Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID and Touch ID for the Web

webkit.org

Post reply on HN
Print view View original

271–280 of 371 posts

Re: Face ID and Touch ID for the Web

#271

Post by rmrfrmrf »

MobileVet wrote: post #265
drexlspivey wrote: post #129

This comes 3 days after a leak that alleged that iPhone 13 will bring back Touch ID via in-screen fingerprinting https://www.techradar.com/uk/news/move-over-iphone-12-apples...

Please please please be true. TouchID is objectively superior to FaceId, by a long shot. It is my soap box... but TouchID RARELY failed and could be activated BEFORE you had the phone in front of you. FaceID fails constantly and MUST be in view to start the unlock process. TouchID has a single failure mode (and a half) that isn't that common. Wet / dampness. Solution, dry your finger, try again. Gloves are the 'half'…

I live in a cold climate, so I was happy to be done with TouchID. Then coronavirus happened and now it doesn't recognize me with a mask on.

Re: Face ID and Touch ID for the Web

#272

Post by ROARosen »

snowwrestler wrote: post #169
yegle wrote: post #33

Earlier quoted context omitted.

"Sign in with Apple" requires a developer account with Apple. Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". (FWIW, the only 2fa with "Sign in with Apple", if you don't own any Apple hardware, is SMS.)

It's pretty clear Epic set out to intentionally get their Apple developer account terminated so they would have standing to sue, so I would not draw too much inference from that. That said, it's generally true that any dependence on a platform is a form of risk. There are documented examples of Google kicking people out of their ecosystem unexpectedly too. Federated sign-in schemes may be a good idea if they help you…

>It's pretty clear Epic set out to intentionally get their Apple developer account terminated so they would have standing to sue, so I would not draw too much inference from that.

Nevertheless, the suspension still clearly highlights the fealty you are expected to give to Apple being a dev on their platform, or else.

Re: Face ID and Touch ID for the Web

#273

Post by cpuguy83 »

MobileVet wrote: post #265
drexlspivey wrote: post #129

This comes 3 days after a leak that alleged that iPhone 13 will bring back Touch ID via in-screen fingerprinting https://www.techradar.com/uk/news/move-over-iphone-12-apples...

Please please please be true. TouchID is objectively superior to FaceId, by a long shot. It is my soap box... but TouchID RARELY failed and could be activated BEFORE you had the phone in front of you. FaceID fails constantly and MUST be in view to start the unlock process. TouchID has a single failure mode (and a half) that isn't that common. Wet / dampness. Solution, dry your finger, try again. Gloves are the 'half'…

Have you tried switching the "Require attention for Face ID" off? Usually it can get you before you are "looking at it".

I've been using Face ID since the xs, and so far my experience is, outside of mask wearing, much better than Touch ID. But I also try not to touch my phone when I'm out (and as such am wearing a mask). I even occasionally can't use Touch ID on my MacBook because of a damp finger, and that sees far less usage than the phone.

I think early on low light (or rather barely any light) was a problem, but I can unlock it in a dark room these days... not sure what that means for accuracy... but it works well.

Re: Face ID and Touch ID for the Web

#274

Post by [deleted] »

kinkrtyavimoodh wrote: post #159
madeofpalk wrote: post #158

Earlier quoted context omitted.

This doesnt really surprise me - Apple has a history of implementing, or moving to, standards for their platform features in Safari. I think about Apple Pay for web - it started out as a proprietary API, and then the Payment Request API standard was developed and they added support for that. It's in Apple's interest to help develop and support standards like this because they mean more adoption of their platform feat…

I am still waiting for them to move to USB-C

[deleted]

Re: Face ID and Touch ID for the Web

#275

Post by stouset »

simonw wrote: post #137
ogre_codes wrote: post #109

Earlier quoted context omitted.

As a user I would prefer no account in most cases. As a distant second, I would prefer the convenience, security, and privacy of Sign in with Apple over Google, Facebook, or the headache of managing yet another web account . As a developer, I use my preferences as a user to steer my choices, but recognize that the world doesn't revolve around Apple so would allow other options. > Having saw Epic's developer account t…

> Since I have zero need to deliberately violate Apple's App Story policy, I don't worry about this overmuch. That may be true today, but their policies are a moving target. Who knows what they'll be like in a year's time?

How does this argument not apply to Facebook and Google?

