Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID and Touch ID for the Web

webkit.org

Post reply on HN
Print view View original

351–360 of 371 posts

Re: Face ID and Touch ID for the Web

#351

Post by parasubvert »

yegle wrote: post #57
tshaddox wrote: post #53

Earlier quoted context omitted.

Even if you don’t like Apple’s actions in the whole Epic drama, one thing that’s clear from it is that Apple probably won’t terminate your developer account like this unless you beg them to as part of a major PR stunt.

But they can expand the prohibited uses clause in the future if they see fit. https://developer.apple.com/sign-in-with-apple/usage-guideli...

Contracts can be changed based on pre-agreed terms, film at 11

At some point, people need to do business. Worrying about hypotheticals leads to paralysis.

Re: Face ID and Touch ID for the Web

#352

Post by jeroenhd »

snowwrestler wrote: post #169
yegle wrote: post #33

Earlier quoted context omitted.

"Sign in with Apple" requires a developer account with Apple. Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". (FWIW, the only 2fa with "Sign in with Apple", if you don't own any Apple hardware, is SMS.)

It's pretty clear Epic set out to intentionally get their Apple developer account terminated so they would have standing to sue, so I would not draw too much inference from that. That said, it's generally true that any dependence on a platform is a form of risk. There are documented examples of Google kicking people out of their ecosystem unexpectedly too. Federated sign-in schemes may be a good idea if they help you…

> It's pretty clear Epic set out to intentionally get their Apple developer account terminated so they would have standing to sue, so I would not draw too much inference from that.

Actually, it's clear that they intentionally got their _app removed_. The termination of their entire Apple account was a step I wouldn't have expected Apple to take because it underlines the fragility of their authentication system. Now, player who signed up to Fortnite on their phones can't continue to play anywhere else, probably making them regret using the Apple sign-in in the first place.

I generally consider any federated login that doesn't have an external email address attached to be fleeting, possibly disappearing out of the blue. I've lost some minor accounts when I deleted my Facebook account with services that didn't offer an email alternative. Developers, at least make adding an email/username and password optional once I've signed in with another service account, because that account might just disappear altogether one day!

Re: Face ID and Touch ID for the Web

#353

Post by acdha »

RonanTheGrey wrote: post #283
coder543 wrote: post #72

Earlier quoted context omitted.

You don't seem to be aware of what is under discussion here. You just raised a huge strawman. Websites are not receiving your biometrics in this context, and your biometrics would be meaningless to the website if captured and somehow provided. Your biometric signature is stored solely inside the Secure Enclave in the Apple device. If and only if the Secure Enclave recognizes you via your biometrics will the Enclave u…

All that's well and good until companies start implementing their own FaceID then forcing you to use it [0] on the back of trusting Apple, even CALLING it the same thing. This app linked above (my bank) contains NONE of the security you've mentioned above. And, incidentally, for me, biometrics STILL fail every test that matters to me: If I am dead, a bad actor can still gain access to my accounts. With a password, th…

> This app linked above (my bank) contains NONE of the security you've mentioned above.

This misunderstanding is where you went wrong: your bank doesn’t have a choice about this. If they use FaceID, they don’t have a choice about implementing that - the app can ask it to perform the public-key authentication operation but there’s no way for the developer to choose to weaken the security of the system.

Similarly, you should read up about how these systems incorporate liveness checks. A dead body will not pass those and, if you weren’t aware, Apple’s implementation requires a password after a reboot or a small number of failed tries. It’s presumably possible for a well-resourced attacker to bypass those but you’d have to think about how much more vulnerable you are if you use only a password which is much easier for an attacker with that level of resources to capture. If you’re worried about Tom Cruise recording a mask from your still-cooling body, think about how much easier it’d be to get a camera to record you entering it - which you do a lot more in public if you don’t use biometrics - and how trivially this could be done without your knowledge.

Re: Face ID and Touch ID for the Web

#354

Post by MobileVet »

cpuguy83 wrote: post #273
MobileVet wrote: post #265

Earlier quoted context omitted.

Please please please be true. TouchID is objectively superior to FaceId, by a long shot. It is my soap box... but TouchID RARELY failed and could be activated BEFORE you had the phone in front of you. FaceID fails constantly and MUST be in view to start the unlock process. TouchID has a single failure mode (and a half) that isn't that common. Wet / dampness. Solution, dry your finger, try again. Gloves are the 'half'…

Have you tried switching the "Require attention for Face ID" off? Usually it can get you before you are "looking at it". I've been using Face ID since the xs, and so far my experience is, outside of mask wearing, much better than Touch ID. But I also try not to touch my phone when I'm out (and as such am wearing a mask). I even occasionally can't use Touch ID on my MacBook because of a damp finger, and that sees far…

I haven’t turned off the ‘require attention’ option... actually didn’t even know about it. Thanks!

Re: Face ID and Touch ID for the Web

#355

Post by kevincox »

Razengan wrote: post #344
AshleysBrain wrote: post #91

It's a shame they have a messy pile of API-specific hacks to propagate the "user gesture". Chrome solved this problem with a change to the spec (which they called "User activation v2" [1]). It's basically two flags and a short timeout, and it covers basically all cases. Safari's approach means you have very specific codepaths, and if you do something async outside of that, tough luck, you can't use the feature and wi…

> It's a shame they have a messy pile of API-specific hacks to propagate the "user gesture". Chrome solved this problem with a change to the spec If Safari had changed the spec that comment would probably have begun with "It's a shame they had to change the spec..." > Safari's approach means you have very specific codepaths, and if you do something async...tough luck I'm no expert on it but this sounds more secure, n…

> If Safari had changed the spec that comment would probably have begun with "It's a shame they had to change the spec..."

