Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Passkey

developer.apple.com

Post reply on HN
Print view View original

171–180 of 421 posts

Re: Apple Passkey

#171

Post by [deleted] »

anony999 wrote: post #43
albertgoeswoof wrote: post #23

Does anyone know if this is different to Webauthn? You can already login with touchid/faceid, with the private key stored in apples keychain. Lots of sites support it, I just added it as 2FA to Mailpace ( https://blog.mailpace.com/blog/why-we-use-webauthn-for-2fa/ ), making it passwordless login instead of 2FA is trivial and fully supported by webauthn. What’s different about this?

>> Apple has described Passkey as a new kind of credential in the iCloud keychain. The technology is based on the Web Authentication API (WebAuthn), a rapidly emerging standard that uses public key cryptography instead of passwords for authenticating users to websites and applications. Whatever "based on webauthn" means...Let's hope it's not just a buggy implementation of WebAuthn as they did with OpenID Connect

[deleted]

Re: Apple Passkey

#172

Post by corrral »

shralpmeister wrote: post #129
mceachen wrote: post #66

Earlier quoted context omitted.

C'mon. Non-Apple devices aren't _even remotely_ a priority for them. Just look how bad Apple Music is on Android and web.

The AppleTV app on my LG TV is the best third party app on it, IMO. Looks and works great.

Their Roku and AndroidTV apps are also good. I'm not sure I've ever even used the service on a piece of Apple hardware, and it's never been a problem.

Re: Apple Passkey

#173

Post by dwaite »

tialaramex wrote: post #57
albertgoeswoof wrote: post #23

Does anyone know if this is different to Webauthn? You can already login with touchid/faceid, with the private key stored in apples keychain. Lots of sites support it, I just added it as 2FA to Mailpace ( https://blog.mailpace.com/blog/why-we-use-webauthn-for-2fa/ ), making it passwordless login instead of 2FA is trivial and fully supported by webauthn. What’s different about this?

As far as I can see this is Apple's (thus macOS / iOS) platform for FIDO, whereas WebAuthn does FIDO for the Web. So, if you have macOS or iOS software for Mailpace, this is a way to have the same workflow for that as you get with WebAuthn for the web site. Android likewise has an API for apps to get this, as well as the Chrome browser on Android having WebAuthn, and if you have apps on both platforms it might make s…

> Technology wise the key difference is that for WebAuthn the Relying Party ID - the thing that distinguishes GitHub from Facebook (for example) is based on a DNS name, and that's verified by your web browser, while for these app APIs the RPID is based on some platform identifier and is verified by the host OS.

The native APIs on Android, Apple and Microsoft platforms leverage relying party IDs which are web origins (e.g. https://github.com) whether doing native or web apps. The same native API is typically used by say Github Desktop as say the Chrome Browser.

A native app needs an entitlement and a file on the web server to enable functionality for particular domains. A browser gets an entitlement to request credentials for all domains.

Re: Apple Passkey

#174

Post by kccqzy »

Vladimof wrote: post #168
0xCMP wrote: post #159

Earlier quoted context omitted.

iCloud Backups != iCloud syncing iiuc. Passwords/Wifi/etc. syncing is a different E2EE system. You can disable iCloud Backups and still use iCloud

ahhh so they already have what they need to do iCloud E2EE, they just decide not to use it for your data....

Yup. Probably because law enforcement would be livid if Apple did that. In the San Bernardino terrorist case, Apple basically said triggering an iCloud backup is the best way to get the contents of a locked iPhone. Apple routinely supplies law enforcement with contents of iCloud backup.

Re: Apple Passkey

#175

Post by ChadNauseam »

Ajedi32 wrote: post #74
mhoad wrote: post #63

How do I leave the Apple ecosystem if I go all in on this? Sounds like major vendor lock in under a deceptive title of “open standards” but I’m hoping I’m wrong here. Does anybody happen to know yet?

Yeah, that's going to be the next big ecosystem challenge for WebAuthn in my opinion. Ideally platforms would support 3rd party password managers, so you could manage your keys without having to tie your credential database to any one specific platform. I'm sure as the popularity of WebAuthn grows there'll be more and more demand for cross-platform compatibility until eventually the big players are forced to implemen…

That would be nice. I used Hanko for one service I built that uses WebAuthn+email, so new devices get a one-time code in their email and existing just use WebAuthn. It would be kind of nice not to have to rely on email, but it's better than making people remember passwords.

Re: Apple Passkey

#176

Post by altairprime »

howinteresting wrote: post #30
xmdx wrote: post #19

Earlier quoted context omitted.

They said in the event that everything is synced on iCloud so all your devices can use the keys, which makes me think no, it's just a password manager, without the password bit. Maybe they create a separate key for each device, but then why mention iCloud syncing at all.

It's a password manager with cryptographic vendor lockin . There are definitely some benefits though, such as immunity from phishing. Surely we as the industry can bring them about in a way that doesn't involve cryptographic vendor lockin.

The industry doesn’t seem to have a working software solution for mobile phone authentication secrets that both is 1) immune to persuading a user to export their data (to get phished), and 2) allows a user to export their data at any time (to prevent lock-in).

What would it look like to do #2 safely, without enabling the phishing that we see today with #1?

Re: Apple Passkey

#177

Post by dane-pgp »

blamestross wrote: post #98
throwaway92394 wrote: post #89

Does anyone know how this/FIDO/Webauthn affect privacy? How well supported are alt accounts? Are they easy to tell they're from the same signer? I figure privacy is fine as long as the implementations allow you to select which account to login with. Is this currently a thing? From everything I read it seems like the current implementations are only meant to support one identity? EDIT: These are great responses, also…

FIDO/WebauthN are generally "the good guys" when it comes to privacy bc "bring your own secure hardware key" is always an option. I'm kinda torn over the "use your cellphone as a key" approaches as not privacy friendly but we can't actually prevent them (you can always simulate a key).

> you can always simulate a key

But you can't simulate an attestation that you're using a device from one of the "approved" manufacturers in the cartel. This is basically DRM for human identity.

https://nitter.net/sleevi_/status/1392903827712512001

Re: Apple Passkey

#179

Post by stetrain »

here4funzies wrote: post #127

If this is about "[hardware devices] for generating and authenticating accounts" like WebAuthn FIDO et al what happens when I upgrade my Macbook. Do I revert back to password in order to associate the new private key (or hardware generate password) with my existing account?

The keys are synced through iCloud Keychain, presumably also to your new Mac.

Re: Apple Passkey

#180

Post by mtgx »

Vladimof wrote: post #168
0xCMP wrote: post #159

Earlier quoted context omitted.

iCloud Backups != iCloud syncing iiuc. Passwords/Wifi/etc. syncing is a different E2EE system. You can disable iCloud Backups and still use iCloud

ahhh so they already have what they need to do iCloud E2EE, they just decide not to use it for your data....

Yes, this is known:

https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...

Post reply on HN