Hint: It does, 100%. Epic could pick a fight with Google, tomorrow, that culminates in the same exact outcome.

Re: Face ID and Touch ID for the Web

#276

Post by enos_feedler »

Teever wrote: post #208
enos_feedler wrote: post #187

Earlier quoted context omitted.

It isn’t productive to establish defense against an arbitrary future that turns on you. Spend those brain cycles focusing on your user and building a great product. Choosing Sign in with Apple is great for Apple users.

> It isn’t productive to establish defense against an arbitrary future that turns on you. It isn't? Isn't that like, the hallmark of intelligence?

I think you watch too much Doomsday Preppers

Re: Face ID and Touch ID for the Web

#277

Post by jimmydorry »

chadlavi wrote: post #212
hk__2 wrote: post #201

Earlier quoted context omitted.

> I am still waiting for them to move to USB-C What do you mean? All Mac models introduced since 2016 support USB-C. https://support.apple.com/en-us/HT201736

Not OC, but they probably mean iPhones. I wish iPhones would switch to USB-C too; my iPhone is now the only device I own that isn't USB-C.

In another generation or two, I would expect it to be port-less (wireless). This generation was the one to change to USB-C if it were on their roadmap... but I guess time will tell.

Re: Face ID and Touch ID for the Web

#278

Post by jimmydorry »

gwillen wrote: post #203
lilyball wrote: post #189

Earlier quoted context omitted.

I really hate the "we're going to send a code to your email" approach because it so often breaks. Case in point, I tried to log into Patreon earlier today, they insisted on sending a code, and it never arrived. I tried several times, no email. I have a record of every email sent to my address for the past several years regardless of spam status so I can be 100% positive they simply never sent it. In the end I had to…

I'm curious -- do you host your own email, or use a lesser-known email provider? I am increasingly seeing failures where sites seem to be blackholing outgoing email, I suspect based on the destination domain, and unaware that they are even doing this / extremely insistent that they are not. I've gotten login-email failures like you describe from a couple of sites, and seemingly similar failures from those "email your…

Patreon has had many outages in the last few weeks, typically for 30mins to 2hours at a time.

The outages have been affecting their authentication (login and sending emails) as well as the API.

Their status page is also very slow to update. This shows a fraction of the outages that myself and others have experienced. https://status.patreon.com/

Re: Face ID and Touch ID for the Web

#280

Post by tialaramex »

mrwnmonm wrote: post #258
notatoad wrote: post #253

Earlier quoted context omitted.

You can think of a private key like a really long, complicated password. Like, thousands of characters. But you don't have to type it in every time, you just let your phone store it for you and fill it in for you in apps (and now, websites). To log into a website, your iPhone checks to see if your face is your face, and if it is then unlocks your private key to send it to the website. If it can't identify your face,…

So does my phone has a different private key for every website?

Yes. In WebAuthn every single time you enroll on some web site with this system, a completely random new private key will be generated and the site will be given the corresponding public key and a fresh magic "cookie" identifier that serves no other purpose.

Your Apple device remembers the association between this particular web site, any user ID the site said is relevant (e.g. maybe the username mrwnmonm and friendly name "Shiny Steve") the cookie, and the private key.

On subsequent visits either of two things can happen:

1. You tap some sort of easy-one-touch login button. The Apple device says "Hey, sign in here as mrwnmonm / Shiny Steve?" and you use your touch ID to prove you are still you, this unlocks the private key, Safari uses the private key to create a proof that you still know that key, attaches the proof, and the cookie. The site recognises you must be Shiny Steve and you're in.

2. You sign in "normally" (e.g. with a username and password) but then as a Second Factor the site shows the Apple Device the cookie it remembers, your device recognises this cookie and prompts you for a touch to prove you are still Shiny Steve, whereupon it uses the private key to sign a proof and send it back to the site.

Because the keys are different on every site even if two web sites deliberately work together to try to figure out if a user on one site is the same person as a user on another site, WebAuthn doesn't help them do that at all.

Also unlike passwords or most other schemes, there's no risk from mass data loss because the web site is storing public information. If a "dump" of every Facebook WebAuthn public key was made, that's essentially useless to everybody except Facebook anyway, whereas obviously a password dump or a dump of all the TOTP secrets would be a huge security problem.

Post reply on HN