Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID and Touch ID for the Web

webkit.org

Post reply on HN
Print view View original

191–200 of 371 posts

Re: Face ID and Touch ID for the Web

#191

Post by dkonofalski »

toomuchtodo wrote: post #73
virtue3 wrote: post #41

Earlier quoted context omitted.

https://developer.apple.com/forums/thread/123774 Not the only ones that randomly gets their accounts terminated. Based on how apple has -insane- fragmentation and security for different aspects of the company, I would doubt any employee that isn't directly tied into the store accounts would know the whole details. (Source: GF worked for the department that did art/design for the apple stores, no one had access to the…

I use Sign In with Apple everywhere I can (so many of my passwords are in haveibeenpwned datasets), and if Apple blacklisted a provider I use, I’d expect the service to email me to migrate to their own email/password identity provider (if I didn’t hide my email from them with SIWA), with a link to the migration process in the email.

Same except that, if Apple blacklisted a provider, I'd want to know why they got blacklisted. At this point, I trust Apple as a neutral third party more than I trust most other companies since Apple isn't incentivized to sell my info.

Re: Face ID and Touch ID for the Web

#192

Post by roughly »

JoeAltmaier wrote: post #55
dustinmoris wrote: post #49

Earlier quoted context omitted.

That doesn't make sense. Username + Password is a cumbersome workaround because (so far) machines couldn't use biometrics to authenticate a user. Now they can, so we can let go of that very problematic and often insecure model. Think like this, when you go to visit your grandmother and knock on her door you don't have to provide a password. You don't have to provide anything, because the human brain is capable of det…

Biometrics fails every test for a password. 1) A password is secret 2) You don't leave copies of it lying around everywhere 3) You can change it periodically 4) If discovered, it can't be traced back to you No, biometrics can only be a username. It can never be an acceptable password.

Biometrics fail every test for a password, but, assuming sufficient accuracy, work pretty well for Authentication, which is the actual purpose of a password.

Biometrics are closer to a public key than a password.

Re: Face ID and Touch ID for the Web

#193

Post by hawkoy »

KMnO4 wrote: post #71
krtkush wrote: post #50

Earlier quoted context omitted.

> I would definitely stay away from any "Sign in with Apple". I would stay away from any "Sign in with.." service as a user and as a product owner. You're affectively giving away a major control of your users to a third party.

As a product owner, why wouldn't I want to piggyback on the millions of dollars of R&D + security that the big companies have put in? And as a user, why would I trust my password to the website that rolled their own authentication over the big companies?

As a user, I recently deleted x account. I used login with x on a few services and now I can't access them anymore.

This situation is solvable by implementing forget password and storing user's email but many services don't and with a system similar to apple's where you mask the email or phone number, you can't do anything.

Re: Face ID and Touch ID for the Web

#194

Post by spondyl »

znpy wrote: post #183

I've come to appreciate DigitalOcean's approach on the matter. Until you configure a 2FA device (TOPT in my case) they'll send you a temporary code to your email address. So password alone is worthless, and mailbox ownership is verified on every login. Also, I made a point never to use the "login with X" feature, no matter what X is. I always sign up with my own email.

I would agree except I always had issues where I would never receive their TOTP emails. I was using Fastmail and had my spam settings set very leniently.

Fastmail Support claimed they never received any mail (ie it hadn't bounced) but DigitalOcean Support would insist I check my spam folder for the 500th time.

Ultimately, I just swore to never use their services, primarily because I... could never log in and actually use their services.

I think it's fixed nowadays but I wasted so much time on that issue.

Re: Face ID and Touch ID for the Web

#195

Post by notatoad »

Zaheer wrote: post #77

You can change a password but you can't change your fingerprint / palm / etc. Am I missing something? How is Face / Touch ID more secure that user + pass? What happens when biometric data is leaked?

you're right that using biometric data for authentication is bad, but that's not what's happening here. faceid/touchid stores a private key on your device, and uses your biometrics to unlock that private key. it's the same idea as using a yubikey or something where you have to press the button on the 2fa dongle to prove it's physically in your posession and unlock the private key stored within it, but it goes beyond just pressing a button by doing some biometric identification.

the concern isn't what if the biometric data is leaked, because the biometrics are only used to allow local access to your phone. the concern is what if the private keys stored in your phone are leaked. and the secure enclave makes that as close to impossible as any other existing solution.

Re: Face ID and Touch ID for the Web

#196

Post by vinceguidry »

enos_feedler wrote: post #187
simonw wrote: post #137

Earlier quoted context omitted.

