Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID and Touch ID for the Web

webkit.org

Post reply on HN
Print view View original

251–260 of 371 posts

Re: Face ID and Touch ID for the Web

#251

Post by Polylactic_acid »

jjcm wrote: post #28

These all seem to be examples that use faceID/touchID as a password. That’s not what biometrics should be though, they should be the username. I hope that this is supported as a flow as well. Identify who you are with biometrics, and prove your access with a correlated password.

I might be wrong but I don't think thats how its working. It sounds like your phone saves a password/key locally and then when you load a website, faceid is used by your phone to unlock the keyring and sends the normal password to the website.

I'm not sure what the UX is when moving devices though.

Re: Face ID and Touch ID for the Web

#252

Post by Polylactic_acid »

mrwnmonm wrote: post #247
notatoad wrote: post #195

Earlier quoted context omitted.

you're right that using biometric data for authentication is bad, but that's not what's happening here. faceid/touchid stores a private key on your device, and uses your biometrics to unlock that private key. it's the same idea as using a yubikey or something where you have to press the button on the 2fa dongle to prove it's physically in your posession and unlock the private key stored within it, but it goes beyond…

I know very little about security. Could you please explain it in simpler way? So, does my iPhone create a private key (which my Face ID data) on the phone itself, then the browser ask the phone to do something to authenticate the user? I am lost here.

Your phone holds the passwords for the websites but they passwords never get presented to the user. FaceID is just used to unlock the password store. You would have to steal a phone and trick faceid on the phone to gain access to someones account.

Re: Face ID and Touch ID for the Web

#253

Post by notatoad »

mrwnmonm wrote: post #247
notatoad wrote: post #195

Earlier quoted context omitted.

you're right that using biometric data for authentication is bad, but that's not what's happening here. faceid/touchid stores a private key on your device, and uses your biometrics to unlock that private key. it's the same idea as using a yubikey or something where you have to press the button on the 2fa dongle to prove it's physically in your posession and unlock the private key stored within it, but it goes beyond…

I know very little about security. Could you please explain it in simpler way? So, does my iPhone create a private key (which my Face ID data) on the phone itself, then the browser ask the phone to do something to authenticate the user? I am lost here.

You can think of a private key like a really long, complicated password. Like, thousands of characters. But you don't have to type it in every time, you just let your phone store it for you and fill it in for you in apps (and now, websites).

To log into a website, your iPhone checks to see if your face is your face, and if it is then unlocks your private key to send it to the website. If it can't identify your face, then it won't enter your password.

Sending your actual facial data to a website would be bad because you can't change your face, so if you give your face to one site, then that site could use it to log in as you to other sites. But by just using it to unlock a private key, you (or apple on your behalf) can still change or de-authorize your private key, and use a unique one for each sites. Basically all the good practices you're supposed to follow when you use a password, and they aren't giving any site any special data that they could use anywhere other than their own site.

Re: Face ID and Touch ID for the Web

#254

Post by mrwnmonm »

Polylactic_acid wrote: post #252
mrwnmonm wrote: post #247

Earlier quoted context omitted.

I know very little about security. Could you please explain it in simpler way? So, does my iPhone create a private key (which my Face ID data) on the phone itself, then the browser ask the phone to do something to authenticate the user? I am lost here.

Your phone holds the passwords for the websites but they passwords never get presented to the user. FaceID is just used to unlock the password store. You would have to steal a phone and trick faceid on the phone to gain access to someones account.

Sorry, I still don't see the improvement here, doesn't that already happen using chrome for example, or Touch ID with 1password? (I think IOS has that too)

Re: Face ID and Touch ID for the Web

#256

Post by Dahoon »

enos_feedler wrote: post #187
simonw wrote: post #137

Earlier quoted context omitted.

> Since I have zero need to deliberately violate Apple's App Story policy, I don't worry about this overmuch. That may be true today, but their policies are a moving target. Who knows what they'll be like in a year's time?

It isn’t productive to establish defense against an arbitrary future that turns on you. Spend those brain cycles focusing on your user and building a great product. Choosing Sign in with Apple is great for Apple users.

And sign in with X is good for X users. Doesn't really add anything.

Re: Face ID and Touch ID for the Web

#257

Post by arcticbull »

snowwrestler wrote: post #169
yegle wrote: post #33

Earlier quoted context omitted.

"Sign in with Apple" requires a developer account with Apple. Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". (FWIW, the only 2fa with "Sign in with Apple", if you don't own any Apple hardware, is SMS.)

It's pretty clear Epic set out to intentionally get their Apple developer account terminated so they would have standing to sue, so I would not draw too much inference from that. That said, it's generally true that any dependence on a platform is a form of risk. There are documented examples of Google kicking people out of their ecosystem unexpectedly too. Federated sign-in schemes may be a good idea if they help you…

Apple isn't perfect, and yeah, you might run into a situation where you have to sue. Them taking away the ability for half your users two sign in to your app while your dispute makes its way through the courts is seriously problematic.

Re: Face ID and Touch ID for the Web

#258

Post by mrwnmonm »

notatoad wrote: post #253
mrwnmonm wrote: post #247

Earlier quoted context omitted.

I know very little about security. Could you please explain it in simpler way? So, does my iPhone create a private key (which my Face ID data) on the phone itself, then the browser ask the phone to do something to authenticate the user? I am lost here.

You can think of a private key like a really long, complicated password. Like, thousands of characters. But you don't have to type it in every time, you just let your phone store it for you and fill it in for you in apps (and now, websites). To log into a website, your iPhone checks to see if your face is your face, and if it is then unlocks your private key to send it to the website. If it can't identify your face,…

So does my phone has a different private key for every website?

Re: Face ID and Touch ID for the Web

#259

Post by djrogers »

mortenjorck wrote: post #42

The UI probably needs to be more explicit about what's going on. I would imagine most non-technical users aren't well-versed in how Apple's Secure Enclave (or other competing solutions) manage authentication, and so I wouldn't be surprised if "allow example.com to use TouchID" would give many the impression that the website is asking to access their biometric data. Ideally, the prompt should reflect the actual model,…

> I wouldn't be surprised if "allow example.com to use TouchID"

This is already a very common pattern on ios devices - every app that wants to allow touch or face ID based login uses such prompts, so users are used to it.

Re: Face ID and Touch ID for the Web

#260

Post by jen729w »

arcticbull wrote: post #257
snowwrestler wrote: post #169

Earlier quoted context omitted.

It's pretty clear Epic set out to intentionally get their Apple developer account terminated so they would have standing to sue, so I would not draw too much inference from that. That said, it's generally true that any dependence on a platform is a form of risk. There are documented examples of Google kicking people out of their ecosystem unexpectedly too. Federated sign-in schemes may be a good idea if they help you…

Apple isn't perfect, and yeah, you might run into a situation where you have to sue. Them taking away the ability for half your users two sign in to your app while your dispute makes its way through the courts is seriously problematic.

I don’t think it’s ever been shown that Apple did this at all, let alone maliciously.

If anyone has a source to the contrary, we need it here please. And I mean a documented source, not hearsay.

Edit: there’s discussion below.

Post reply on HN