201–210 of 274 posts
If anyone wants to deploy this server-side, I made a Django library that's very easy to use: https://gitlab.com/stavros/django-webauthin You can see a demo login here: https://www.pastery.net/ It allows the user to log in without a username or a password (untested on any Apple device as I don't have any, please file bugs if it doesn't work).
If anyone wants to deploy this server-side, I made a Django library that's very easy to use: https://gitlab.com/stavros/django-webauthin You can see a demo login here: https://www.pastery.net/ It allows the user to log in without a username or a password (untested on any Apple device as I don't have any, please file bugs if it doesn't work).
Hmm, on an iPhone it asked me to hold my authentication device near the top of the phone, it didn’t use faceid at all... :/
Face or finger data is akin a login name... What is the password in that case? Because if you cant change your password, that could be a problem
Earlier quoted context omitted.
There are some differences between Safari and WKWebView. Some features are blocked.
It's funny how much bashing Google gets for monopoly with Android, pushing users to use Chrome, Play Store and whatnot. While all of that is relevant, Apple's stranglehold seems much more and worse.
I’ve never noticed that criticism come up in the wild. The criticism I’ve seen of Android is that it’s primarily a surveillance device with a questionable security model.
The Safari team do move slowly.
Earlier quoted context omitted.
Not as securely or cheaply: using 1Password this way either requires less secure TOTP codes (which are easily phished) or a separate token. Having this available to every Apple user on the web is huge, especially when you look at the network benefits of the Apple feature pushing all of the slackers (hi, every large financial company!) to implement secure MFA.
How are TOTP codes more phishable? Seems like the same phishability to me
Machinery to take that TOTP code and immediately plug it into the real bank (since it's time sensitive) exists already.
In contrast WebAuthn credentials are tied to the domain name of the site. Your iPhone doesn't have any credentials for https://fake-bank.example/ so it won't sign you in, and even if it did have credentials for fake-bank.example they'd be completely useless on the https://real-bank.example/ web site. There is no way to give real-bank credentials to fake-bank, it just can't work because the cryptographic material used is tied to the domain name.
Google deployed an earlier iteration of this same technology and reported zero phishing for accounts protected this way because it isn't possible to see how to phish it without some grave security bug somewhere. This is the penicillin of web user security, it's a night-and-day difference over what we had before.
A fingerprint can be a personal password or it can be a government ID, but it can’t be both. Since the U.S. government already has something like 200 million fingerprints on file, and many foreign governments collect fingerprints whenever you travel, these fingerprints are sometimes leaked en masse ( https://en.wikipedia.org/wiki/Office_of_Personnel_Management... ), and because they can never be changed, biometrics a…
But I think you missed the point about the second factor, because there are really 2 factors here: 1. Something you have (e.g. your phone, in this case the Secure Enclave that stores the private key). 2. Something you 'know', e.g. your fingerprint. Just having the fingerprint itself is not sufficient.
Earlier quoted context omitted.
Webauthn actually fully supports this model as "platform authenticators", ie hardware security modules built into the client system. You see this on the windows side too where "Windows Hello" integrates with the TPM and acts as a platform authenticator as well. No need to speak roughly.
* you don't need the TPM for Windows Hello to act as your security key. I can't enable BitLocker because there's no TPM yet I have Hello enrolled as a key for GH.
Earlier quoted context omitted.
The attestation is a signed (digital) document saying basically "We are $manufacturer and we made this $product and we promise it has these desirable security properties". In WebAuthn the design is that a batch of (at least 1000 but usually far more) authenticator products should have such a document which Javascript can optionally request (together with proof they didn't just knock it off from another authenticator)…
The point of the video was that when using the device as the authenticator, attestation reveals details of the phone (such as the unique private key used to prove the phone is valid to a manufacturer). The anonymous attestation authority here allows Apple to be assert to the qualities of the device without the device having to reveal identifiers externally. This is akin to a batch of identifiers the size of all Apple…
There are already designs if you are quite sure you must have attestation and yet you don't want device identification. You can do blinded attestation and agl has written up a much fancier approach on his blog too.
But again, Don't Ask, Don't Tell. The video shows this silly demo "Shiny picture" site asking for attestation and that's a bad idea you should not replicate, write "none" instead of "direct" and then the problem goes away for your site.