Earlier quoted context omitted.
And end-to-end encryption doesn't have to break that: https://security.googleblog.com/2018/10/google-and-android-h...
That's not end to end encryption, the key is stored in a HSM in Google's data center in that case. They can be subpoenaed for it.
Face ID and Touch ID for the Web
241–250 of 274 posts
Re: Face ID and Touch ID for the Web
#242Earlier quoted context omitted.
I think that this is coming in the next release of Safari, so MDN is correct, it's not currently supported.
WebAuthn API is supported in WebKit starting from Safari 13 and iOS 13. The MDN chart needs to be properly updated.
User verification + resident keys were never implemented in Safari 13.
Re: Face ID and Touch ID for the Web
#243Face or finger data is akin a login name... What is the password in that case? Because if you cant change your password, that could be a problem
The biometric data never leaves your device. Your biometric is only used to unlock a private key stored in the secure enclave of your phone. This private key is then used to sign a server-sent challenge. The phone sends this signed challenge back to the server, where the server can validate it using the public key. The public/private key gets generated by the phone upon first registration with the server.
Re: Face ID and Touch ID for the Web
#244FaceID is one of the most important technology invented. Imagine if Apple somehow was open to license it and make it universal like Bill Gates wanted to make PCs universal. It can make driver licenses, passports, credit cards, student IDs, insurance IDs - all of these can be things of past. You go to grocery store and simply pay using your face. You want to pay online? Simply look at FaceID device that is now standar…
Otherwise I don't understand why iPhone doesn't support "guest" profile via FaceID. Or iPad doesn't allow multiple users(family) on the same device by simply "looking at it"
Re: Face ID and Touch ID for the Web
#245Apple is considering this to be multi-factor authentication all in one click, the something you have (the phone) and the something you are (FaceID or TouchID). For the site perspective, if you ask for attestation then you will have cryptographic evidence of this. No more SMS 2FA! Apple is promising to do something extra with their attestation process which they call "Apple Anonymous Attestation" to mitigate the issue…
WebAuthn has two scenarios. For something like an iPhone or a Windows laptop we can choose to have the device store a heap of credentials mapped to domain names. So your Safari sees this is cat-videos.example and the iPhone knows credentials for cat-videos.example so .get() fetches those credentials without needing IDs and the site doesn't (if it does things this way) need to ask for a username first. This is called "resident key" because the device remembers which keys it has and you can have your site say during registration that you prefer this outcome, or even that you insist upon it by setting it as "required".
The other scenario is older and very clever, it is used for things like a cheap FIDO USB dongle. It stores nothing, the device doesn't know who you are. This means it cannot provide that seamless "no need to enter your username" UX, however it does work well as a second factor and can be used as a sole factor if you want. How can it work if the device doesn't remember credentials? Well the WebAuthn ID is deliberately big enough to "hide" encrypted keys inside it. Instead of remembering your credentials after registration like this Safari feature, a cheap FIDO dongle encrypts the private key it'll need and then gives that to the web site to store as an ID, alongside the public key. When you give the site your username, it fishes out the IDs associated with your user and hands those to get() in that buffer you spotted. The user's web browser shows these IDs to any FIDO dongles and if one of them made that ID it can decrypt it successfully and authenticate you.
So the overall answer to your question is: It depends.
The cheapest simplest WebAuthn setup uses it only as a second factor and would need a username every time.
A very nice UX focused on being as seamless as possible for Apple users wouldn't need a username unless you're using a device you haven't authorised this way before. The video shows such a UX because that's what Apple wants you to do for their users.
Re: Face ID and Touch ID for the Web
#246So for the non-developer, is this basically as if any participating website could send an 2FA request to your iPhone (like the role of the SMS code but more secure), have the iPhone verify you by face/touch, and then confirm back to the website and let you in? (also like Google does with their app?). Or even take the place of a password?
When you register for this feature, your Apple device gives the site an ID (a really huge random-looking number) and a public key. The site associates this ID and key with your user.
On subsequent visits you do something (e.g. press "Face Sign In" button on the site) and then your device authenticates you (with Face ID/ Touch ID) and if you pass it sends the same ID, and some signed stuff about this authentication. The site matches the ID, finds your user, checks the signed stuff is OK with the public key is stored before, and you're in - no other steps and very secure.
WebAuthn can do simpler journeys that only replace the second factor or as a single factor but with the user still needing to provide their username first, but Apple is pushing developers to have this lovely journey that suits the Face ID/ Touch ID experience on an Apple product.
Re: Face ID and Touch ID for the Web
#247So roughly speaking this is WebAuthn for a web site, with the iphone acting as the dongle. It's a really good idea. I can see there being a big demand for just simplifying signin - I can easily see a time where it is worth not having the hassle of managing multiple signin processes and just choosing webauth or nothing. Edit: to be clear this won't affect B2C sites whose monetisation is based on getting as many people…
Can someone explain how does it work behind the scenes? As I see it, data is stored in a secure enclave separate from the processor and OS. It only provides a match value based on the generated digital private key. So phones will create a separate pair for every site and send the public key with credentials so the server can verify it with the device. Wouldn't apple have to open source their hardware as well?
Here, the iPhone functions as a platform authenticator, like a U2F usb/nfc key would. Why would they need to open source their hardware for this?
Re: Face ID and Touch ID for the Web
#248Sometimes it feels like I'm the only one that doesn't trust biometric sensors. I mean it's basically magic. If for any reason the face detection algorithm doesnt match your face anymore you have the equivalent problem of losing the master password to your entire password store.
If my finger is rejected multiple times, I am asked for the password instead.
Re: Face ID and Touch ID for the Web
#249If anyone wants to deploy this server-side, I made a Django library that's very easy to use: https://gitlab.com/stavros/django-webauthin You can see a demo login here: https://www.pastery.net/ It allows the user to log in without a username or a password (untested on any Apple device as I don't have any, please file bugs if it doesn't work).
Re: Face ID and Touch ID for the Web
#250Earlier quoted context omitted.
Can someone explain how does it work behind the scenes? As I see it, data is stored in a secure enclave separate from the processor and OS. It only provides a match value based on the generated digital private key. So phones will create a separate pair for every site and send the public key with credentials so the server can verify it with the device. Wouldn't apple have to open source their hardware as well?
This uses WebAuthn ( https://webauthn.guide - https://webauthn.io ). The video has a great description starting at 1:40. Here, the iPhone functions as a platform authenticator, like a U2F usb/nfc key would. Why would they need to open source their hardware for this?