181–190 of 274 posts
Android is doing the same thing: Android phones are now also capable of being a FIDO2 authenticator for Webauthn.
Now what we need is many more sites actually offering it :) I'm already using it for Office 365 but that's really the only one so far that I use that offers it.
I think it's pretty ridiculous that Apple pours time and effort into stuff like this but apps have been able to steal from your clipboard for years. It reminds me of the phenomenon when researchers and engineers don't work on something that's useful for everyday users, instead prioritizing what they find exciting and cool. The security team is so busy dealing with absurd edge cases like nation-states attacking your e…
I dont see a problem with this as part of MFA, but here in the US our fifth amendment protections are pretty lax, and only cover passwords (sometimes). If the police wanted to force your fingerprint or face ID to log into a website (say, maybe a protest message board), they can do it just the same as they can force your blood draw during a DUI with a warrant from a judge.
Earlier quoted context omitted.
> The last I read, if you wanted security then Face ID and Touch ID definitely weren't the way to go. Sounds vague and overly general. I don't think anyone can take this seriously without some more information.
You are but a duck-search away Face ID defeated with glasses and tape https://appleinsider.com/articles/19/08/08/face-id-security-... Touch ID defeated by lifted fingerprints 2013: https://arstechnica.com/information-technology/2013/09/defea... 2016: https://appleinsider.com/articles/13/09/22/apples-touch-id-a... 2019: https://www.forbes.com/sites/daveywinder/2019/11/02/smartpho... Biometric "security" on phones is a…
E.g. from the first article you linked:
> the attack is only really useful against unconscious victims, requiring both physical access and the tricky move of placing glasses on their face without waking them up.
All authentication mechanisms have limitations, BTW.
So roughly speaking this is WebAuthn for a web site, with the iphone acting as the dongle. It's a really good idea. I can see there being a big demand for just simplifying signin - I can easily see a time where it is worth not having the hassle of managing multiple signin processes and just choosing webauth or nothing. Edit: to be clear this won't affect B2C sites whose monetisation is based on getting as many people…
ios/macos already let you copy/paste between them if you have bluetooth enabled on both sides and are signed in the same icloud account on both. I wonder if they're planning to let me authenticate/webauthn on macos using my phone as a platform authenticator?
Apple is considering this to be multi-factor authentication all in one click, the something you have (the phone) and the something you are (FaceID or TouchID). For the site perspective, if you ask for attestation then you will have cryptographic evidence of this. No more SMS 2FA! Apple is promising to do something extra with their attestation process which they call "Apple Anonymous Attestation" to mitigate the issue…
Interesting, Apple is letting you change your default web browser with this new iOS version, but also adding Face ID and Touch ID to Safari. Why would anyone want to build these features if they're so platform / browser specific? Does anyone know if these auth features might work on other browsers on iPhone?
There isn't a reason it wouldn't work - the browsers all use the same engine anyway.
Layout engine and even rendering etc. is quite distinct from the other browser features. What goes on in front of your eyes is fairly separate from networking, security all those other nice things.
So roughly speaking this is WebAuthn for a web site, with the iphone acting as the dongle. It's a really good idea. I can see there being a big demand for just simplifying signin - I can easily see a time where it is worth not having the hassle of managing multiple signin processes and just choosing webauth or nothing. Edit: to be clear this won't affect B2C sites whose monetisation is based on getting as many people…
ios/macos already let you copy/paste between them if you have bluetooth enabled on both sides and are signed in the same icloud account on both. I wonder if they're planning to let me authenticate/webauthn on macos using my phone as a platform authenticator?
There are UX issues there that have to be solved yet. Also, while I haven't gotten my hands deep in what Apple has done yet I suspect this is a browser-level feature and not a platform-level feature, where say your phone would pop up a "do you want to authenticate" screen when held near another computer with BLE the same way you get "do you want to use Apple Pay" today.
Platform level support would allow me to use this directly within other applications and browsers, rather than just from Safari and the SFSafariViewController/ASWebAuthenticationSession Safari-managed views.
So roughly speaking this is WebAuthn for a web site, with the iphone acting as the dongle. It's a really good idea. I can see there being a big demand for just simplifying signin - I can easily see a time where it is worth not having the hassle of managing multiple signin processes and just choosing webauth or nothing. Edit: to be clear this won't affect B2C sites whose monetisation is based on getting as many people…
It'd be really nice to see this working with iCloud Keychain at some point too - so you can have FIDO working as a secure platform thing but with syncing and dealing with the problem of effectively losing your keys over time etc
Typically deploying WebAuthn means that you have to put more thought into your account recovery flows - you don't want to deploy strong authentication to fall back to email or KBA-based recovery, for example. Then, this recovery may be used both to recover from a lost device as well as to just add a second device.