Face ID and Touch ID for the Web • Hacker News Board

Re: Face ID and Touch ID for the Web

#61

Post by wayneftw » Mon, Oct 19, 2020, 8:19 PM UTC

yegle wrote: post #54

otterley wrote: post #38

Earlier quoted context omitted.

> Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". If you don't renege on your agreements with Apple as part of a public pissing contest, and you aren't in the business of misleading customers and creating deceptive apps, it's unlikely they'll revoke your developer account.

There's an explicit list of websites that are not allowed to integrate with "Sign in with Apple". https://developer.apple.com/sign-in-with-apple/usage-guideli... Nothing stops Apple from adding more requirements in the future, even if you don't start a feud with Apple.

Wow, you can’t even use sign in with Apple if you

“Show Apple or its products in a false or derogatory light.”

Who decides what’s false or derogatory?

Re: Face ID and Touch ID for the Web

#62

Post by samatman » Mon, Oct 19, 2020, 8:20 PM UTC

jjcm wrote: post #28

These all seem to be examples that use faceID/touchID as a password. That’s not what biometrics should be though, they should be the username. I hope that this is supported as a flow as well. Identify who you are with biometrics, and prove your access with a correlated password.

This is a good doctrine, and a bad dogma.

Under the hood, [bio]ID generates a one-time token with a signature that serves as a superior substitute to a password.

If your face or fingerprint don't happen to be around, you can always use the password for the same account to reset it. If you have legal concerns about being coerced into using a biometric system, you should disable it.

One of the problems "biometrics shouldn't be a password" is meant to expose, is that you can't reset a biometric if it leaks. By keeping the biometrics inside a device at all times, the T2 system substantially mitigates this risk. I'm fairly certain you can remove a device from your Apple account, and the ID system will no longer work, even if provided with your face or fingerprint.

Re: Face ID and Touch ID for the Web

#63

Post by reaperducer » Mon, Oct 19, 2020, 8:20 PM UTC

yegle wrote: post #54

otterley wrote: post #38

Earlier quoted context omitted.

> Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". If you don't renege on your agreements with Apple as part of a public pissing contest, and you aren't in the business of misleading customers and creating deceptive apps, it's unlikely they'll revoke your developer account.

There's an explicit list of websites that are not allowed to integrate with "Sign in with Apple". https://developer.apple.com/sign-in-with-apple/usage-guideli... Nothing stops Apple from adding more requirements in the future, even if you don't start a feud with Apple.

There's an explicit list of websites that are not allowed to integrate with "Sign in with Apple".

I don't think anyone is crying over Apple not wanting to handle authentication for web sites offering "Illegal drugs or non-legally prescribed controlled substances."

The rest of the list is similar.

And yes, with that list Apple has once again affirmed it's not interested in helping normalize pornography. That's its choice.

Re: Face ID and Touch ID for the Web

#64

Post by brightball » Mon, Oct 19, 2020, 8:20 PM UTC

blintz wrote: post #13

So happy Apple decided to go with an open standard here rather than something proprietary. This is good news for the FIDO2 ecosystem and I hope this leads to far greater support for FIDO2 authenticators of all types. There is another world in which Apple just pushed 'Sign in with Apple' and created yet another federated identity provider rather than true, 'secure element'-based FIDO2 authentication.

Really excited about this too. When we were adding 2FA options at my company we pushed to use Webauthn instead of just a QR code/OTP approach.

News like this where we can tell people "it already works because we made the right decision" is fun.

Re: Face ID and Touch ID for the Web

#65

Post by gremlinsinc » Mon, Oct 19, 2020, 8:20 PM UTC

krtkush wrote: post #50

yegle wrote: post #33

Earlier quoted context omitted.

"Sign in with Apple" requires a developer account with Apple. Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". (FWIW, the only 2fa with "Sign in with Apple", if you don't own any Apple hardware, is SMS.)

> I would definitely stay away from any "Sign in with Apple". I would stay away from any "Sign in with.." service as a user and as a product owner. You're affectively giving away a major control of your users to a third party.

so, if you're a service that posts memes to twitter, or facebook you should always use email and sms two factor, no 'sign in with facebook/twitter' links?

Re: Face ID and Touch ID for the Web

#66

Post by dustinmoris » Mon, Oct 19, 2020, 8:21 PM UTC

JoeAltmaier wrote: post #55

dustinmoris wrote: post #49

Earlier quoted context omitted.