> Since I have zero need to deliberately violate Apple's App Story policy, I don't worry about this overmuch. That may be true today, but their policies are a moving target. Who knows what they'll be like in a year's time?

It isn’t productive to establish defense against an arbitrary future that turns on you. Spend those brain cycles focusing on your user and building a great product. Choosing Sign in with Apple is great for Apple users.

It absolutely can be productive. So many people have done as you said and had the rug ripped out from under them by $ARBITRARY_PLATFORM_DECISION (cough cough YouTube) that if they had thought the risk they were taking on by going with one platform they might still be in business.

Re: Face ID and Touch ID for the Web

#197

Post by StavrosK »

rektide wrote: post #21
blintz wrote: post #13

So happy Apple decided to go with an open standard here rather than something proprietary. This is good news for the FIDO2 ecosystem and I hope this leads to far greater support for FIDO2 authenticators of all types. There is another world in which Apple just pushed 'Sign in with Apple' and created yet another federated identity provider rather than true, 'secure element'-based FIDO2 authentication.

I dunno. I mean, I do, it feels good. But it also is a very different kind of FIDO2 than what we've seen before. In a way that FIDO was designed for, that we hoped would happen. But it's still not entirely joy & mirth that we're here for me. It feels like a little like the first day we start to understand how "Big Tent" (in the OpenStack sense) FIDO2 ecosystem is. You can do whatever, make anything, and call it FIDO2…

So what exactly is the concrete downside here, apart from the icky word "platform", that, in this context, means "a security chip that's not removable", ie as opposed to a Yubikey or such.

Re: Face ID and Touch ID for the Web

#198

Post by dwaite »

dane-pgp wrote: post #172
dwaite wrote: post #48

Earlier quoted context omitted.

> So if an attacker tampers with the physical device, they can revoke the key for that particular device so that it is no longer trusted (the way I am reading it) vs yubikey where if an attacker has messed with one key, there is no good way to revoke attestation for that one device. Attestation is a statement that the hardware and firmware are genuine, with the trust model being based on genuine hardware/software. Yo…

> allowing someone to authenticate into a lower security level until they re-register the phone after upgrading their operating system. Instead of "This site requires IE6" we'll have "To log back into your account, please buy an iPhone 12 Pro Max and re-register". I'm imagining an undesirable future where having access to different sites requires carrying around multiple different pieces of authentication hardware, a…

Firefox and Chrome both prompt before disclosing the attestation information of your key, adding a UX tax to asking for attestations.

The protocol also does not have a way to get the browser to 'filter' potential authentication methods to just say a google titan key or iPhone 12. So while sites might determine whether to show the authentication options by scraping user agents like they always have, they can't get the browser to handle the user tapping the wrong kind of key. Instead, the browser has to repeatedly inform the user of what went wrong and drive the user through registration/authentication.

So websites _can_ restrict things to a particular form of authentication, but in many cases it may lead to a sub-par user experience. They may also need to tune this repeatedly, for instance to allow other browsers once Apple makes this available to them, or say pushing the authentication experience from desktop to phone or watch.

Since Android and Windows Hello support the same API, platform restrictions in particular have been just asking for more rope to hang yourself with. Such restrictions have been required up to this point because the platform support has been spotty (with Android being the current third place)

Re: Face ID and Touch ID for the Web

#199

Post by dwaite »

virtue3 wrote: post #41
dwaite wrote: post #36

Earlier quoted context omitted.

Apple did not terminate Epic's SiwA account, and several journalists have sources within Apple that say that Apple never sent the message Epic claimed to receive that said access was going away.

https://developer.apple.com/forums/thread/123774 Not the only ones that randomly gets their accounts terminated. Based on how apple has -insane- fragmentation and security for different aspects of the company, I would doubt any employee that isn't directly tied into the store accounts would know the whole details. (Source: GF worked for the department that did art/design for the apple stores, no one had access to the…

That does not necessarily have anything to do with SiwA, however.

Re: Face ID and Touch ID for the Web

#200

Post by hawkoy »

karlshea wrote: post #131
KMnO4 wrote: post #71

Earlier quoted context omitted.

As a product owner, why wouldn't I want to piggyback on the millions of dollars of R&D + security that the big companies have put in? And as a user, why would I trust my password to the website that rolled their own authentication over the big companies?

Well one issue as a user is trying to remember which third-party auth was used when I first created the account (did I use Facebook? Google? Twitter?).

Well, you can get access to the email on all three so it's not a huge problem for vast majority of whom only maintain single email address.
Post reply on HN