Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID and Touch ID for the Web

webkit.org

Post reply on HN
Print view View original

331–340 of 371 posts

Re: Face ID and Touch ID for the Web

#331

Post by mszcz »

ogre_codes wrote: post #109
yegle wrote: post #33

Earlier quoted context omitted.

"Sign in with Apple" requires a developer account with Apple. Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". (FWIW, the only 2fa with "Sign in with Apple", if you don't own any Apple hardware, is SMS.)

As a user I would prefer no account in most cases. As a distant second, I would prefer the convenience, security, and privacy of Sign in with Apple over Google, Facebook, or the headache of managing yet another web account . As a developer, I use my preferences as a user to steer my choices, but recognize that the world doesn't revolve around Apple so would allow other options. > Having saw Epic's developer account t…

> convenience, security, and privacy of Sign in with Apple over Google, Facebook

Unless of course they block you for whatever reason. Then the process of getting back access has nothing to do with convenience, security, and privacy...

Re: Face ID and Touch ID for the Web

#332

Post by ksec »

chadlavi wrote: post #212
hk__2 wrote: post #201

Earlier quoted context omitted.

> I am still waiting for them to move to USB-C What do you mean? All Mac models introduced since 2016 support USB-C. https://support.apple.com/en-us/HT201736

Not OC, but they probably mean iPhones. I wish iPhones would switch to USB-C too; my iPhone is now the only device I own that isn't USB-C.

I would actually pay extra $10 for an Portless iPhone or iPhone without USB-C.

Re: Face ID and Touch ID for the Web

#333

Post by frenchy »

robomartin wrote: post #238
blintz wrote: post #13

So happy Apple decided to go with an open standard here rather than something proprietary. This is good news for the FIDO2 ecosystem and I hope this leads to far greater support for FIDO2 authenticators of all types. There is another world in which Apple just pushed 'Sign in with Apple' and created yet another federated identity provider rather than true, 'secure element'-based FIDO2 authentication.

Having just devoted about 12 hours to helping my wife migrate to a password manager from an ad-hoc collection of access control approaches (you don't want to know), I emerged horrified by the range and domain of what I can only call incompetence and a total lack of common sense and UI intelligence. I wrote about it here (long post): https://news.ycombinator.com/item?id=24827031 I haven't quite processed this entirely…

I think a big part of the problem here is that the vast majority of the time, nobody wants to pay for security. The end result is that you end up with 2 kinds of players in this market:

- "small" players like Mozzila who don't have a big enough marketing budget or leverage from existing products to drive adoption.

- large companies who are willing to throw large sums of money into this with the goal of monopolizing auth, and using that monopoly to manipulate related markets. In the non-Apple cases (Google, Facebook, Microsoft), it also involves collecting data on users for ad targetting.

Re: Face ID and Touch ID for the Web

#334

Post by EtienneK »

oezi wrote: post #180

Does anyone know why Webauth does not support a message associated with the authentication? Shouldn't the user be informed in a secure way what they are authenticating for? Currently only site and user name are supported to be shown to the user. For payments (PSD2 for instance) it is a requirement to also provide information about the transaction for instance.

Last time I checked, WebAuthN does not support UAF transaction signing yet - only via extensions and thus we don't see it in the browser implementations. Hopefully it gets added to the spec in the future.

Re: Face ID and Touch ID for the Web

#335

Post by [deleted] »

ROARosen wrote: post #272
snowwrestler wrote: post #169

Earlier quoted context omitted.

It's pretty clear Epic set out to intentionally get their Apple developer account terminated so they would have standing to sue, so I would not draw too much inference from that. That said, it's generally true that any dependence on a platform is a form of risk. There are documented examples of Google kicking people out of their ecosystem unexpectedly too. Federated sign-in schemes may be a good idea if they help you…

>It's pretty clear Epic set out to intentionally get their Apple developer account terminated so they would have standing to sue, so I would not draw too much inference from that. Nevertheless, the suspension still clearly highlights the fealty you are expected to give to Apple being a dev on their platform, or else.

[deleted]

Re: Face ID and Touch ID for the Web

#336

Post by samtheprogram »

snowwrestler wrote: post #308
kyriakos wrote: post #295

Earlier quoted context omitted.

What if I'm running a site that is against apple's beliefs? E.g you run an adult site? Would you risk it?

Apple doesn't allow adult content in their App Store, but they don't do anything to prevent adult sites from loading in Safari, even on iOS--never have. They seem to draw a distinction between their walled gardens and the open web. I'll admit I'm not an expert on Face ID and Touch ID for the web, but to me it looks like a feature of the Safari browser, not a walled garden.

On the contrary, although not against all uses within Safari, there are rules against use of Sign In with Apple depending on what you are doing, including one against pornographic websites as mentioned.

https://developer.apple.com/sign-in-with-apple/usage-guideli...

Re: Face ID and Touch ID for the Web

#337

Post by Cthulhu_ »

kyriakos wrote: post #295
snowwrestler wrote: post #169

Earlier quoted context omitted.

It's pretty clear Epic set out to intentionally get their Apple developer account terminated so they would have standing to sue, so I would not draw too much inference from that. That said, it's generally true that any dependence on a platform is a form of risk. There are documented examples of Google kicking people out of their ecosystem unexpectedly too. Federated sign-in schemes may be a good idea if they help you…

What if I'm running a site that is against apple's beliefs? E.g you run an adult site? Would you risk it?

Loads of companies - especially financial processors - don't want anything to do with adult sites, so if you're in that industry you're already up for a challenge.

I've worked for a project for the tobacco industry, similar story.

Re: Face ID and Touch ID for the Web

#338

Post by mrwnmonm »

tialaramex wrote: post #280
mrwnmonm wrote: post #258

Earlier quoted context omitted.

So does my phone has a different private key for every website?

Yes. In WebAuthn every single time you enroll on some web site with this system, a completely random new private key will be generated and the site will be given the corresponding public key and a fresh magic "cookie" identifier that serves no other purpose. Your Apple device remembers the association between this particular web site, any user ID the site said is relevant (e.g. maybe the username mrwnmonm and friendl…

Oh man, couldn't they write it this way?

This comment summarizes it all. Thanks very much.

Re: Face ID and Touch ID for the Web

#339

Post by guptaneil »

dirtae wrote: post #321
guptaneil wrote: post #284

Earlier quoted context omitted.

While there's always a risk anytime you build on top of someone else's platform, it's worth noting that it looks like Epic lied[0] about getting blocked from Sign in with Apple. There's no evidence they were going to lose access to it, even with a terminated developer account. 0: https://daringfireball.net/linked/2020/09/29/epic-games-unre...

False. https://twitter.com/TimSweeneyEpic/status/131134525357683097...

Ahh thanks for sharing that. That’s good to know. Super disappointed Gruber didn’t update his post with that information, especially given his recent campaign against editorial integrity.

Re: Face ID and Touch ID for the Web

#340

Post by rimliu »

young_unixer wrote: post #92
reaperducer wrote: post #75

Earlier quoted context omitted.

Apple has my face and fingerprint? I haven't heard this before and Google turns up nothing. Any source?

You put your fingerprint into a black box and that black box phones home to Apple servers. From a security standpoint, we must assume that they have your fingerprint unless there's a way to prove that they don't. iOS is closed source so we can't prove that. From an epistemological point of view: I don't know if they have it. From a security point of view: they have your fingerprint.

My bank has my money. Shoul I feel robbed, from security point of view?
Post reply on HN