Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID and Touch ID for the Web

developer.apple.com

Post reply on HN
Print view View original

171–180 of 274 posts

Re: Face ID and Touch ID for the Web

#171

Post by GoMonad »

snuxoll wrote: post #164
gorgoiler wrote: post #162

Isn’t this a classic example of the fragility of biometrics? If I move to a new device, iOS should be required to give up whatever secret key my face translates to, so I can log into websites. Simplistically, if iOS silently turned my face into the web password “g0rG0il3r”, when I eventually migrate from iOS to something new, I’ll have to be able take my face password with me, thus exposing that my face was only ever…

WebAuthN is not supposed to be the only way you log into a service. The credentials are permanently tied to your Authenticator of choice, which can be lost or stolen at any time. If you change devices you just provision the new one for your account after signing in with a traditional username/password(/2nd-factor).

FIDO/WebAuthn has been designed to be first factor authentication (passwordless) as well as 2FA.

Though, I agree lost and stolen devices are a problem whose solution space needs more exploring than simply multiple auth devices.

Re: Face ID and Touch ID for the Web

#172

Post by bfulgham »

jiveturkey wrote: post #39
duskwuff wrote: post #13

Earlier quoted context omitted.

That's a really interesting point. If this really does allow a web user to prove that a human interacted with the computer, it'd make for a really nice CAPTCHA replacement.

it doesn't do that, since there's no attestation.

Yes there is. The video covers this clearly.

Re: Face ID and Touch ID for the Web

#174

Post by bfulgham »

GoMonad wrote: post #171
snuxoll wrote: post #164

Earlier quoted context omitted.

WebAuthN is not supposed to be the only way you log into a service. The credentials are permanently tied to your Authenticator of choice, which can be lost or stolen at any time. If you change devices you just provision the new one for your account after signing in with a traditional username/password(/2nd-factor).

FIDO/WebAuthn has been designed to be first factor authentication (passwordless) as well as 2FA. Though, I agree lost and stolen devices are a problem whose solution space needs more exploring than simply multiple auth devices.

This is, of course, an active thread of discussion in the WebAuthentication working group.

Re: Face ID and Touch ID for the Web

#175

Post by tialaramex »

amluto wrote: post #80
jrockway wrote: post #30

Earlier quoted context omitted.

It also doesn't add any security. Your password can still be guessed or phished. When authenticating with a cryptographic token (U2F/WebAuthn), that vector goes away. (Even OTP can be phished... the phishing site can just ask you for the code.) Password managers do make it more difficult to get phished, since they will not know what password to autofill on phishing.example.com... but on the other hand, password manag…

WebAuthn is less phishing resistant than it should be. The original intent was that WebAuthn + token binding would ensure that, even if an attacker obtained a fraudulent certificate for a victim site and had an MITM position on the network, the attacker still couldn’t steal a WebAuthn protected session. Alas, Chrome removes its token binding implementation, and WebAuthn no longer has this property. If you authenticat…

The WebAuthn specification still explains how you could get token binding if it's present, it's just that it isn't present on any major implementations today.

I'm not sure I believe that real bad guys can successfully attack the Web PKI yet would be foiled by a site using token binding. I think crooks sophisticated enough to burn an exploit to get themselves a fraudulent certificate and put themselves on path for the main attack probably just break into the actual target web server and dispense with everything else entirely. I'd welcome token binding as an option, but I expect I'd never use it in my software.

Re: Face ID and Touch ID for the Web

#176

Post by the_svd_doctor »

hn_throwaway_99 wrote: post #168
aarongray wrote: post #165

A fingerprint can be a personal password or it can be a government ID, but it can’t be both. Since the U.S. government already has something like 200 million fingerprints on file, and many foreign governments collect fingerprints whenever you travel, these fingerprints are sometimes leaked en masse ( https://en.wikipedia.org/wiki/Office_of_Personnel_Management... ), and because they can never be changed, biometrics a…

But I think you missed the point about the second factor, because there are really 2 factors here: 1. Something you have (e.g. your phone, in this case the Secure Enclave that stores the private key). 2. Something you 'know', e.g. your fingerprint. Just having the fingerprint itself is not sufficient.

