Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Face ID and Touch ID for the Web

developer.apple.com

Post reply on HN
Print view View original

71–80 of 274 posts

Re: Face ID and Touch ID for the Web

#71

Post by acdha »

mtgp1000 wrote: post #49
empath75 wrote: post #11

Earlier quoted context omitted.

it never leaves your phone.

Yeah, and my personal data never left Equifax's servers either. You can't change your biometrics when they are inevitably hacked. If you even find out.

Watch the video where he shows the JavaScript APIs being called: the website sees a standard public-key process using WebAuthn. You can use anything which can perform that protocol with zero change to the system — if someone steals your phone, you don't need to change your face since the new phone will generate a new key and the biometric data is only used to unlock that key.

Re: Face ID and Touch ID for the Web

#72

Post by thowawaymom »

orf wrote: post #67
thowawaymom wrote: post #50

Earlier quoted context omitted.

Oh the almighty Secure Enclave, bow down to the Enclave... Do you even know what the heck an enclave is and how does it work? It's nuts that when a figure of authority uses a fancy shiny new word to describe some magic black box and the masses follow with no questions asked.

Do you know how it works?

That's the point, not many do

Re: Face ID and Touch ID for the Web

#73

Post by motohagiography »

Linking biometrics to cryptographic authentication is difficult. When I worked on this problem about 5-6 years ago somewhere else, it came down to adding a separate applet for the biometric verification to the secure element, which then authenticated itself to the user authN applet, which was then authorized to generate the user authentication cryptogram.

Biometrics are probabilistic samples of data, where cryptographic verification requires deterministic inputs. They are apples/oranges and that's what made this hard, so you need a connector for them. The attack on such a scheme means spoofing the biometric authenticator's validation message to the cryptographic authenticator, which, if this all occurs between applets on the same secure element, raises the bar for attacks.

Re: Face ID and Touch ID for the Web

#74

Post by mathisonturing »

throw03172019 wrote: post #43
aaomidi wrote: post #19

Earlier quoted context omitted.

There isn't a reason it wouldn't work - the browsers all use the same engine anyway.

There are some differences between Safari and WKWebView. Some features are blocked.

It's funny how much bashing Google gets for monopoly with Android, pushing users to use Chrome, Play Store and whatnot. While all of that is relevant, Apple's stranglehold seems much more and worse.

Re: Face ID and Touch ID for the Web

#75

Post by acdha »

thowawaymom wrote: post #52

Oh the almighty Secure Enclave, bow down to the Enclave... I see so many comments mentioning Secure Enclave to any security objection as if it's a panacea. Do you even know what the heck an enclave is and how does it work? It's nuts that when a figure of authority uses a fancy shiny new word to describe some magic black box and the masses follow with no questions asked.

Please don't spam the same comment

Re: Face ID and Touch ID for the Web

#76

Post by sygma »

WA wrote: post #58
toomuchtodo wrote: post #21

Earlier quoted context omitted.

Apple users will get this natively without having to acquire 1Password. If you’ve bought into the Apple ecosystem and don’t have needs outside of it (Windows, Linux), you can eliminate the need for a separate password manager. Similar to how iCloud Files is moving towards (but likely won’t meet, while not needing to) Dropbox parity. This is making a friendly version of Yubikeys (using Apple devices) and password vaul…

For interested readers: 1Password does a few more things. For example, you can add 2FA to 1Password logins, so that 1Password replaces Google Authenticator with the immense advantage that you don’t have to setup 2FA again if you get a new device. Just a happy 1Password user, nut related to them in any way.

Is it really 2FA if your password and your token are on the same device?

Re: Face ID and Touch ID for the Web

#77

Post by monocasa »

thowawaymom wrote: post #52

Oh the almighty Secure Enclave, bow down to the Enclave... I see so many comments mentioning Secure Enclave to any security objection as if it's a panacea. Do you even know what the heck an enclave is and how does it work? It's nuts that when a figure of authority uses a fancy shiny new word to describe some magic black box and the masses follow with no questions asked.

They've been fairly open about how it works, and since then the binaries have been disassembled and backed up what they were saying.

It's a pretty modified L4 (I want to say L4::Pistachio off the top of my head) that for some reason has had Mach-O support added and pretty much just acts as a keystore with a secure but upgradable boot sequence.

Re: Face ID and Touch ID for the Web

#78

Post by thowawaymom »

acdha wrote: post #75
thowawaymom wrote: post #52

Oh the almighty Secure Enclave, bow down to the Enclave... I see so many comments mentioning Secure Enclave to any security objection as if it's a panacea. Do you even know what the heck an enclave is and how does it work? It's nuts that when a figure of authority uses a fancy shiny new word to describe some magic black box and the masses follow with no questions asked.

Please don't spam the same comment

I literally mentioned it one other time as a reply to a comment, that's hardly spam (the m stands for mass, fyi)

Re: Face ID and Touch ID for the Web

#79

Post by acdha »

thowawaymom wrote: post #52

Oh the almighty Secure Enclave, bow down to the Enclave... I see so many comments mentioning Secure Enclave to any security objection as if it's a panacea. Do you even know what the heck an enclave is and how does it work? It's nuts that when a figure of authority uses a fancy shiny new word to describe some magic black box and the masses follow with no questions asked.

You may not know what it is but it's been well documented for years detailing what it is, what it's used for, and the built-in tamper-resistance features:

https://support.apple.com/guide/security/secure-enclave-over...

https://www.apple.com/lae/business/docs/site/iOS_Security_Gu...

Re: Face ID and Touch ID for the Web

#80

Post by amluto »

jrockway wrote: post #30
barbegal wrote: post #16

This isn't that revolutionary: LastPass already allows you to use biometric ID to authenticate and it works without any changes to the website.

It also doesn't add any security. Your password can still be guessed or phished. When authenticating with a cryptographic token (U2F/WebAuthn), that vector goes away. (Even OTP can be phished... the phishing site can just ask you for the code.) Password managers do make it more difficult to get phished, since they will not know what password to autofill on phishing.example.com... but on the other hand, password manag…

WebAuthn is less phishing resistant than it should be. The original intent was that WebAuthn + token binding would ensure that, even if an attacker obtained a fraudulent certificate for a victim site and had an MITM position on the network, the attacker still couldn’t steal a WebAuthn protected session. Alas, Chrome removes its token binding implementation, and WebAuthn no longer has this property. If you authenticate with WebAuthn, and there is a MITM, the MITM gets your session.

(Conventional phishing is still prevented. If you go to, say, g00gle.com, the owner of g00gle.com can’t reuse your authentication to authenticate to google.com. But this relies on your browser actually knowing what domain it’s looking at, which relies on the CA system.)

Post reply on HN