Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID and Touch ID for the Web

developer.apple.com

Post reply on HN
Print view View original

141–150 of 274 posts

Re: Face ID and Touch ID for the Web

#141

Post by sirn »

sygma wrote: post #76
WA wrote: post #58

Earlier quoted context omitted.

For interested readers: 1Password does a few more things. For example, you can add 2FA to 1Password logins, so that 1Password replaces Google Authenticator with the immense advantage that you don’t have to setup 2FA again if you get a new device. Just a happy 1Password user, nut related to them in any way.

Is it really 2FA if your password and your token are on the same device?

One could argue that authenticating via 1Password is already multi factor in itself e.g. Master Password is Something You Know as the first factor and access to a 1Password Vault is Something You Have as a second factor (since you cannot login to 1Password with just username and password, but also requires a Secret Key that can only be acquired from a device that already logged in).

In this case TOTP acts more like an insecure one-time session key.

Re: Face ID and Touch ID for the Web

#142

Post by jackson1442 »

sirn wrote: post #122
Skunkleton wrote: post #105

Earlier quoted context omitted.

With Okta (since gp mentioned it), you would sign in with a password, then click the "yes its me" button on your phone, or you could use TOTP, or even a yubikey.

Okta is more of a SAML/OpenID Connect thing with built-in multi factor authentication than a replacement for WebAuthn, though. Okta could embrace WebAuthn Platform Authenticator as one of their authenticating factor if user is unwilling to install an app, but a website isn't expected to use Okta as a second factor in their authentication flow.

OP is referring to how you already can sign in to Okta as a website, not as an authentication mechanism. You can create a sign in flow that goes like so:

username -> password -> [ WebAuthn | Okta Verify Push ]

This approach can be used on any website, just with a regular TOTP code in place of the proprietary Okta Verify Push.

Re: Face ID and Touch ID for the Web

#143

Post by sirn »

jackson1442 wrote: post #142
sirn wrote: post #122

Earlier quoted context omitted.

Okta is more of a SAML/OpenID Connect thing with built-in multi factor authentication than a replacement for WebAuthn, though. Okta could embrace WebAuthn Platform Authenticator as one of their authenticating factor if user is unwilling to install an app, but a website isn't expected to use Okta as a second factor in their authentication flow.

OP is referring to how you already can sign in to Okta as a website, not as an authentication mechanism. You can create a sign in flow that goes like so: username -> password -> [ WebAuthn | Okta Verify Push ] This approach can be used on any website, just with a regular TOTP code in place of the proprietary Okta Verify Push.

Ah I didn't know you could do the Okta push without using their whole SSO suite. Thank you! I guess in this scenario Okta acts more like Authy proprietary OTP thing then.

Re: Face ID and Touch ID for the Web

#144

Post by tialaramex »

Spivak wrote: post #5
theboat wrote: post #2

If the web migrates to biometric sensors for authentication, I hope this won't suffer from vendor lock-in. When every new device ships with facial recognition and/or a fingerprint reader, it will be nice to login using my face/fingerprint irrespective of the device I'm on.

I don't see how this could ever be something not vendor-specific because without this being tied to "Log in with Apple" you're just saying "trust the client." Maybe that's fine if all you want is to "lock" a sensitive page to people who aren't the device owner but that's pretty limited compared to FaceID to actually log in.

It has no relationship to "Log in with Apple". It's a WebAuthn authenticator.

Almost all web sites should just implement WebAuthn. On a suitable iPhone or Mac users will be able to sign in by touching the sensor or looking at the camera, while on my Pixel phone I touch the fingerprint sensor, on this Linux desktop I touch a Yubico Security Key.

If your site is paranoid that some crazy user will choose a bad WebAuthn authenticator, or deliberately sabotage their own security for some reason, then you can use WebAuthn Attestation to obtain a signed document from the authenticator (yes, over the Web) which proves that it is, for example, an Apple iPhone 25 Super Mega Plus. I don't think you should bother doing that, but you can.

Re: Face ID and Touch ID for the Web

#145

Post by jiveturkey »

Tepix wrote: post #47
jiveturkey wrote: post #39

Earlier quoted context omitted.

it doesn't do that, since there's no attestation.

Did you watch the video?

where he says it is "not included"? (because the Apple secure enclave does not attest keys.)

also where he falsely alludes to other attestations being identifying? sure, they can be, but they generally aren't.

Re: Face ID and Touch ID for the Web

#147

Post by monocasa »

Dahoon wrote: post #136
monocasa wrote: post #118

Earlier quoted context omitted.

> They are generally happy to hand over iCloud backups That one they legally have to do when given a subpoena.

They could encrypt everything and not have the keys. So not really.

The whole point of the backup is that you'll be able to access it even if you your device and it's keystore are destroyed.

Re: Face ID and Touch ID for the Web

#148

Post by BillinghamJ »

lifeisstillgood wrote: post #7

So roughly speaking this is WebAuthn for a web site, with the iphone acting as the dongle. It's a really good idea. I can see there being a big demand for just simplifying signin - I can easily see a time where it is worth not having the hassle of managing multiple signin processes and just choosing webauth or nothing. Edit: to be clear this won't affect B2C sites whose monetisation is based on getting as many people…

It'd be really nice to see this working with iCloud Keychain at some point too - so you can have FIDO working as a secure platform thing but with syncing and dealing with the problem of effectively losing your keys over time etc

Re: Face ID and Touch ID for the Web

#149

Post by jmull »

LockAndLol wrote: post #127

The last I read, if you wanted security then Face ID and Touch ID definitely weren't the way to go. I'd rather see Apple pick up something like SQRL[0] than continue down this path of pseudo-security. They work, but it's like having a half-blind doorman who can't tell if you're wearing a mask or if it's your real face. 0: https://www.grc.com/sqrl/sqrl.htm

> The last I read, if you wanted security then Face ID and Touch ID definitely weren't the way to go.

Sounds vague and overly general. I don't think anyone can take this seriously without some more information.

Re: Face ID and Touch ID for the Web

#150

Post by ryukafalz »

dividuum wrote: post #140
ryukafalz wrote: post #109

Earlier quoted context omitted.

There's no reason a browser couldn't have generated a new self-signed client certificate for each site, though; the fact that they don't offer that as an option is just a browser design decision.

There was actually a html tag used within s to generate a keypair what was then supposed to be signed by the server and finally returned to the browser for local installation. At least that's how I understand it. It's been deprecated for a while now.

Oh wow, yeah - I didn't realize that existed, and now I'm sad it never caught on. :(
Post reply on HN