16 ms·

Face ID and Touch ID for the Web

647 points by gok 6y ago

jiveturkey 6y ago
This has been a very long time coming. Apple finally joined FIDO in Feb of this year, so we knew it was right around the corner.
theboat 6y ago
If the web migrates to biometric sensors for authentication, I hope this won't suffer from vendor lock-in. When every new device ships with facial recognition and/or a fingerprint reader, it will be nice to login using my face/fingerprint irrespective of the device I'm on.
- cgb223 6y ago
  We’d need to have a standard HTML element like <facial-rec> or something and let the browser handle mapping it to whatever specific hardware the device is using
  - rovr138 6y ago
    The issue is that it's just a token that would simply say Passed/Fail. So it's trusting the client/browser.
    - duskwuff 6y ago
      It's more than that -- from what I'm seeing, it looks like it's a cryptographic token, presumably signed by a certificate that's embedded somewhere inaccessible in the device (probably in the secure element).
    - crispyporkbites 6y ago
      If the token is signed you could validate it with Apple (or the vendor that implemented the face recognition on the device, eg Samsung, Nokia, pinephone etc). You just need an open standard, you could even embed the url of the validating api in the token, so anyone could create their own Face ID provider.
      - bfulgham 6y ago
        That's precisely what the attestation section of the talk describes. This is all part of the WebAuthentication standard.
- Spivak 6y ago
  I don't see how this could ever be something not vendor-specific because without this being tied to "Log in with Apple" you're just saying "trust the client." Maybe that's fine if all you want is to "lock" a sensitive page to people who aren't the device owner but that's pretty limited compared to FaceID to actually log in.
  - tialaramex 6y ago
    It has no relationship to "Log in with Apple". It's a WebAuthn authenticator. Almost all web sites should just implement WebAuthn. On a suitable iPhone or Mac users will be able to sign in by touching the sensor or looking at the camera, while on my Pixel phone I touch the fingerprint sensor, on this Linux desktop I touch a Yubico Security Key. If your site is paranoid that some crazy user will choose a bad WebAuthn authenticator, or deliberately sabotage their own security for some reason, then you can use WebAuthn Attestation to obtain a signed document from the authenticator (yes, over the Web) which proves that it is, for example, an Apple iPhone 25 Super Mega Plus. I don't think you should bother doing that, but you can.
- munchbunny 6y ago
  This looks like a WebAuthn implementation, in which case it's an established standard and lots of vendors have interchangeable implementations. For example, Windows Hello has been WebAuthn compatible (FIDO2) for a while for sites configured to accept on-device authenticators.
- acdha 6y ago
  This isn't biometric authentication: it's WebAuthn, which is a public-key based system implemented by all major browsers (https://webauthn.io/ https://webauthn.io/). This particular implementation uses biometrics to unlock it but other implementations use a contact sensor (Yubikeys) or PIN, and the target website doesn't need to know anything about which particular mechanism was used to unlock the keystore.
- chrismorgan 6y ago
  This is an implementation of the Web Authentication API, and is exposed as a platform authenticator. There is no vendor lock-in.
theogravity 6y ago
I wonder what part of the Web Auth APIs does iOS Safari support since MDN says most of the APIs are not supported. https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent...
- jedieaston 6y ago
  I think that this is coming in the next release of Safari, so MDN is correct, it's not currently supported.
  - alanwaketan 6y ago
    WebAuthn API is supported in WebKit starting from Safari 13 and iOS 13. The MDN chart needs to be properly updated.
    - madjam002 6y ago
      Hardly, it only supports basic MFA scenarios with a cross platform Authenticator. User verification + resident keys were never implemented in Safari 13.
lifeisstillgood 6y ago
So roughly speaking this is WebAuthn for a web site, with the iphone acting as the dongle. It's a really good idea. I can see there being a big demand for just simplifying signin - I can easily see a time where it is worth not having the hassle of managing multiple signin processes and just choosing webauth or nothing. Edit: to be clear this won't affect B2C sites whose monetisation is based on getting as many people as possible. But imagine a saas business charging upwards of 100 bucks a month - they have something valuable to protect, and the security story just got a lot easier
- monocasa 6y ago
  Webauthn actually fully supports this model as "platform authenticators", ie hardware security modules built into the client system. You see this on the windows side too where "Windows Hello" integrates with the TPM and acts as a platform authenticator as well. No need to speak roughly.
  - tialaramex 6y ago
    Yup. A site can even say "I want a platform authenticator" or "I specifically don't want a platform authenticator" during registration using the Javascript API. Most sites should just not care, but it's an option if you've determined there's a specific reason it matters in your application.
    - DaiPlusPlus 6y ago
      > A site can even say "I want a platform authenticator" or "I specifically don't want a platform authenticator" during registration using the Javascript API. Websites should not depend on JavaScript for something that should be able to be done declaratively. (Amongst other things - we shouldn't need to use `fetch`/`XMLHttpRequest` when a <form> would work just-as-well - but if only <form> let us use more than just GET and POST, and supported more types of serialization, and supported asynchronous form submission - and bring back <keygen>!).
  - judge2020 6y ago
_jal 6y ago
Going to have to give serious thought to where I will and won't use this. There are a lot of implications - no ability to automate and giving others data on you were provably in front of some machine are two big ones.
- duskwuff 6y ago
  That's a really interesting point. If this really does allow a web user to prove that a human interacted with the computer, it'd make for a really nice CAPTCHA replacement.
  - jiveturkey 6y ago
    it doesn't do that, since there's no attestation.
    - Tepix 6y ago
      Did you watch the video?
      - jiveturkey 6y ago
        where he says it is "not included"? (because the Apple secure enclave does not attest keys.) also where he falsely alludes to other attestations being identifying? sure, they can be, but they generally aren't.
    - bfulgham 6y ago
      Yes there is. The video covers this clearly.
- thephyber 6y ago
  From the server side, isn't this just a WebAuth integration? How does the server know for sure if the client is on an iOS Safari browser on an iPhone with FaceID or a custom browser on any OS and any non-locked-down hardware being run with Selenium?
mtgp1000 6y ago
No way this biometric data could possibly be abused, right? I'll stick to taping over my cameras, thanks.
- empath75 6y ago
  it never leaves your phone.
  - mtgp1000 6y ago
    Yeah, and my personal data never left Equifax's servers either. You can't change your biometrics when they are inevitably hacked. If you even find out.
    - orf 6y ago
      I quite rightly trust Apple more than I trust Equifax.
    - monocasa 6y ago
      For all Apple's faults, they're pretty open about how their Secure Enclave works. I think they consider privacy to be a key differentiator, particularly when compared to Android and Windows. you can see this in how they didn't open a phone even given an FBI request.
      - kohtatsu 6y ago
        They didn't develop the capability to backdoor phones at the FBI's request. They are generally happy to hand over iCloud backups, which they did in that case and the FBI "lost" them IIRC. It was also an iPhone 5c, the last iPhone without a Secure Enclave, I believe they were able to get in with GrayKey.
        monocasa 6y ago
        > They are generally happy to hand over iCloud backups That one they legally have to do when given a subpoena.
adamleithp 6y ago
The keynote a few days ago failed to mention FaceID used to opening your mac... and this video shows/mentions FaceID on a macOS11 website? Seems they missed a step here with rolling it out, or are withholding the obvious. I'm assuming the latter.
- JimDabell 6y ago
  This video shows Touch ID being used with a laptop, not Face ID. The interface is generic, so it should use Face ID on devices that have Face ID hardware, and Touch ID on devices that have Touch ID hardware.
  - goalieca 6y ago
    FaceID requires special cameras and infrared lighting system. Perhaps they would add that to the mbp one day but that would be a crazy leak if they showed off that capability now.
- sirn 6y ago
  Apple supports WebAuthn on iOS/iPadOS as well (since iOS/iPadOS 13) so presumably FaceID part is referring to iOS/iPadOS.
paxys 6y ago
Happy to see Apple following an established standard for once.
barbegal 6y ago
This isn't that revolutionary: LastPass already allows you to use biometric ID to authenticate and it works without any changes to the website.
- crispyporkbites 6y ago
  Right but Apple have done it and they have actual market share and 100% control of the end to end device
- jrockway 6y ago