That doesn't make sense. Username + Password is a cumbersome workaround because (so far) machines couldn't use biometrics to authenticate a user. Now they can, so we can let go of that very problematic and often insecure model. Think like this, when you go to visit your grandmother and knock on her door you don't have to provide a password. You don't have to provide anything, because the human brain is capable of det…

Biometrics fails every test for a password. 1) A password is secret 2) You don't leave copies of it lying around everywhere 3) You can change it periodically 4) If discovered, it can't be traced back to you No, biometrics can only be a username. It can never be an acceptable password.

It falls short, because biometrics passwords. As I said, biometrics == identity.

Compare biometrics with identity:

1) Your identity is not secret. Your mother knows you, your entire school knows you, your neighbour knows you, when you go anywhere the police may ask for your ID at any time and knows you. Biometrics is the same.

2) You don't hide every day from the world. You don't cover your face (ok maybe before COVID) when entering a shop ;)

3) You cannot change who you are. You shouldn't have to and shouldn't want to. Same for biometrics.

4) If your identity is discovered then of course they know who you are. Same applies for biometrics.

So yes, biometrics isn't passwords, it's identity. Username + Password is a workaround to establish a person's identity and will never be as good as a biometric. The fact that you can have multiple usernames but only the same right index fingerprint is proof that biometrics is superior in establishing your identity than username + password.

Re: Face ID and Touch ID for the Web

#67

Post by mvanbaak » Mon, Oct 19, 2020, 8:22 PM UTC

yegle wrote: post #33

blintz wrote: post #13

So happy Apple decided to go with an open standard here rather than something proprietary. This is good news for the FIDO2 ecosystem and I hope this leads to far greater support for FIDO2 authenticators of all types. There is another world in which Apple just pushed 'Sign in with Apple' and created yet another federated identity provider rather than true, 'secure element'-based FIDO2 authentication.

"Sign in with Apple" requires a developer account with Apple. Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". (FWIW, the only 2fa with "Sign in with Apple", if you don't own any Apple hardware, is SMS.)

you do know EPIC did break a lot of clauses in their contract, knowing what the impact of breaking these clauses was, and still breaking all those clauses?

Re: Face ID and Touch ID for the Web

#68

Post by 0xCMP » Mon, Oct 19, 2020, 8:22 PM UTC

judge2020 wrote: post #35

Neither sync nor keychain is mentioned in this post or in the WWDC presentation, so I'd like to ask if the credentials are synced between devices whatsoever, or if they're transferrable. While it'd be more secure to run it through a device's T2, a syncing/keychain-backed key would save a lot of the re-enrollment hassle for users who end up transferring their data to a new phone or need to enroll each of their devices…

For simplified login situations (e.g. not requiring two factors for authentication) you'll probably have some kind of password or password-less (email) login flow where you can login at first and then enroll the FIDO2 device.

Otherwise there is no way to login from any other device.

An alternative is that you can authenticate a new device from an existing device along with a re-auth on that device to verify it's them. Discord has a feature similar to this with it's QR login system.

Re: Face ID and Touch ID for the Web

#69

Post by reaperducer » Mon, Oct 19, 2020, 8:22 PM UTC

Qahlel wrote: post #45

otterley wrote: post #38

Earlier quoted context omitted.

> Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". If you don't renege on your agreements with Apple as part of a public pissing contest, and you aren't in the business of misleading customers and creating deceptive apps, it's unlikely they'll revoke your developer account.

unilateral agreements that one side can change on a whim is not something that one would call a fair agreement in the first place.

unilateral agreements that one side can change on a whim is not something that one would call a fair agreement in the first place.

Wait till you read the fine print in your cell phone contract.

Re: Face ID and Touch ID for the Web

#70

Post by olliej » Mon, Oct 19, 2020, 8:22 PM UTC

Qahlel wrote: post #45

otterley wrote: post #38

Earlier quoted context omitted.

> Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". If you don't renege on your agreements with Apple as part of a public pissing contest, and you aren't in the business of misleading customers and creating deceptive apps, it's unlikely they'll revoke your developer account.

unilateral agreements that one side can change on a whim is not something that one would call a fair agreement in the first place.

Well, both companies do that - The various epic EULAs let them behave just as apple does, so they can't argue it's unfair unless they want all their existing EULAs to be invalidated as well.