Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Passkey

developer.apple.com

Post reply on HN
Print view View original

181–190 of 421 posts

Re: Apple Passkey

#181

Post by sircastor »

kccqzy wrote: post #174
Vladimof wrote: post #168

Earlier quoted context omitted.

ahhh so they already have what they need to do iCloud E2EE, they just decide not to use it for your data....

Yup. Probably because law enforcement would be livid if Apple did that. In the San Bernardino terrorist case, Apple basically said triggering an iCloud backup is the best way to get the contents of a locked iPhone. Apple routinely supplies law enforcement with contents of iCloud backup.

It remains one of the clearest examples of law enforcement wanting a friction-free solution for getting data out of iOS without Apple. They could have easily attained the information and have been doing so for years. They were explicitly trying to generate sympathy towards a backdoor solution.

What's sort of surprising to me is how much they overestimated public support for their cause.

Re: Apple Passkey

#183

Post by smorks »

dyml wrote: post #165

This is wonderful news! If anyone is interested in experimenting we built an API that makes it very simple to add WebAuthn (passkeys) to your existing web app. It’s available at https://passwordless.dev Note: We also maintain the open source fido2-net-lib, the API just lowers the friction for devs.

i use fido2-net-lib for a personal auth site, it works great! thanks for all your work!

Re: Apple Passkey

#184

Post by majewsky »

acka wrote: post #169

Sorry for the somewhat but not quite off topic post, but can we please prevent HN from becoming yet another Apple billboard? There are more than enough of those already. Thank you. Yes I've heard that there may be some Apple manifestation going on or something but to have every little Apple tidbit hoisted directly to the front page (at least 7 articles and counting) is a bit much imho. Downvote me if you must, but I…

That's just how Apple does their announcements: in big piles at few dates. The alternative would be to dribble them out slowly. As someone who is not particularly interested in Apple news either, I actually prefer this. Better get it out of the way in one fell swoop than have one announcement every other week that dominates the discussion all the time. Things being as they are, there are 3-4 Apple events per year, and so there are 48-49 weeks without big Apple news.

Re: Apple Passkey

#186

Post by samwillis »

Vladimof wrote: post #168
0xCMP wrote: post #159

Earlier quoted context omitted.

iCloud Backups != iCloud syncing iiuc. Passwords/Wifi/etc. syncing is a different E2EE system. You can disable iCloud Backups and still use iCloud

ahhh so they already have what they need to do iCloud E2EE, they just decide not to use it for your data....

E2EE would have made it significantly harder for Apple to build the web based apps at iCloud.com. Not to say that shouldn’t have though, but I can understand whey they didn’t.

Re: Apple Passkey

#187

Post by al_borland »

zxcvgm wrote: post #46

This is based on the open standards WebAuthn and FIDO2, where the credentials (“passkeys”) are synced via iCloud Keychain. Currently you need remember to register at least 2 security keys, in case one is lost/misplaced. The syncing of passkeys in iCloud solves this backup problem. https://fidoalliance.org/apple-google-and-microsoft-commit-t...

>Currently you need remember to register at least 2 security keys, in case one is lost/misplaced.

This is always my issue with 2FA or passwordless auth. You're forced to have 2 devices and are kind of screwed if you don't hvae two on you.

I was on a trip and broke my iPhone. It had my plane tickets on it to get home. I was able to get a replacement from Apple, they just gave it to me and sent me on my way. When I turned it on it wanted me to authenticate with one of my other Apple devices. By dumb luck I happened to have my iPad with me. If I didn't have that, I'm not sure what I would have done.

A co-worker told me to move all my 2FA to Authy as a means to avoid locking 2FA to hardware, but I haven't sufficently looked into it yet.

While I don't like passwords and understand their very real security limitations. I'm also not a fan of my phone becoming my identity.

Re: Apple Passkey

#188

Post by simplify »

acka wrote: post #169

Sorry for the somewhat but not quite off topic post, but can we please prevent HN from becoming yet another Apple billboard? There are more than enough of those already. Thank you. Yes I've heard that there may be some Apple manifestation going on or something but to have every little Apple tidbit hoisted directly to the front page (at least 7 articles and counting) is a bit much imho. Downvote me if you must, but I…

This post is related to a large number of developers and startups (read: HN users), many of which have at least an iOS app or support safari. I don't see what the problem is.

Re: Apple Passkey

#189

Post by plonk »

samwillis wrote: post #186
Vladimof wrote: post #168

Earlier quoted context omitted.

ahhh so they already have what they need to do iCloud E2EE, they just decide not to use it for your data....

E2EE would have made it significantly harder for Apple to build the web based apps at iCloud.com. Not to say that shouldn’t have though, but I can understand whey they didn’t.

Does anyone use that? It's nice to have when I want to access my data from the web, which is never, and it's not worth the loss of security.

But I imagine the FBU wouldn't like an end-to-end encrypted iCloud Photos at all.

Post reply on HN