I don't follow. They are breaking the spec anyways. A simple timeout would be equally spec-breaking and a lot easier to understand and use.

The weird async-callback-chaining doesn't actually limit any nefarious behaviour. It just requires the code author to carefully stay inside their arbitrary happy-path. A simple timeout after a user gesture is just simpler. Furthermore this is something that you can't test without buying a thousand dollar device.

Re: Face ID and Touch ID for the Web

#356

Post by kevincox »

can16358p wrote: post #303
asdff wrote: post #299

Earlier quoted context omitted.

Apple's UI designers would never tolerate such a helpful and wordy dialog box.

I don't understand why they even ask it as a popup. I mean, you already get "touch to login" kind of text next to Touch ID on Touch Bar, if you don't want to login that way, simply don't touch it. Am I missing something extra about the purpose of this popup?

Because who is looking at their touch bar constantly just in case a site is trying to login? It seems to me that every time it is active a dialog pops up.

Especially when I am using an external monitor there is no way I would notice just that.

Re: Face ID and Touch ID for the Web

#357

Post by davweb »

yegle wrote: post #33
blintz wrote: post #13

So happy Apple decided to go with an open standard here rather than something proprietary. This is good news for the FIDO2 ecosystem and I hope this leads to far greater support for FIDO2 authenticators of all types. There is another world in which Apple just pushed 'Sign in with Apple' and created yet another federated identity provider rather than true, 'secure element'-based FIDO2 authentication.

"Sign in with Apple" requires a developer account with Apple. Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". (FWIW, the only 2fa with "Sign in with Apple", if you don't own any Apple hardware, is SMS.)

Sign in with Apple still works for Fortnite. [1]

According to Epic, Apple said they were going to turn it off and then changed their minds. Apple's position is they were never going to turn off Sign in with Apple for Epic.

[1]: https://twitter.com/FortniteStatus/status/130416143288864358...

Re: Face ID and Touch ID for the Web

#358

Post by ascagnel_ »

jeroenhd wrote: post #352
snowwrestler wrote: post #169

Earlier quoted context omitted.

It's pretty clear Epic set out to intentionally get their Apple developer account terminated so they would have standing to sue, so I would not draw too much inference from that. That said, it's generally true that any dependence on a platform is a form of risk. There are documented examples of Google kicking people out of their ecosystem unexpectedly too. Federated sign-in schemes may be a good idea if they help you…

> It's pretty clear Epic set out to intentionally get their Apple developer account terminated so they would have standing to sue, so I would not draw too much inference from that. Actually, it's clear that they intentionally got their _app removed_. The termination of their entire Apple account was a step I wouldn't have expected Apple to take because it underlines the fragility of their authentication system. Now,…

> Actually, it's clear that they intentionally got their _app removed_. The termination of their entire Apple account was a step I wouldn't have expected Apple to take because it underlines the fragility of their authentication system. Now, player who signed up to Fortnite on their phones can't continue to play anywhere else, probably making them regret using the Apple sign-in in the first place.

- Apple never indicated that they’d remove Epic’s SIWA support, and there have been reports that Apple went out of their way to make sure the support would survive the account being terminated [0]

- Apple’s developer agreement allows them to terminate the account of an offending developer after 30 days; Epic’s account was terminated 45+ days after breach.

[0] https://daringfireball.net/linked/2020/09/29/epic-games-unre... (with the caveat that John Gruber shills for Apple, but also has some good contacts within)

Re: Face ID and Touch ID for the Web

#359

Post by athms »

ascagnel_ wrote: post #358
jeroenhd wrote: post #352

Earlier quoted context omitted.

> It's pretty clear Epic set out to intentionally get their Apple developer account terminated so they would have standing to sue, so I would not draw too much inference from that. Actually, it's clear that they intentionally got their _app removed_. The termination of their entire Apple account was a step I wouldn't have expected Apple to take because it underlines the fragility of their authentication system. Now,…

> Actually, it's clear that they intentionally got their _app removed_. The termination of their entire Apple account was a step I wouldn't have expected Apple to take because it underlines the fragility of their authentication system. Now, player who signed up to Fortnite on their phones can't continue to play anywhere else, probably making them regret using the Apple sign-in in the first place. - Apple never indica…

>John Gruber shills for Apple...

A shill is a person who pretends to give a neutral endorsement but has an interest in the deal.

Re: Face ID and Touch ID for the Web

#360

Post by kube-system »

chadlavi wrote: post #212
hk__2 wrote: post #201

Earlier quoted context omitted.

> I am still waiting for them to move to USB-C What do you mean? All Mac models introduced since 2016 support USB-C. https://support.apple.com/en-us/HT201736

Not OC, but they probably mean iPhones. I wish iPhones would switch to USB-C too; my iPhone is now the only device I own that isn't USB-C.

I hope they don't switch. I think Lightning is a better engineered connector -- it is very durable and attaches much more positively.

I am 100% on board with USB-C on computers -- but the use cases that apply to a laptop/desktop are very different than how people use phones.

Post reply on HN