  It also doesn't add any security. Your password can still be guessed or phished. When authenticating with a cryptographic token (U2F/WebAuthn), that vector goes away. (Even OTP can be phished... the phishing site can just ask you for the code.) Password managers do make it more difficult to get phished, since they will not know what password to autofill on phishing.example.com... but on the other hand, password manager users are used to having to force-fill a password. I have to take my password out of LastPass to log into Battle.net or Fusion 360, and websites like the Wall Street Journal create your account on dowjones.com but require you to log in on wsj.com (or maybe it's the opposite, I forget). With WebAuthn, more care is required for both the site operator and the user (have more than one way of logging in in case you lose your phone, make sure the enrollment and login origins are the same), but you are then open to fewer attacks.
  - treebornfrog 6y ago
    What happens in the instance that one wants to move away from webauthn?
  - amluto 6y ago
    WebAuthn is less phishing resistant than it should be. The original intent was that WebAuthn + token binding would ensure that, even if an attacker obtained a fraudulent certificate for a victim site and had an MITM position on the network, the attacker still couldn’t steal a WebAuthn protected session. Alas, Chrome removes its token binding implementation, and WebAuthn no longer has this property. If you authenticate with WebAuthn, and there is a MITM, the MITM gets your session. (Conventional phishing is still prevented. If you go to, say, g00gle.com, the owner of g00gle.com can’t reuse your authentication to authenticate to google.com. But this relies on your browser actually knowing what domain it’s looking at, which relies on the CA system.)
zuhayeer 6y ago
Interesting, Apple is letting you change your default web browser with this new iOS version, but also adding Face ID and Touch ID to Safari. Why would anyone want to build these features if they're so platform / browser specific? Does anyone know if these auth features might work on other browsers on iPhone?
- aaomidi 6y ago
  There isn't a reason it wouldn't work - the browsers all use the same engine anyway.
  - abrowne 6y ago
    If Apple lets other browsers using the engine have access to this feature.
  - throw03172019 6y ago
    There are some differences between Safari and WKWebView. Some features are blocked.
    - mathisonturing 6y ago
      It's funny how much bashing Google gets for monopoly with Android, pushing users to use Chrome, Play Store and whatnot. While all of that is relevant, Apple's stranglehold seems much more and worse.
      - naringas 6y ago
        at least apple never pretended like iOS was open source
      - jodrellblank 6y ago
        Apple sells between 10-20% of smartphones per quarter[1], that implies Android makes up 80+% and Windows/Blackberry a neglible amount. How can Apple be a monopolist from such a small position, or have a "stranglehold" when they are outsold 4-8x by the competition? [1] https://www.statista.com/statistics/216459/global-market-share-of-apple-iphone/ https://www.statista.com/statistics/216459/global-market-sha...
elwell 6y ago
1Password users can already have effectively the same experience.
- toomuchtodo 6y ago
  Apple users will get this natively without having to acquire 1Password. If you’ve bought into the Apple ecosystem and don’t have needs outside of it (Windows, Linux), you can eliminate the need for a separate password manager. Similar to how iCloud Files is moving towards (but likely won’t meet, while not needing to) Dropbox parity. This is making a friendly version of Yubikeys (using Apple devices) and password vaults for Apple users.
  - bdcravens 6y ago
    I'm more of a fan of buy-in without lock-in.
  - chanmad29 6y ago
    so one more instance of Apple effectively rendering a third party app useless. As an apple user, I love that I do not need to install an additional app but something does not feel right from an ethical standpoint. Or maybe I'm just being too touchy.
    - toomuchtodo 6y ago
      I would rather have a native UX versus Bitwarden, especially if there’s no additional cost (I have to pay for Bitwarden annually or spend time running a server) and an easy way to share creds with my partner (for delegation in the event of my passing). Competition and a free market has perils. May the best solution win.
      - MetallicCloud 6y ago
        You can use Bitwarden for free while using their servers.
BiteCode_dev 6y ago
Giving my finger and face prints to the browser, the software with the biggest attack surface in the world, connected to internet no less, feels off to me.
- lemoncucumber 6y ago
  Native apps have long been able to use TouchID/FaceID and have never been able to access the actual finger/face print data. There's no way that iOS exposes your actual finger or face print to websites.
- brandonhorst 6y ago
  All of that is managed by the Secure Enclave in exactly the same way that it is for all over auth on Apple devices. The browser doesn't touch it at all.
  - thowawaymom 6y ago
    Oh the almighty Secure Enclave, bow down to the Enclave... Do you even know what the heck an enclave is and how does it work? It's nuts that when a figure of authority uses a fancy shiny new word to describe some magic black box and the masses follow with no questions asked.
    - nicky0 6y ago
      The concept has been around for years now, it is well understood.
    - orf 6y ago
      Do you know how it works?
      - thowawaymom 6y ago
        That's the point, not many do
EGreg 6y ago
Just to state the obvious... Biometric data must always stay on your personal device in order to be secure from replay attacks, not to mention finding out more about you. https://amp.theguardian.com/world/2019/sep/04/smile-to-pay-chinese-shoppers-turn-to-facial-payment-technology https://amp.theguardian.com/world/2019/sep/04/smile-to-pay-c... Of course, in Apple’s implementation, the data never leaves the device. Which is far better than, say, how facial recognition is used in China for payment where the merchant is the one operating the machine which scans your face.
- marinhero 6y ago
  The video mentions the data never leaves the device and that the transaction is performed in the secure enclave of the phone.
echeese 6y ago
I got a Yubikey earlier this year and was disappointed by Apple's implementation of WebAuthn it (doesn't work if there's a PIN on the device) but it looks like they're fixing that as well in iOS 14
- 0xCMP 6y ago
  I'm hoping it works with NFC and not just the lightning one. Would be nice to have Yubikey replace my password and then allow me to enroll FaceID so I can keep signing back in.
  - echeese 6y ago
    The current Yubikey works with NFC on iOS, it just doesn't work if you add a PIN to it (which Windows Hello requires). They mention that they added PIN support in the changelog
thowawaymom 6y ago
Oh the almighty Secure Enclave, bow down to the Enclave... I see so many comments mentioning Secure Enclave to any security objection as if it's a panacea. Do you even know what the heck an enclave is and how does it work? It's nuts that when a figure of authority uses a fancy shiny new word to describe some magic black box and the masses follow with no questions asked.
- derefr 6y ago
  > Do you even know what the heck an enclave is and how does it work? It's a isolated smart-card-like KMS core within the SoC, that has most smart-card guarantees (e.g. no side-channel attacks; tamper-resistance.)
- acdha 6y ago
  Please don't spam the same comment
  - thowawaymom 6y ago
    I literally mentioned it one other time as a reply to a comment, that's hardly spam (the m stands for mass, fyi)
- monocasa 6y ago
  They've been fairly open about how it works, and since then the binaries have been disassembled and backed up what they were saying. It's a pretty modified L4 (I want to say L4::Pistachio off the top of my head) that for some reason has had Mach-O support added and pretty much just acts as a keystore with a secure but upgradable boot sequence.
- acdha 6y ago
  You may not know what it is but it's been well documented for years detailing what it is, what it's used for, and the built-in tamper-resistance features: https://support.apple.com/guide/security/secure-enclave-overview-sec59b0b31ff/1/web/1 https://support.apple.com/guide/security/secure-enclave-over... https://www.apple.com/lae/business/docs/site/iOS_Security_Guide.pdf https://www.apple.com/lae/business/docs/site/iOS_Security_Gu...
thowawaymom 6y ago
Don't mean to sound harsh, but is it just me or the speaker was borderline impossible to understand? What is that word again "authontication"?
xvector 6y ago
I think it's pretty ridiculous that Apple pours time and effort into stuff like this but apps have been able to steal from your clipboard for years. It reminds me of the phenomenon when researchers and engineers don't work on something that's useful for everyday users, instead prioritizing what they find exciting and cool. The security team is so busy dealing with absurd edge cases like nation-states attacking your enclave that they don't seem to care to address egregious and obvious holes in the security model like this. It's not that WebAuthn and passwordless isn't exciting or useful, it's just that there are much bigger fish to fry (clipboard paste, terrible permissions management, non-shitty VPN support, trackers in apps) that Apple seems completely uninterested in addressing. There really is no excuse, at least not when you're tooting the privacy/security horn so loudly, but let stuff like this pass by. Edit: have y'all thought of an actual counterargument instead of just downvoting? Is it really too much to ask security engineers at Apple to focus on actual major privacy holes in their OS than things like this?
