Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID and Touch ID for the Web

developer.apple.com

Post reply on HN
Print view View original

21–30 of 274 posts

Re: Face ID and Touch ID for the Web

#21

Post by toomuchtodo »

elwell wrote: post #18

1Password users can already have effectively the same experience.

Apple users will get this natively without having to acquire 1Password. If you’ve bought into the Apple ecosystem and don’t have needs outside of it (Windows, Linux), you can eliminate the need for a separate password manager. Similar to how iCloud Files is moving towards (but likely won’t meet, while not needing to) Dropbox parity.

This is making a friendly version of Yubikeys (using Apple devices) and password vaults for Apple users.

Re: Face ID and Touch ID for the Web

#23

Post by chanmad29 »

toomuchtodo wrote: post #21
elwell wrote: post #18

1Password users can already have effectively the same experience.

Apple users will get this natively without having to acquire 1Password. If you’ve bought into the Apple ecosystem and don’t have needs outside of it (Windows, Linux), you can eliminate the need for a separate password manager. Similar to how iCloud Files is moving towards (but likely won’t meet, while not needing to) Dropbox parity. This is making a friendly version of Yubikeys (using Apple devices) and password vaul…

so one more instance of Apple effectively rendering a third party app useless. As an apple user, I love that I do not need to install an additional app but something does not feel right from an ethical standpoint. Or maybe I'm just being too touchy.

Re: Face ID and Touch ID for the Web

#24

Post by crispyporkbites »

barbegal wrote: post #16

This isn't that revolutionary: LastPass already allows you to use biometric ID to authenticate and it works without any changes to the website.

Right but Apple have done it and they have actual market share and 100% control of the end to end device

Re: Face ID and Touch ID for the Web

#25

Post by EGreg »

Just to state the obvious...

Biometric data must always stay on your personal device in order to be secure from replay attacks, not to mention finding out more about you.

https://amp.theguardian.com/world/2019/sep/04/smile-to-pay-c...

Of course, in Apple’s implementation, the data never leaves the device. Which is far better than, say, how facial recognition is used in China for payment where the merchant is the one operating the machine which scans your face.

Re: Face ID and Touch ID for the Web

#26

Post by toomuchtodo »

chanmad29 wrote: post #23
toomuchtodo wrote: post #21

Earlier quoted context omitted.

Apple users will get this natively without having to acquire 1Password. If you’ve bought into the Apple ecosystem and don’t have needs outside of it (Windows, Linux), you can eliminate the need for a separate password manager. Similar to how iCloud Files is moving towards (but likely won’t meet, while not needing to) Dropbox parity. This is making a friendly version of Yubikeys (using Apple devices) and password vaul…

so one more instance of Apple effectively rendering a third party app useless. As an apple user, I love that I do not need to install an additional app but something does not feel right from an ethical standpoint. Or maybe I'm just being too touchy.

I would rather have a native UX versus Bitwarden, especially if there’s no additional cost (I have to pay for Bitwarden annually or spend time running a server) and an easy way to share creds with my partner (for delegation in the event of my passing).

Competition and a free market has perils. May the best solution win.

Re: Face ID and Touch ID for the Web

#27

Post by lemoncucumber »

BiteCode_dev wrote: post #22

Giving my finger and face prints to the browser, the software with the biggest attack surface in the world, connected to internet no less, feels off to me.

Native apps have long been able to use TouchID/FaceID and have never been able to access the actual finger/face print data. There's no way that iOS exposes your actual finger or face print to websites.

Re: Face ID and Touch ID for the Web

#28

Post by brandonhorst »

BiteCode_dev wrote: post #22

Giving my finger and face prints to the browser, the software with the biggest attack surface in the world, connected to internet no less, feels off to me.

All of that is managed by the Secure Enclave in exactly the same way that it is for all over auth on Apple devices. The browser doesn't touch it at all.

Re: Face ID and Touch ID for the Web

#29

Post by KMnO4 »

BiteCode_dev wrote: post #22

Giving my finger and face prints to the browser, the software with the biggest attack surface in the world, connected to internet no less, feels off to me.

They're not giving your fingerprint or face image to the browser. They're simply providing the ability to authenticate using iOS hardware.

Re: Face ID and Touch ID for the Web

#30

Post by jrockway »

barbegal wrote: post #16

This isn't that revolutionary: LastPass already allows you to use biometric ID to authenticate and it works without any changes to the website.

It also doesn't add any security. Your password can still be guessed or phished. When authenticating with a cryptographic token (U2F/WebAuthn), that vector goes away. (Even OTP can be phished... the phishing site can just ask you for the code.)

Password managers do make it more difficult to get phished, since they will not know what password to autofill on phishing.example.com... but on the other hand, password manager users are used to having to force-fill a password. I have to take my password out of LastPass to log into Battle.net or Fusion 360, and websites like the Wall Street Journal create your account on dowjones.com but require you to log in on wsj.com (or maybe it's the opposite, I forget).

With WebAuthn, more care is required for both the site operator and the user (have more than one way of logging in in case you lose your phone, make sure the enrollment and login origins are the same), but you are then open to fewer attacks.

Post reply on HN