Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID and Touch ID for the Web

webkit.org

Post reply on HN
Print view View original

361–370 of 371 posts

Re: Face ID and Touch ID for the Web

#361

Post by ascagnel_ »

lotsofpulp wrote: post #225
askvictor wrote: post #219

Earlier quoted context omitted.

I agree with you, but am not sure a password works too well in such situations either - the abuser would presumably just beat the victim until they enter their password?

Yes, I don’t see it helping in situations where the attacker has a long term relationship with victim. https://xkcd.com/538/ However, I think touchID is susceptible to being robbed since if you have your bank account or Apple Pay enabled to transfer cash with touchID as authentication, then you can be robbed while you’re passed out drunk or roofied or whatever.

One of the benefits of Face ID is that it supports an attention check, which should be harder to coerce if you’re passed out/drugged.

Re: Face ID and Touch ID for the Web

#362

Post by mooreds »

gowld wrote: post #230
mooreds wrote: post #150

Earlier quoted context omitted.

This is always a business decision, imo. It's similar to publishing on medium (or Huffpost, from a few years ago) as opposed to your blog. You'll get more reach in the former case, but have much less control. For that matter, it's similar to serverless vs code everything and host it in a server on a rack somewhere. Engineering is all about the tradeoffs. So, how would I make that call? I'd think about how much it mat…

It's extremely cheap to syndicate to Medium plus other venues. Not so for Sign In With.

What is expensive about "sign in with"? There are lots of libraries that will make it pretty simple, though the configuration can be hairy (google, looking at you).

It's more expensive than syndicating content, sure, but I think you want to compare the relative costs of each option, not between them.

Write on medium vs writing on your own blog

Using social sign on vs building your own auth system (hopefully using a library)

Re: Face ID and Touch ID for the Web

#363

Post by jrmann100 »

sneak wrote: post #266
StavrosK wrote: post #197

Earlier quoted context omitted.

So what exactly is the concrete downside here, apart from the icky word "platform", that, in this context, means "a security chip that's not removable", ie as opposed to a Yubikey or such.

Websites will, at their option, be able to require Apple hardware to use them.

Last I checked, Windows won't let you use self-signed attestation keys for your homemade devices.

Re: Face ID and Touch ID for the Web

#364

Post by qppo »

tchalla wrote: post #240
qppo wrote: post #136

Earlier quoted context omitted.

I've had an issue with sign-in with Apple where using an autogenerated emails ruins certain support interactions. One of them was cancelling a subscription service that was eventually resolved (they required me to email their customer support, which I couldn't figure out how to do using the autogenerated email address created by "sign-in with Apple").

It would be helpful if you could let us know how you managed to send that e-mail.

I didn't, I found an alternative that was specific to the service.

Re: Face ID and Touch ID for the Web

#365

Post by RonanTheGrey »

acdha wrote: post #353
RonanTheGrey wrote: post #283

Earlier quoted context omitted.

All that's well and good until companies start implementing their own FaceID then forcing you to use it [0] on the back of trusting Apple, even CALLING it the same thing. This app linked above (my bank) contains NONE of the security you've mentioned above. And, incidentally, for me, biometrics STILL fail every test that matters to me: If I am dead, a bad actor can still gain access to my accounts. With a password, th…

> This app linked above (my bank) contains NONE of the security you've mentioned above. This misunderstanding is where you went wrong: your bank doesn’t have a choice about this. If they use FaceID, they don’t have a choice about implementing that - the app can ask it to perform the public-key authentication operation but there’s no way for the developer to choose to weaken the security of the system. Similarly, you…

I think you misunderstood (but I appreciate your reply)

This bank is NOT using FaceID, they invented their own version and are calling it the same thing. Your picture goes to their servers. Who knows what happens after that. And they're piggy backing on Apple's trust where FaceID is concerned in order to do it.

They are not the only company I have seen do this.