- _fzslm 6y ago
  i don't want to focus too much on why i think you're being downvoted but i would say it's probably because your message came across as quite reductive. > engineers don't work on something that's useful for everyday users, instead prioritizing what they find exciting and cool i get this, to some extent. i really do. but i don't think WebAuthn, sign in with apple, ios 14's recent microphone and camera usage indicators, etc. are not huge steps forward in terms of mobile privacy & security. (rough double negative. you get me.) i am pretty sure Apple knows about everything you stated, and would wager they are developing, or at least R&D'ing, effective, polished, "Apple" solutions to these problems. clipboard is a bit of an obscure one, but is absolutely a problem and must be addressed. but Apple is in the business of juggling user experience and privacy. it's quite difficult, because you don't want to get in the way of the user's intents and make things way hard to do. but you also don't want to make things so easy that bad actors can get away with bloody murder. granted, they still can, if they really want, but it's way harder. and slowly apple is killing the mice. it's a cat and mouse game. i think they're doing exactly what they should be. could they be doing more? hell yes. they should -always- strive to do more. but right now, this is better than last year, and the year before that, and the year... yknow.
motohagiography 6y ago
Linking biometrics to cryptographic authentication is difficult. When I worked on this problem about 5-6 years ago somewhere else, it came down to adding a separate applet for the biometric verification to the secure element, which then authenticated itself to the user authN applet, which was then authorized to generate the user authentication cryptogram. Biometrics are probabilistic samples of data, where cryptographic verification requires deterministic inputs. They are apples/oranges and that's what made this hard, so you need a connector for them. The attack on such a scheme means spoofing the biometric authenticator's validation message to the cryptographic authenticator, which, if this all occurs between applets on the same secure element, raises the bar for attacks.
- someguyorother 6y ago
  There are ways to use error-correcting codes to turn probabilistic samples into deterministic ones and mix them with a key. These are constructed so that you gain no information if you only know the key, or only know the biometric. See https://en.wikipedia.org/wiki/Fuzzy_extractor https://en.wikipedia.org/wiki/Fuzzy_extractor.
  - motohagiography 6y ago
    Great papers linked from that. At the time, it seemed the sensor APIs didn't provide a key with sufficient entropy to be considered a cryptographic verification for the tokens we were using. We didn't take it further because the entropy of the biometric sample was going to be diminished by using it to generate a static key, even though the papers linked show you can compose a key with error correcting codes, and intuitively, you could use some kind of probabilistic filter to verify a set of bits in the sample via shamir secret sharing to provide a threshold for a key. It still relies on separate security domains between the biometric sample collection and the cryptographic verifier, and we'd be deep in to the engineering over the differences, but these papers are really useful for getting into the details. One of the early ones was a good intro to it: http://people.csail.mit.edu/madhu/papers/2002/ari-journ.pdf http://people.csail.mit.edu/madhu/papers/2002/ari-journ.pdf
tectec 6y ago
Does anyone know if iOS devices support multiple users/bio metrics per device and could log a specific user in when they are using a shared device? I'm wondering if this could be used for a shared iPad on a factory floor to log users into their own account on our web app.
- turdnagel 6y ago
  It's not really supported for Face ID - you can create an "alternate appearance" for Face ID but it doesn't work well if the people look very different. With TouchID you can register fingers from different people and it works fairly well, but again not really supported.
- jacobr1 6y ago
  Since we are really talking about WebAuthn and not just the iOS implementation, You probably could use alternative hardware (maybe android based) that supports the multiple-user biometric use-case. From the server/web-app side it still would just be WebAuthn. Looks like you use a separate device like this: https://www.ftsafe.com/Products/FIDO/Bio https://www.ftsafe.com/Products/FIDO/Bio That supports fido2, hooked to any tablet to make it work.
jacobr1 6y ago
This really is just bringing WebAuthn to Safari. I've been using it via chrome w/ TouchID for our corporate okta SSO and it has been working great. WebAuthn is really just a way to make public-key/private-key crypto scale. The user never really knows about or interacts with the keys. The website doesn't store a password, they store a public key. The user doesn't know about the private key (paired to the public key) they just know how to unlock the private key via the yubikey or biometric device. The site sends some data to the user to sign, and they do so with the private key, then the site verifies the data was signed by the private key, boom: authenticated.
- sneak 6y ago
  To think we could have had this a decade+ ago with TLS client certificates, if web browsers weren't perpetually stuck in the past.
  - tialaramex 6y ago
    Client certificates suck in a bunch of ways that WebAuthn, specifically designed to solve this problem, does not. Example: If the certificate used to sign into Hacker News as "sneak" is also used to sign into PornHub then I can correlate that to discern that "sneak" on HN uses PornHub. Whereas you can't do that with WebAuthn credentials - a separate credential is spun up for every single registration, it's completely useless everywhere except the one site it was issued for and can't be correlated to other credentials except via a cryptographic attack on the underlying primitives (ie breaking WebAuthn itself).
    - ryukafalz 6y ago
      There's no reason a browser couldn't have generated a new self-signed client certificate for each site, though; the fact that they don't offer that as an option is just a browser design decision.
      - sirn 6y ago
        ...which means a login is now tied to a browser, and you have to come up with a way to securely export or sync private key (bad idea?) or a way to link another browser to a login. Also user losing access to all their websites by accidentally uninstalling a browser doesn't sounds very user friendly.
noodlesUK 6y ago
One of the reasons this is so important is that it makes it far harder to phish people. The webauthn APIs include the web origin in the authentication process, so it’s not possible to use something like modlishka to phish people. If we use magic links or something similar like a QR code for adding new devices, or more users also have roaming authenticators with PINs, webauthn will massively massively reduce phishing success where it’s implemented, as it’s pretty easy to make website that doesn’t have phishable credentials at all.
zaroth 6y ago
Apple is considering this to be multi-factor authentication all in one click, the something you have (the phone) and the something you are (FaceID or TouchID). For the site perspective, if you ask for attestation then you will have cryptographic evidence of this. No more SMS 2FA! Apple is promising to do something extra with their attestation process which they call "Apple Anonymous Attestation" to mitigate the issue where attestation allows tracking the same device across different websites even if they are using different usernames. Not included in the current release, but "coming soon". The process of enrolling an authenticator is presented as a "one and done" event, but of course the devil is in the details. Shared accounts would need multiple authenticators, and what happens when you upgrade your phone or lose your phone? I guess this gets handled like a password reset. You probably will want users to be able to add/remove authenticators, which means also having to name them. The enrollment process in this video highlights the upgrade path from a password login to a FaceID/TouchID login, but doesn't give us the UI flow of a new login. It seems like sites would need to implement a standard registration page and then perhaps swap out the password field with a Next button which would prompt for the FaceID/TouchID enrollment. Makes me wonder how does this compete with or tie into the 'Signin with Apple' if a site wants to offer one-click registration? Will my Mac and iOS devices automatically and securely sync the private keys between their respective Secure Enclaves so that I can signin from any of my devices after enrolling on just one? Lastly, how about the case when returning to a site where the user is on their enrolled device, but there isn't a cookie present. It looks like the site can detect that the device supports Webauthn, but I'm not sure if it can automatically detect that the device already has an account enrolled with the site? The call to 'credentials.get' includes the 'credentialIdBuffer' which is a value provided by the platform authenticator and saved during registration. But in the video they make it sound like 'credentialIdBuffer' is actually optional? It's not even clear to me in the official WebAuthn spec [1] if this value is required, or if the authenticator will just use the RP domain to present the user a list of available credentials? Ultimately I'm wondering if a user without a cookie will still have to type in their username before the site can prompt them for FaceID/TouchID authentication. [1] - https://w3c.github.io/webauthn/#dom-publickeycredentialrequestoptions-allowcredentials https://w3c.github.io/webauthn/#dom-publickeycredentialreque...
