (with sync) is quite a bit trickier but the real blocker is that Apple and Google aren't much interested in solving it. The terawatts of brain power that went into the anonymized COVID tracker phone thing which turned out to be largely pointless could be applied to this, it just doesn't feel very likely.

Re: Apple Passkey

#144

Post by WorldMaker »

atonse wrote: post #85

My wife signed up for calm.com using Sign in with Apple. Thanks to this, I am not able to occasionally use her login to listen to the wonderful music. There's just no way in hell I'm paying the $60 a year or whatever they're asking to listen to a couple songs every now and then. In a normal setting, she'd add her login to her 1password and I'd be able to use Calm.com, and who knows, I would've grown to love it, and g…

"Sign in with Apple" does have a very bare-bones OIDC flow in the browser on non-Apple devices/browsers. That flow takes you through a typical Apple Cloud login flow with Apple ID email and password and usual 2FA if it's the first time on that browser/device.

To meet bare minimum requirements sites like Calm.com often only show the "Sign In with Apple" button for iOS and iPadOS user agents. You can sometimes fake an iOS/iPadOS user agent and get the buttons to show up and then switch the User Agent back to get the boring in-browser OIDC flow.

As an iOS/iPadOS but Windows PC user I find it frustrating how many websites intentionally hide that button in other browsers, just when dealing with my own accounts.

I feel like Apple could maybe do a better job of education here: "please don't hide the button on non-iOS/iPadOS user agents". I hope Apple has strong developer education plans for Passkey.

Re: Apple Passkey

#146

Post by nobodywasishere »

mceachen wrote: post #66
epaulson wrote: post #56

I can be onboard with this if Apple opens up an iCloud API for syncing, so I can sync a non-Apple device through iCloud, and if I leave Apple and iCloud behind, my non-Apple devices keep working, even if I never sync through iCloud again.

C'mon. Non-Apple devices aren't _even remotely_ a priority for them. Just look how bad Apple Music is on Android and web.

Apple Music on Android is actually really good, I use it daily. On some level it was a priority for them for market share, to compete with Spotify. I don't see the "competitor" in this space (cloud) though that would drive that necessity.

Re: Apple Passkey

#148

Post by booi »

WorldMaker wrote: post #133
kps wrote: post #90

Earlier quoted context omitted.

I'm writing this on a non-Apple computer that doesn't have any radios. Now what?

Buy a cheap USB dongle for BLE?

Also, in what world can you buy a computer with no radios anymore. Even $10 SOC computers have radios.

Re: Apple Passkey

#149

Post by Rafert »

stetrain wrote: post #147
saos wrote: post #145

How does this impact 1Password going forward?

1Password is also part of FIDO. I assume if you want to use 1Password on Apple devices to store passkeys that should work fine, just like it does for passwords today. https://blog.1password.com/1password-is-joining-the-fido-all...

They've already put this WebAuthn teaser up: https://www.youtube.com/watch?v=lYFxfchhR1g

Re: Apple Passkey

#150

Post by aseipp »

judge2020 wrote: post #69
aseipp wrote: post #50

Earlier quoted context omitted.

Passkeys are available for general use in any application through the system frameworks, not just the browser; they simply use WebAuthn under the hood, but it's meant to expand support outside of the browser for more apps in more use cases. I wrote another comment elsewhere but there are some other issues with using WebAuthn as a primary authentication mechanism right now, especially things like new device enrollment…

> Also we still need ways of exporting keys and software (like 1password) needs to synchronize them, manage them securely. There's still a long ways to go on that front, which probably won't be handled until stuff like this has settled. That's the point of passkeys here: iCloud Keychain syncs them, and if you want to use your keys on a non-apple device you'll be able to scan a QR code, which initiates a new BLE conne…

Yes, obviously, but I was mostly referring to being able to share outside iCloud keychain, and in general 3rd party software support for this -- but, I wasn't aware of the BLE option, which is very interesting! I'm already very invested in 1Password (which I would like to integrate somehow, ideally) but that's good to know
Post reply on HN