Re: Face ID and Touch ID for the Web

#366

Post by om2 »

Razengan wrote: post #344
AshleysBrain wrote: post #91

It's a shame they have a messy pile of API-specific hacks to propagate the "user gesture". Chrome solved this problem with a change to the spec (which they called "User activation v2" [1]). It's basically two flags and a short timeout, and it covers basically all cases. Safari's approach means you have very specific codepaths, and if you do something async outside of that, tough luck, you can't use the feature and wi…

> It's a shame they have a messy pile of API-specific hacks to propagate the "user gesture". Chrome solved this problem with a change to the spec If Safari had changed the spec that comment would probably have begun with "It's a shame they had to change the spec..." > Safari's approach means you have very specific codepaths, and if you do something async...tough luck I'm no expert on it but this sounds more secure, n…

Programmatic paste is restricted in all browsers, including Safari (although Chrome has a special exception hardcoded to the Suite apps).

Re: Face ID and Touch ID for the Web

#367

Post by JoeAltmaier »

coder543 wrote: post #147
JoeAltmaier wrote: post #145

Earlier quoted context omitted.

Sure it was - sophistry is pretended an issue is simple by (deliberately) ignoring alternatives. If biometrics are fallible, it matters zero how secure the digital system behind it is. That's obvious, and a comment belaboring the digital security is beside the point. As for how hard to spoof, just google it. There are dozens of folks with techniques and hacks right now. It'll only get worse.

You are the one using sophistry, if anyone is using it. You are completely (and willfully!) ignoring how vulnerable passwords are in any threat model that invalidates a FIDO2 implementation of Face ID. No threat model invalidates the security of Face ID for the Web without similarly invalidating passwords. At least, you have chosen not to present such a threat model, which would help my (apparent) failure of imaginat…

You're right; I apologize.

Re: Face ID and Touch ID for the Web

#368

Post by lilyball »

JohnTHaller wrote: post #281
lilyball wrote: post #217

Earlier quoted context omitted.

I have a custom domain that uses Gmail as its mail provider (for legacy reasons related to the other users of this domain), and my Gmail account is configured to never mark anything as spam and to forward everything to Fastmail. This means that no matter what I do with my email, I can log into the gmail account and see every email I've received for years sitting in my inbox. I don't really recommend this setup, I'd r…

Gmail and most other providers will 5xx incoming mail they see as spam before it even gets to your spam settings. It's a "feature" on their end to outright block more blatant spam, but it often snags larger senders of legitimate email. Like Patreon.

If it’s catching Patreon then Patreon must be doing something really egregiously wrong, because there’s tons of spam I get to my address that’s exceedingly obvious. And I have no problem receiving other email from Patreon, so I think Patreon really just failed to send the login code email.

Re: Face ID and Touch ID for the Web

#369

Post by znpy »

gwillen wrote: post #203
lilyball wrote: post #189

Earlier quoted context omitted.

I really hate the "we're going to send a code to your email" approach because it so often breaks. Case in point, I tried to log into Patreon earlier today, they insisted on sending a code, and it never arrived. I tried several times, no email. I have a record of every email sent to my address for the past several years regardless of spam status so I can be 100% positive they simply never sent it. In the end I had to…

I'm curious -- do you host your own email, or use a lesser-known email provider? I am increasingly seeing failures where sites seem to be blackholing outgoing email, I suspect based on the destination domain, and unaware that they are even doing this / extremely insistent that they are not. I've gotten login-email failures like you describe from a couple of sites, and seemingly similar failures from those "email your…

I host my own email but I'm not having any problem with digital ocean's mails.

Re: Face ID and Touch ID for the Web

#370

Post by klysm »

MobileVet wrote: post #349
klysm wrote: post #285

Earlier quoted context omitted.

TouchID has another interesting failure mode for me that's probably quite rare: after I go climbing, my skin is so worn that it doesn't recognize any of my fingerprints.

Similarly, when my mother had chemo, her prints changed enough that it would fail. These are definitely failure modes, but I would put them in the niche bucket.

Interesting I didn’t realize prints changed significantly during chemo.
Post reply on HN