- alanwaketan 6y ago
EGreg 6y ago
What exactly does attestation do vs not having it? Can someone here explain clearly?
- jacobr1 6y ago
  With passwords, the "proof" or "attestation" is that nobody knows my secret password. In practice this tends to be weak. Some reasons this is so includes: - the password is low-entropy/complexity, so it is guessable or brute-forcible. - the password is typed into the system, so keyloggers might observe it - the password might be stored insecurity by the server - the password is transmitted over the network and might be intercepted - the password is transmitted over the network, possibly to unintended recipients (like a phishing site) and thus is intercepted. One alternative is employing public-key/private-key crypto. The server sends some random data to the user. The user signs that data with their private key (this is the attestation part). Only the signed data, which is generated for this single authentication attempt is transmitted. And during registration only the public key is transmitted. The public key is used by the service to verify the attested data. The private key remains secret the entire time. Likely it remains secret even to the user's machine because it lives in separate hardware, such as a yubikey or secure-enclave. The key is also something that isn't going to be guessed because we are using modern algos with large bit-sizes.
  - EGreg 6y ago
    Sure but how is that different from JUST logging in with touchID or faceID? Without attestation?
    - dannyw 6y ago
      If you don't have attestation, then I can write some JavaScript code that "return true" for the authentication callback, and log into any and every account.
    - jacobr1 6y ago
      There is no mechanism for that. The biometric hardware is local to your machine. I suppose the hardware could emit a "biometric fingerprint" that is transmitted to the server. And if anyone acquired your fingerprint they could unlock any site. Ok, so you could add some site specific salt to the process before sending the data. This is pretty close to just having a local password manager where the master key is biometric rather than a password. But touch/faceID aren't implemented that way. They intentionally don't expose the biometric profile, that is kept local to the secure enclave. They instead just give you access to the secure enclaves keystore. Rather than signing data you could just use uniquely generated public keys like a password, or do something like signing a websites name with a private key to generate a password. However, these approaches don't really make sense. The advantage of public-key cryptography is that you prove who you are WITHOUT SHARING the private/secret key. This is much more secure, because it prevents threat actors that don't have access to the private key from replicating the "proof" or signing process. This is what attestation is about. You can design alternative attestation schemes, but webauthn is pretty simple.
apl002 6y ago
I miss touch id. Face ID is one of my least favorite things apple has done
irrational 6y ago
My company recently started using Okta. This is the first time I've heard of webAuthn. Is there any relationship between Okta and WebAuthn?
- lukeramsden 6y ago
  Not as far as I'm aware, WebAuthn is a standard, and Okta is an authn provider. You can use WebAuthn with many other things, like the Yubikey.
LockAndLol 6y ago
The last I read, if you wanted security then Face ID and Touch ID definitely weren't the way to go. I'd rather see Apple pick up something like SQRL[0] than continue down this path of pseudo-security. They work, but it's like having a half-blind doorman who can't tell if you're wearing a mask or if it's your real face. 0: https://www.grc.com/sqrl/sqrl.htm https://www.grc.com/sqrl/sqrl.htm
- jmull 6y ago
  > The last I read, if you wanted security then Face ID and Touch ID definitely weren't the way to go. Sounds vague and overly general. I don't think anyone can take this seriously without some more information.
  - LockAndLol 6y ago
    You are but a duck-search away Face ID defeated with glasses and tape https://appleinsider.com/articles/19/08/08/face-id-security-defeated-with-glasses-and-tape https://appleinsider.com/articles/19/08/08/face-id-security-... Touch ID defeated by lifted fingerprints 2013: https://arstechnica.com/information-technology/2013/09/defeating-apples-touch-id-its-easier-than-you-may-think/ https://arstechnica.com/information-technology/2013/09/defea... 2016: https://appleinsider.com/articles/13/09/22/apples-touch-id-already-bypassed-with-established-fake-finger-technique https://appleinsider.com/articles/13/09/22/apples-touch-id-a... 2019: https://www.forbes.com/sites/daveywinder/2019/11/02/smartphone-security-alert-as-hackers-claim-any-fingerprint-lock-broken-in-20-minutes/ https://www.forbes.com/sites/daveywinder/2019/11/02/smartpho... Biometric "security" on phones is a gimmick.
    - jmull 6y ago
      These demos are useful to help understand the limitations of these security measures, but hardly invalidate them. E.g. from the first article you linked: > the attack is only really useful against unconscious victims, requiring both physical access and the tricky move of placing glasses on their face without waking them up. All authentication mechanisms have limitations, BTW.
nimbius 6y ago
I dont see a problem with this as part of MFA, but here in the US our fifth amendment protections are pretty lax, and only cover passwords (sometimes). If the police wanted to force your fingerprint or face ID to log into a website (say, maybe a protest message board), they can do it just the same as they can force your blood draw during a DUI with a warrant from a judge.
- nojito 6y ago
  The only way they can do that is with a warrant and if you own the website.
supernova87a 6y ago
So for the non-developer, is this basically as if any participating website could send an 2FA request to your iPhone (like the role of the SMS code but more secure), have the iPhone verify you by face/touch, and then confirm back to the website and let you in? (also like Google does with their app?). Or even take the place of a password?
- tialaramex 6y ago
  Done the way Apple describes it this (optionally) replaces the entire login sequence. Username, password, second factor, all replaced by tapping one button. When you register for this feature, your Apple device gives the site an ID (a really huge random-looking number) and a public key. The site associates this ID and key with your user. On subsequent visits you do something (e.g. press "Face Sign In" button on the site) and then your device authenticates you (with Face ID/ Touch ID) and if you pass it sends the same ID, and some signed stuff about this authentication. The site matches the ID, finds your user, checks the signed stuff is OK with the public key is stored before, and you're in - no other steps and very secure. WebAuthn can do simpler journeys that only replace the second factor or as a single factor but with the user still needing to provide their username first, but Apple is pushing developers to have this lovely journey that suits the Face ID/ Touch ID experience on an Apple product.
ixtli 6y ago
Anonymous attestation is really interesting because, afaict, there really isn't a way to do this right now if my application wants to authenticate a "normal" user with a "normal" phone.
StavrosK 6y ago
If anyone wants to deploy this server-side, I made a Django library that's very easy to use: https://gitlab.com/stavros/django-webauthin https://gitlab.com/stavros/django-webauthin You can see a demo login here: https://www.pastery.net/ https://www.pastery.net/ It allows the user to log in without a username or a password (untested on any Apple device as I don't have any, please file bugs if it doesn't work).
- zhoujianfu 6y ago
  Hmm, on an iPhone it asked me to hold my authentication device near the top of the phone, it didn’t use faceid at all... :/
  - aeontech 6y ago
    Are you on the new OS seed build?
    - kalleboo 6y ago
      I get the same thing, and I'm on the iOS 14 beta
- jedisct1 6y ago
  Doesn't work (yes, on iOS 14).
gorgoiler 6y ago
Isn’t this a classic example of the fragility of biometrics? If I move to a new device, iOS should be required to give up whatever secret key my face translates to, so I can log into websites. Simplistically, if iOS silently turned my face into the web password “g0rG0il3r”, when I eventually migrate from iOS to something new, I’ll have to be able take my face password with me, thus exposing that my face was only ever equivalent to a password in the first place?
- snuxoll 6y ago
  WebAuthN is not supposed to be the only way you log into a service. The credentials are permanently tied to your Authenticator of choice, which can be lost or stolen at any time. If you change devices you just provision the new one for your account after signing in with a traditional username/password(/2nd-factor).
  - GoMonad 6y ago
    FIDO/WebAuthn has been designed to be first factor authentication (passwordless) as well as 2FA. Though, I agree lost and stolen devices are a problem whose solution space needs more exploring than simply multiple auth devices.
    - bfulgham 6y ago
      This is, of course, an active thread of discussion in the WebAuthentication working group.
      - GoMonad 6y ago