This is key. I just hope this never changes and we never end up in a situation where the fingerprint is all that is used.

Because for most non technical user, my bank app asking my fingerprint to unlock the app is exactly that. They don't really get the difference.

Re: Face ID and Touch ID for the Web

#177

Post by alanwaketan »

jedieaston wrote: post #6
theogravity wrote: post #3

I wonder what part of the Web Auth APIs does iOS Safari support since MDN says most of the APIs are not supported. https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent...

I think that this is coming in the next release of Safari, so MDN is correct, it's not currently supported.

WebAuthn API is supported in WebKit starting from Safari 13 and iOS 13. The MDN chart needs to be properly updated.

Re: Face ID and Touch ID for the Web

#178

Post by jodrellblank »

Dahoon wrote: post #135
jodrellblank wrote: post #101

Earlier quoted context omitted.

Apple sells between 10-20% of smartphones per quarter[1], that implies Android makes up 80+% and Windows/Blackberry a neglible amount. How can Apple be a monopolist from such a small position, or have a "stranglehold" when they are outsold 4-8x by the competition? [1] https://www.statista.com/statistics/216459/global-market-sha...

So you are comparing Android vs iOS. You cannot see how that is Apples Vs Oranges? Just because something is based on Android doesn't make Everything Android vs iOS a direct comparison. Try Google Phones Vs Apple phones or Huawei vs Apple.

It is a direct comparison, because Google control Android.

The poster I replied to compared Google and Apple using the terms "stranglehold" and "monopoly". These terms don't work because Apple don't have control of most of the smartphone market, so they can't be a monopoly. Through Android, Google do control most of the smartphone market, so they might have a monopoly effect on the smartphone market. Apple aren't in any position to strongarm things. Google are.

Therefore whatever Apple does with iOS can't be "worse" from this perspective. It could be worse for users, but it can't be "worse" monopolistically for Apple to affect 20% of the market in Apple's favour, than it is for Google to affect 80% of the market in Google's favour.

Google could strongarm Huawei and Sony and LG and all the other Android manufacturers. Apple couldn't. Google could strongarm 80% of smartphone users, Apple only 20%.

Re: Face ID and Touch ID for the Web

#179

Post by bfulgham »

crispyporkbites wrote: post #32
rovr138 wrote: post #8

Earlier quoted context omitted.

The issue is that it's just a token that would simply say Passed/Fail. So it's trusting the client/browser.

If the token is signed you could validate it with Apple (or the vendor that implemented the face recognition on the device, eg Samsung, Nokia, pinephone etc). You just need an open standard, you could even embed the url of the validating api in the token, so anyone could create their own Face ID provider.

That's precisely what the attestation section of the talk describes. This is all part of the WebAuthentication standard.

Re: Face ID and Touch ID for the Web

#180

Post by GekkePrutser »

cactus2093 wrote: post #92
jacobr1 wrote: post #82

This really is just bringing WebAuthn to Safari. I've been using it via chrome w/ TouchID for our corporate okta SSO and it has been working great. WebAuthn is really just a way to make public-key/private-key crypto scale. The user never really knows about or interacts with the keys. The website doesn't store a password, they store a public key. The user doesn't know about the private key (paired to the public key) t…

How does this work if you need to sign in to a site on a borrowed computer while traveling or something? Is the private key derivable from a master password or something?

I'm surprised nobody has mentioned this but you can also use a hardware FIDO2 token for Webauthn. Like a Yubikey. This is ideal if you use many computers.

If you need to sign in on a borrowed computer you visit the site, it'll ask you to insert the yubikey (if not already), you enter the PIN code and touch it, that's it.

I believe a yubikey with fingerprint instead of PIN (or additionally? Information is scarce on it) is also coming.

Post reply on HN