4 ms·
These use-cases for specialized processors are prime examples of how Apple's software-hardware bundling can give their products some really cool advantages over
by spunker540 8y ago
These use-cases for specialized processors are prime examples of how Apple's software-hardware bundling can give their products some really cool advantages over competitors.
I'm not a security specialist though -- so I'm curious how valuable these extra hardware protections are to the security community at-large.
- klodolph 8y agoI know of at least one place where the MacBook Pro fingerprint sensor is approved for authentication, but the only other approved devices are dedicated hardware (security tokens).
- gruez 8y ago>MacBook Pro fingerprint sensor is approved for authentication does the fingerprint sensor API return a signed response from the fingerprint sensor or SE? or is it a simple yes/no?. if it's the latter, the whole thing is security theater.
- extra88 8y agoThe MacBook Pro's TouchID works like it does on iPhones, with the Secure Enclave.
- pudquick 8y agoWhy does that make a difference? If it's a signed response, at some point there's another piece of code that checks that the signature is valid and returns a yes/no. I think the reason Apple's sensor was mentioned in this instance was due to how Apple handled storage and usage of biometrics as described in here https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf Compare that to, say, other laptop vendors: https://support.lenovo.com/us/en/product_security/len-15999 https://support.lenovo.com/us/en/product_security/len-15999
- Buge 8y agoIt depends on where you're authenticating to. If you're authenticating to yourself, then sure a signature is will just be converted to a yes/no and be no better. But if you're authenticating to a server, the server can do the signature verification, whereas a server looking at a yes/no that a client sends would be mostly useless.
- wmf 8y agoI wonder what software they're using, because AFAIK the enclave doesn't provide attestation. So Touch ID is really secure but there's no way to prove to the server that you're using Touch ID. But I guess most hardware tokens don't have attestation either.
- willstrafach 8y agoYou can generate a key pair on the secure enclave which never leaves it, so could be that, same as a smart card.
- izacus 8y agoI think you forgot about Pixelbooks ;)
- klodolph 8y agoNo, I definitely did not forget about Pixelbooks. They're not approved (and not for a lack of people interested in getting them approved).