        Can you point me to that discussion? I'd love to read more about it.
aarongray 6y ago
A fingerprint can be a personal password or it can be a government ID, but it can’t be both. Since the U.S. government already has something like 200 million fingerprints on file, and many foreign governments collect fingerprints whenever you travel, these fingerprints are sometimes leaked en masse (https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach#Theft_of_fingerprints https://en.wikipedia.org/wiki/Office_of_Personnel_Management...), and because they can never be changed, biometrics aren't my personal choice for a secure method of authentication.
- hn_throwaway_99 6y ago
  But I think you missed the point about the second factor, because there are really 2 factors here: 1. Something you have (e.g. your phone, in this case the Secure Enclave that stores the private key). 2. Something you 'know', e.g. your fingerprint. Just having the fingerprint itself is not sufficient.
  - the_svd_doctor 6y ago
    This is key. I just hope this never changes and we never end up in a situation where the fingerprint is all that is used. Because for most non technical user, my bank app asking my fingerprint to unlock the app is exactly that. They don't really get the difference.
  - aarongray 6y ago
    That's a good point that it is more nuanced. The issue I think is that organized crime and unscrupulous governments are getting better at connecting these things so they are not as cleanly separated as they have been in the past. Just look at China. Essentially spyware and viruses are installed at checkpoints on people's phones and biometric tracking is becoming very commonplace. I don't think it will be long before organized crime begins to get better at this too. As such, being able to change that "something you know" is a very powerful countermeasure.
- someguyorother 6y ago
  In addition, fingerprints and faces are particularly bad biometrics for keeping secrets, because attackers can get hold of them without you noticing. E.g. anyone can take a picture of you in a crowd, or lift your fingerprints if they can get to somewhere you've been. But they can't do a surreptitious retinal scan on you.
GekkePrutser 6y ago
Great to see Apple is focusing on Webauthn this time instead of rolling something themselves that only works inside their walled garden. Android is doing the same thing: Android phones are now also capable of being a FIDO2 authenticator for Webauthn. Now what we need is many more sites actually offering it :) I'm already using it for Office 365 but that's really the only one so far that I use that offers it.
exabrial 6y ago
Face Id is a terrible idea in the age of westerners wearing masks or south Asian countries
EGreg 6y ago
Can a person have more than one account? Does google have a similar thing? Because overnight we can finally stop sybil attacks! Right?
coronadisaster 6y ago
Face or finger data is akin a login name... What is the password in that case? Because if you cant change your password, that could be a problem
- Ayesh 6y ago
  Face/finger data is never revealed to the web sites. You can read webauthn for more information.
- EtienneK 6y ago
  The biometric data never leaves your device. Your biometric is only used to unlock a private key stored in the secure enclave of your phone. This private key is then used to sign a server-sent challenge. The phone sends this signed challenge back to the server, where the server can validate it using the public key. The public/private key gets generated by the phone upon first registration with the server.
  - coronadisaster 6y ago
    So if someone has your phone and your face, not only can they unlock your phone but also the services that you are using?
tonyhb 6y ago
Called it, but it took longer than expected: https://news.ycombinator.com/item?id=18141918 https://news.ycombinator.com/item?id=18141918 The Safari team do move slowly.
hubert1234 6y ago
Sometimes it feels like I'm the only one that doesn't trust biometric sensors. I mean it's basically magic. If for any reason the face detection algorithm doesnt match your face anymore you have the equivalent problem of losing the master password to your entire password store.
- Cogito 6y ago
  It's a little different, I think. You could have it set up where your face is the one-and-only thing that identifies you, but that doesn't seem to be the case in practice. Instead, we have the multipart authentication used in many places today: something you know (password), something you are (biometric fingerprint/face), and something you have (your physical device, your email account, your phone number). Any one of these has downsides (stolen password, biometric misidentification or duplication, redirected phone number) but in combination with the others makes it much harder to circumvent authentication. Almost all systems have some kind of fallback that rely on a 'something you know' like a master password, and can optionally only be changed if you have other authentication methods (like physically having the device in your hands). Having multipart authentication allows for a better user experience (look at your phone and it unlocks) with an acceptable amount of risk (you have to have your phone and be you in order to unlock it), with systems to fallback to if something fails (get the super secret password off that slip of paper you hid in your mother-in-laws garden shed behind the loose brick in the wall). The typcial authentication flows are both more secure and more convenient, and the user is responsible for the security of the backup.
- neuronic 6y ago
  Forgive my ignorance: isn't this solved by fallbacks, at least on the iPhone/MacBook itself (don't know about webauthn)? If my finger is rejected multiple times, I am asked for the password instead.
buoyantair 6y ago
I wonder how these face detection algorithms work for transgender folks...
- robertoandred 6y ago
  Have transgender people had issues with FaceID?
- fiblye 6y ago
  Unless they're getting extensive facial surgery, their phones will acknowledge them.
erickhill 6y ago
Unfortunately Face ID has become much less useful since many of us began using face masks. I wish I had touch ID back on my iPhone.
gmantg 6y ago
There's surprising support here for the faceid stuff, despite it's clearly made to normalize using biometric data for everything and make one step towards the survelliance state. But let's pretend we are more concerned with security of this approach: how is it better than a ring with a chip you'd wear and use for auth? If this identity is compromised, you could just get another ring. And you wouldn't need to give your real identity to apple.
- threentaway 6y ago
  All biometric processing happens locally. You aren't sending your fingerprint or face, they simply unlock the private key in the enclave.
  - gmantg 6y ago
    Sure, at this point Apple's solution likely works this way: they care about their reputation. But even a secure faceid opens the Pandora box: today it's just iPhone users, 5 years later it's everywhere, including in solutions from Huawei and 10 years later it's the law. Afaik, Delta airlines already trying to use faceid. And once faceid is required to buy gas and groceries, your complete and nuanced dossier will be available for sale on all these data exchange brokerages. In this beautiful future, faceid is needed to unlock any car and it would play you ads for 3 mins while it's starting.
- planb 6y ago
  > How is it better than a ring with a chip you'd wear and use for auth? Normal people would actually use it. And this is in fact not different. The phone IS the ring. You just unlock it using your biometrics (and of course, the data is NOT given to Apple)
sytelus 6y ago
FaceID is one of the most important technology invented. Imagine if Apple somehow was open to license it and make it universal like Bill Gates wanted to make PCs universal. It can make driver licenses, passports, credit cards, student IDs, insurance IDs - all of these can be things of past. You go to grocery store and simply pay using your face. You want to pay online? Simply look at FaceID device that is now standard with all new computers sold. This is 100s of billions worth of business to make so much legacy gone. Security and identity is now (hopefully) solved but unfortunately still all behind walled garden.
- jsf01 6y ago
  Why did fingerprinting never catch on in that way? That tech has existed for ages. Way cheaper to implement as well. Seems like it would also be less prone to false positives compared to facial recognition, but that’s just speculation on my part.
  - teruakohatu 6y ago
    Fingerprints are left everywhere and even photographed from a distance. It is harder to 3D scan a face then recreate it in such a way as to fool Face ID although I am sure it is possible.
  - searchableguy 6y ago
    Touch ID has been hacked multiple times. It's not reliable. 0] The probability that a random person in the population could look at your iPhone or iPad Pro and unlock it using Face ID is approximately 1 in 1,000,000 with a single enrolled appearance. As an additional protection, Face ID allows only five unsuccessful match attempts before a passcode is required. The statistical probability is different for twins and siblings that look like you and among children under the age of 13, because their distinct facial features may not have fully developed. If you're concerned about this, we recommend using a passcode to authenticate. For comparison, touch ID has a probability of 1 in 50,000. 0] https://support.apple.com/en-in/HT208108 https://support.apple.com/en-in/HT208108
- teddyh 6y ago

