Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID and Touch ID for the Web

developer.apple.com

Post reply on HN
Print view View original

271–274 of 274 posts

Re: Face ID and Touch ID for the Web

#271

Post by amluto »

tialaramex wrote: post #175
amluto wrote: post #80

Earlier quoted context omitted.

WebAuthn is less phishing resistant than it should be. The original intent was that WebAuthn + token binding would ensure that, even if an attacker obtained a fraudulent certificate for a victim site and had an MITM position on the network, the attacker still couldn’t steal a WebAuthn protected session. Alas, Chrome removes its token binding implementation, and WebAuthn no longer has this property. If you authenticat…

The WebAuthn specification still explains how you could get token binding if it's present, it's just that it isn't present on any major implementations today. I'm not sure I believe that real bad guys can successfully attack the Web PKI yet would be foiled by a site using token binding. I think crooks sophisticated enough to burn an exploit to get themselves a fraudulent certificate and put themselves on path for the…

If you include attackers who control an organizational MITM CA in your threat model, then this could be a big deal. If I were, say, a bank, I would like WebAuthn to protect me against compromise of an organization’s MITM box. Token binding can do this to some extent.

Re: Face ID and Touch ID for the Web

#272

Post by aaomidi »

playpause wrote: post #93
aaomidi wrote: post #19

Earlier quoted context omitted.

There isn't a reason it wouldn't work - the browsers all use the same engine anyway.

This isn't really true any more. Apple requires their competitors' browser apps to use a 'webview' to display websites, and Safari does not use this. The iOS webview may share a layout/paint engine with Safari, but it is heavily restricted in other ways. Apps with webviews (like Chrome for iOS) can't have extensions, for example. But the subtlest, cleverest restriction is that webviews are forced to use an older and…

Interesting, thank you for the information!

Re: Face ID and Touch ID for the Web

#273

Post by tialaramex »

amluto wrote: post #271
tialaramex wrote: post #175

Earlier quoted context omitted.

The WebAuthn specification still explains how you could get token binding if it's present, it's just that it isn't present on any major implementations today. I'm not sure I believe that real bad guys can successfully attack the Web PKI yet would be foiled by a site using token binding. I think crooks sophisticated enough to burn an exploit to get themselves a fraudulent certificate and put themselves on path for the…

If you include attackers who control an organizational MITM CA in your threat model, then this could be a big deal. If I were, say, a bank, I would like WebAuthn to protect me against compromise of an organization’s MITM box. Token binding can do this to some extent.

Surely in most MITM box scenarios the token binding just isn't possible?

The only correct MITM box design for TLS is back-to-back client and server, and with that structure there are two TLS channels instead of the one you expected so you can't bind anything to "the" channel between your client and the destination server as there are in fact two channels.

Hacks to try to do something else invariably break and make everything worse. The resulting wreckage for TLS 1.3 took a year of engineering plus an extra year of whining MITM box owners reluctant to stop doing broken crap. We certainly don't want to encourage more of that.

Re: Face ID and Touch ID for the Web

#274

Post by navanchauhan »

jammmety wrote: post #255
navanchauhan wrote: post #252

Earlier quoted context omitted.

It works 100% of the time when I have both WiFi and Bluetooth on, when do you face problems?

It doesn't work if both devices are connected to different WiFi networks. But Airdrop works without being connected to any AP…

Yes, either you are both connected to the same WiFi network or both of you are not, kind of weird
Post reply on HN