Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID and Touch ID for the Web

webkit.org

Post reply on HN
Print view View original

291–300 of 371 posts

Re: Face ID and Touch ID for the Web

#291

Post by ogre_codes »

gowld wrote: post #224
ogre_codes wrote: post #207

Earlier quoted context omitted.

It is more of an monopsony[1] than a monopoly. If you are looking to buy a smartphone there are still options. If you are looking to sell software for smart phones, Apple is by far the most lucrative platform and they have a lock on publishing software for iOS. It is very difficult in the US to survive as a software developer for Android only. The anti-trust frameworks in the US are based largely on monopolies and th…

Apple sits between users and developers. If it's a monopsony on one side, it's a monopoly on the other side.

Not remotely. Users can buy Android phones.

Having ~50% market share is not a monopoly.

Even suggesting Apple has monopsony as I did above is a stretch and is only the case if you define the market based on paying users.

Re: Face ID and Touch ID for the Web

#293

Post by kalleboo »

Zaheer wrote: post #77

You can change a password but you can't change your fingerprint / palm / etc. Am I missing something? How is Face / Touch ID more secure that user + pass? What happens when biometric data is leaked?

> How is Face / Touch ID more secure that user + pass

Because the password that the average user is using is shared among 100 sites and has been leaked 10 times over, and meanwhile there is nobody dusting their leftover coke can for prints.

Re: Face ID and Touch ID for the Web

#295

Post by kyriakos »

snowwrestler wrote: post #169
yegle wrote: post #33

Earlier quoted context omitted.

"Sign in with Apple" requires a developer account with Apple. Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". (FWIW, the only 2fa with "Sign in with Apple", if you don't own any Apple hardware, is SMS.)

It's pretty clear Epic set out to intentionally get their Apple developer account terminated so they would have standing to sue, so I would not draw too much inference from that. That said, it's generally true that any dependence on a platform is a form of risk. There are documented examples of Google kicking people out of their ecosystem unexpectedly too. Federated sign-in schemes may be a good idea if they help you…

What if I'm running a site that is against apple's beliefs? E.g you run an adult site? Would you risk it?

Re: Face ID and Touch ID for the Web

#296

Post by throwaway894345 »

ogre_codes wrote: post #291
gowld wrote: post #224

Earlier quoted context omitted.

Apple sits between users and developers. If it's a monopsony on one side, it's a monopoly on the other side.

Not remotely. Users can buy Android phones. Having ~50% market share is not a monopoly. Even suggesting Apple has monopsony as I did above is a stretch and is only the case if you define the market based on paying users.

The monopoly/monopsony distinction is pedantry. The important point is that consumers and developers suffer because one company controls access to the lion’s share of a market. That point can be criticized and debated, but litigating semantics makes for boring reading and anyway it’s off topic.

Re: Face ID and Touch ID for the Web

#297

Post by om2 »

djrogers wrote: post #259
mortenjorck wrote: post #42

The UI probably needs to be more explicit about what's going on. I would imagine most non-technical users aren't well-versed in how Apple's Secure Enclave (or other competing solutions) manage authentication, and so I wouldn't be surprised if "allow example.com to use TouchID" would give many the impression that the website is asking to access their biometric data. Ideally, the prompt should reflect the actual model,…

> I wouldn't be surprised if "allow example.com to use TouchID" This is already a very common pattern on ios devices - every app that wants to allow touch or face ID based login uses such prompts, so users are used to it.

Yep, we tried to be consistent with the wording for the app prompt (even though that doesn't generate a private key in the same way).

Re: Face ID and Touch ID for the Web

#298

Post by acdha »

10000truths wrote: post #223
kryptozinc wrote: post #214

Earlier quoted context omitted.

> The final model took a few days to generate at the cost of just over £300. "easily"

£300 is chump change in most any organization's budget.

This is why real security starts with a threat model.

If you are worried that someone will kidnap you, take you to a 3-D imaging system, hit you with an amnesiac so you forget that happened, build a mask realistic enough to unlock your iPhone – which that article noted could NOT be done for £300 — and then use that to unlock your devices you have to start by asking why they wouldn’t simply unlock the device when they had enough control over you to run an invasive scan. That’s a movie-plot threat, not something anyone reading this needs to worry about and if they did they should be investing in bodyguards.

Similarly, in the real world you have to make trade-offs. In this case, the alternative is using a password. Those are not only much, much easier to observe with a camera but also open rich new areas for an attacker to try: passwords are generated by normal people so they’re often weak, notoriously reused across multiple sites, and people are convinced by phishers to enter their passwords on the wrong site. Trying to protect against the Hollywood threats makes you more vulnerable to the kinds of things which befall many people on a daily basis.

Re: Face ID and Touch ID for the Web

#299

Post by asdff »

easton wrote: post #171
mortenjorck wrote: post #42

The UI probably needs to be more explicit about what's going on. I would imagine most non-technical users aren't well-versed in how Apple's Secure Enclave (or other competing solutions) manage authentication, and so I wouldn't be surprised if "allow example.com to use TouchID" would give many the impression that the website is asking to access their biometric data. Ideally, the prompt should reflect the actual model,…

They could just have it say "example.com wants to use Touch ID to sign-in. Biometric data is not shared." with a help link that goes on to explain in laymens terms how your iPhone basically sends a password-ish thing to the website after you use Touch ID (similar to how Apple Pay sends a one-time use credit card number to a merchant).

Apple's UI designers would never tolerate such a helpful and wordy dialog box.

Re: Face ID and Touch ID for the Web

#300

Post by om2 »

coder543 wrote: post #147
JoeAltmaier wrote: post #145

Earlier quoted context omitted.

Sure it was - sophistry is pretended an issue is simple by (deliberately) ignoring alternatives. If biometrics are fallible, it matters zero how secure the digital system behind it is. That's obvious, and a comment belaboring the digital security is beside the point. As for how hard to spoof, just google it. There are dozens of folks with techniques and hacks right now. It'll only get worse.

You are the one using sophistry, if anyone is using it. You are completely (and willfully!) ignoring how vulnerable passwords are in any threat model that invalidates a FIDO2 implementation of Face ID. No threat model invalidates the security of Face ID for the Web without similarly invalidating passwords. At least, you have chosen not to present such a threat model, which would help my (apparent) failure of imaginat…

Corroborating you point: Safari on iPhone will autofill passwords with just a biometric, so if you have an unlocked iPhone and a clone of the user's biometric, you can access websites and potentially even change their passwords. If it's timed out or user deliberately disabled the biometric, then you will need the passcode to be able to access anything.
Post reply on HN