647 points by gok 6y ago

This has been a very long time coming. Apple finally joined FIDO in Feb of this year, so we knew it was right around the corner.

theboat 6y ago

If the web migrates to biometric sensors for authentication, I hope this won't suffer from vendor lock-in. When every new device ships with facial recognition and/or a fingerprint reader, it will be nice to login using my face/fingerprint irrespective of the device I'm on.

cgb223 6y ago
We’d need to have a standard HTML element like <facial-rec> or something and let the browser handle mapping it to whatever specific hardware the device is using
- rovr138 6y ago
  The issue is that it's just a token that would simply say Passed/Fail. So it's trusting the client/browser.
  - duskwuff 6y ago
    It's more than that -- from what I'm seeing, it looks like it's a cryptographic token, presumably signed by a certificate that's embedded somewhere inaccessible in the device (probably in the secure element).
  - crispyporkbites 6y ago
    If the token is signed you could validate it with Apple (or the vendor that implemented the face recognition on the device, eg Samsung, Nokia, pinephone etc). You just need an open standard, you could even embed the url of the validating api in the token, so anyone could create their own Face ID provider.
    - bfulgham 6y ago
      That's precisely what the attestation section of the talk describes. This is all part of the WebAuthentication standard.
Spivak 6y ago
I don't see how this could ever be something not vendor-specific because without this being tied to "Log in with Apple" you're just saying "trust the client." Maybe that's fine if all you want is to "lock" a sensitive page to people who aren't the device owner but that's pretty limited compared to FaceID to actually log in.
- tialaramex 6y ago
  It has no relationship to "Log in with Apple". It's a WebAuthn authenticator. Almost all web sites should just implement WebAuthn. On a suitable iPhone or Mac users will be able to sign in by touching the sensor or looking at the camera, while on my Pixel phone I touch the fingerprint sensor, on this Linux desktop I touch a Yubico Security Key. If your site is paranoid that some crazy user will choose a bad WebAuthn authenticator, or deliberately sabotage their own security for some reason, then you can use WebAuthn Attestation to obtain a signed document from the authenticator (yes, over the Web) which proves that it is, for example, an Apple iPhone 25 Super Mega Plus. I don't think you should bother doing that, but you can.
munchbunny 6y ago
This looks like a WebAuthn implementation, in which case it's an established standard and lots of vendors have interchangeable implementations. For example, Windows Hello has been WebAuthn compatible (FIDO2) for a while for sites configured to accept on-device authenticators.
acdha 6y ago
This isn't biometric authentication: it's WebAuthn, which is a public-key based system implemented by all major browsers (https://webauthn.io/ https://webauthn.io/). This particular implementation uses biometrics to unlock it but other implementations use a contact sensor (Yubikeys) or PIN, and the target website doesn't need to know anything about which particular mechanism was used to unlock the keystore.
chrismorgan 6y ago
This is an implementation of the Web Authentication API, and is exposed as a platform authenticator. There is no vendor lock-in.

theogravity 6y ago

I wonder what part of the Web Auth APIs does iOS Safari support since MDN says most of the APIs are not supported. https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent...

jedieaston 6y ago
I think that this is coming in the next release of Safari, so MDN is correct, it's not currently supported.
- alanwaketan 6y ago
  WebAuthn API is supported in WebKit starting from Safari 13 and iOS 13. The MDN chart needs to be properly updated.
  - madjam002 6y ago
    Hardly, it only supports basic MFA scenarios with a cross platform Authenticator. User verification + resident keys were never implemented in Safari 13.

lifeisstillgood 6y ago

So roughly speaking this is WebAuthn for a web site, with the iphone acting as the dongle. It's a really good idea. I can see there being a big demand for just simplifying signin - I can easily see a time where it is worth not having the hassle of managing multiple signin processes and just choosing webauth or nothing. Edit: to be clear this won't affect B2C sites whose monetisation is based on getting as many people as possible. But imagine a saas business charging upwards of 100 bucks a month - they have something valuable to protect, and the security story just got a lot easier

monocasa 6y ago
Webauthn actually fully supports this model as "platform authenticators", ie hardware security modules built into the client system. You see this on the windows side too where "Windows Hello" integrates with the TPM and acts as a platform authenticator as well. No need to speak roughly.
- tialaramex 6y ago
  Yup. A site can even say "I want a platform authenticator" or "I specifically don't want a platform authenticator" during registration using the Javascript API. Most sites should just not care, but it's an option if you've determined there's a specific reason it matters in your application.
  - DaiPlusPlus 6y ago
    > A site can even say "I want a platform authenticator" or "I specifically don't want a platform authenticator" during registration using the Javascript API. Websites should not depend on JavaScript for something that should be able to be done declaratively. (Amongst other things - we shouldn't need to use `fetch`/`XMLHttpRequest` when a <form> would work just-as-well - but if only <form> let us use more than just GET and POST, and supported more types of serialization, and supported asynchronous form submission - and bring back <keygen>!).
- judge2020 6y ago

_jal 6y ago

Going to have to give serious thought to where I will and won't use this. There are a lot of implications - no ability to automate and giving others data on you were provably in front of some machine are two big ones.

duskwuff 6y ago
That's a really interesting point. If this really does allow a web user to prove that a human interacted with the computer, it'd make for a really nice CAPTCHA replacement.
- jiveturkey 6y ago
  it doesn't do that, since there's no attestation.
  - Tepix 6y ago
    Did you watch the video?
    - jiveturkey 6y ago
      where he says it is "not included"? (because the Apple secure enclave does not attest keys.) also where he falsely alludes to other attestations being identifying? sure, they can be, but they generally aren't.
  - bfulgham 6y ago
    Yes there is. The video covers this clearly.
thephyber 6y ago
From the server side, isn't this just a WebAuth integration? How does the server know for sure if the client is on an iOS Safari browser on an iPhone with FaceID or a custom browser on any OS and any non-locked-down hardware being run with Selenium?

mtgp1000 6y ago

No way this biometric data could possibly be abused, right? I'll stick to taping over my cameras, thanks.

empath75 6y ago
it never leaves your phone.
- mtgp1000 6y ago
  Yeah, and my personal data never left Equifax's servers either. You can't change your biometrics when they are inevitably hacked. If you even find out.
  - orf 6y ago
    I quite rightly trust Apple more than I trust Equifax.
  - monocasa 6y ago
    For all Apple's faults, they're pretty open about how their Secure Enclave works. I think they consider privacy to be a key differentiator, particularly when compared to Android and Windows. you can see this in how they didn't open a phone even given an FBI request.
    - kohtatsu 6y ago
      They didn't develop the capability to backdoor phones at the FBI's request. They are generally happy to hand over iCloud backups, which they did in that case and the FBI "lost" them IIRC. It was also an iPhone 5c, the last iPhone without a Secure Enclave, I believe they were able to get in with GrayKey.
      - monocasa 6y ago
        > They are generally happy to hand over iCloud backups That one they legally have to do when given a subpoena.

adamleithp 6y ago

The keynote a few days ago failed to mention FaceID used to opening your mac... and this video shows/mentions FaceID on a macOS11 website? Seems they missed a step here with rolling it out, or are withholding the obvious. I'm assuming the latter.

JimDabell 6y ago
This video shows Touch ID being used with a laptop, not Face ID. The interface is generic, so it should use Face ID on devices that have Face ID hardware, and Touch ID on devices that have Touch ID hardware.
- goalieca 6y ago
  FaceID requires special cameras and infrared lighting system. Perhaps they would add that to the mbp one day but that would be a crazy leak if they showed off that capability now.
sirn 6y ago
Apple supports WebAuthn on iOS/iPadOS as well (since iOS/iPadOS 13) so presumably FaceID part is referring to iOS/iPadOS.

paxys 6y ago

Happy to see Apple following an established standard for once.

barbegal 6y ago

This isn't that revolutionary: LastPass already allows you to use biometric ID to authenticate and it works without any changes to the website.

crispyporkbites 6y ago
Right but Apple have done it and they have actual market share and 100% control of the end to end device
jrockway 6y ago
It also doesn't add any security. Your password can still be guessed or phished. When authenticating with a cryptographic token (U2F/WebAuthn), that vector goes away. (Even OTP can be phished... the phishing site can just ask you for the code.) Password managers do make it more difficult to get phished, since they will not know what password to autofill on phishing.example.com... but on the other hand, password manager users are used to having to force-fill a password. I have to take my password out of LastPass to log into Battle.net or Fusion 360, and websites like the Wall Street Journal create your account on dowjones.com but require you to log in on wsj.com (or maybe it's the opposite, I forget). With WebAuthn, more care is required for both the site operator and the user (have more than one way of logging in in case you lose your phone, make sure the enrollment and login origins are the same), but you are then open to fewer attacks.
- treebornfrog 6y ago
  What happens in the instance that one wants to move away from webauthn?
- amluto 6y ago
  WebAuthn is less phishing resistant than it should be. The original intent was that WebAuthn + token binding would ensure that, even if an attacker obtained a fraudulent certificate for a victim site and had an MITM position on the network, the attacker still couldn’t steal a WebAuthn protected session. Alas, Chrome removes its token binding implementation, and WebAuthn no longer has this property. If you authenticate with WebAuthn, and there is a MITM, the MITM gets your session. (Conventional phishing is still prevented. If you go to, say, g00gle.com, the owner of g00gle.com can’t reuse your authentication to authenticate to google.com. But this relies on your browser actually knowing what domain it’s looking at, which relies on the CA system.)

zuhayeer 6y ago

Interesting, Apple is letting you change your default web browser with this new iOS version, but also adding Face ID and Touch ID to Safari. Why would anyone want to build these features if they're so platform / browser specific? Does anyone know if these auth features might work on other browsers on iPhone?

aaomidi 6y ago
There isn't a reason it wouldn't work - the browsers all use the same engine anyway.
- abrowne 6y ago
  If Apple lets other browsers using the engine have access to this feature.
- throw03172019 6y ago
  There are some differences between Safari and WKWebView. Some features are blocked.
  - mathisonturing 6y ago
    It's funny how much bashing Google gets for monopoly with Android, pushing users to use Chrome, Play Store and whatnot. While all of that is relevant, Apple's stranglehold seems much more and worse.
    - naringas 6y ago
      at least apple never pretended like iOS was open source
    - jodrellblank 6y ago
      Apple sells between 10-20% of smartphones per quarter[1], that implies Android makes up 80+% and Windows/Blackberry a neglible amount. How can Apple be a monopolist from such a small position, or have a "stranglehold" when they are outsold 4-8x by the competition? [1] https://www.statista.com/statistics/216459/global-market-share-of-apple-iphone/ https://www.statista.com/statistics/216459/global-market-sha...

elwell 6y ago

1Password users can already have effectively the same experience.

toomuchtodo 6y ago
Apple users will get this natively without having to acquire 1Password. If you’ve bought into the Apple ecosystem and don’t have needs outside of it (Windows, Linux), you can eliminate the need for a separate password manager. Similar to how iCloud Files is moving towards (but likely won’t meet, while not needing to) Dropbox parity. This is making a friendly version of Yubikeys (using Apple devices) and password vaults for Apple users.
- bdcravens 6y ago
  I'm more of a fan of buy-in without lock-in.
- chanmad29 6y ago
  so one more instance of Apple effectively rendering a third party app useless. As an apple user, I love that I do not need to install an additional app but something does not feel right from an ethical standpoint. Or maybe I'm just being too touchy.
  - toomuchtodo 6y ago
    I would rather have a native UX versus Bitwarden, especially if there’s no additional cost (I have to pay for Bitwarden annually or spend time running a server) and an easy way to share creds with my partner (for delegation in the event of my passing). Competition and a free market has perils. May the best solution win.
    - MetallicCloud 6y ago
      You can use Bitwarden for free while using their servers.

BiteCode_dev 6y ago

Giving my finger and face prints to the browser, the software with the biggest attack surface in the world, connected to internet no less, feels off to me.

lemoncucumber 6y ago
Native apps have long been able to use TouchID/FaceID and have never been able to access the actual finger/face print data. There's no way that iOS exposes your actual finger or face print to websites.
brandonhorst 6y ago
All of that is managed by the Secure Enclave in exactly the same way that it is for all over auth on Apple devices. The browser doesn't touch it at all.
- thowawaymom 6y ago
  Oh the almighty Secure Enclave, bow down to the Enclave... Do you even know what the heck an enclave is and how does it work? It's nuts that when a figure of authority uses a fancy shiny new word to describe some magic black box and the masses follow with no questions asked.
  - nicky0 6y ago
    The concept has been around for years now, it is well understood.
  - orf 6y ago
    Do you know how it works?
    - thowawaymom 6y ago
      That's the point, not many do

EGreg 6y ago

Just to state the obvious... Biometric data must always stay on your personal device in order to be secure from replay attacks, not to mention finding out more about you. https://amp.theguardian.com/world/2019/sep/04/smile-to-pay-chinese-shoppers-turn-to-facial-payment-technology https://amp.theguardian.com/world/2019/sep/04/smile-to-pay-c... Of course, in Apple’s implementation, the data never leaves the device. Which is far better than, say, how facial recognition is used in China for payment where the merchant is the one operating the machine which scans your face.

marinhero 6y ago
The video mentions the data never leaves the device and that the transaction is performed in the secure enclave of the phone.

echeese 6y ago

I got a Yubikey earlier this year and was disappointed by Apple's implementation of WebAuthn it (doesn't work if there's a PIN on the device) but it looks like they're fixing that as well in iOS 14

0xCMP 6y ago
I'm hoping it works with NFC and not just the lightning one. Would be nice to have Yubikey replace my password and then allow me to enroll FaceID so I can keep signing back in.
- echeese 6y ago
  The current Yubikey works with NFC on iOS, it just doesn't work if you add a PIN to it (which Windows Hello requires). They mention that they added PIN support in the changelog

thowawaymom 6y ago

Oh the almighty Secure Enclave, bow down to the Enclave... I see so many comments mentioning Secure Enclave to any security objection as if it's a panacea. Do you even know what the heck an enclave is and how does it work? It's nuts that when a figure of authority uses a fancy shiny new word to describe some magic black box and the masses follow with no questions asked.

derefr 6y ago
> Do you even know what the heck an enclave is and how does it work? It's a isolated smart-card-like KMS core within the SoC, that has most smart-card guarantees (e.g. no side-channel attacks; tamper-resistance.)
acdha 6y ago
Please don't spam the same comment
- thowawaymom 6y ago
  I literally mentioned it one other time as a reply to a comment, that's hardly spam (the m stands for mass, fyi)
monocasa 6y ago
They've been fairly open about how it works, and since then the binaries have been disassembled and backed up what they were saying. It's a pretty modified L4 (I want to say L4::Pistachio off the top of my head) that for some reason has had Mach-O support added and pretty much just acts as a keystore with a secure but upgradable boot sequence.
acdha 6y ago
You may not know what it is but it's been well documented for years detailing what it is, what it's used for, and the built-in tamper-resistance features: https://support.apple.com/guide/security/secure-enclave-overview-sec59b0b31ff/1/web/1 https://support.apple.com/guide/security/secure-enclave-over... https://www.apple.com/lae/business/docs/site/iOS_Security_Guide.pdf https://www.apple.com/lae/business/docs/site/iOS_Security_Gu...

thowawaymom 6y ago

Don't mean to sound harsh, but is it just me or the speaker was borderline impossible to understand? What is that word again "authontication"?

xvector 6y ago

I think it's pretty ridiculous that Apple pours time and effort into stuff like this but apps have been able to steal from your clipboard for years. It reminds me of the phenomenon when researchers and engineers don't work on something that's useful for everyday users, instead prioritizing what they find exciting and cool. The security team is so busy dealing with absurd edge cases like nation-states attacking your enclave that they don't seem to care to address egregious and obvious holes in the security model like this. It's not that WebAuthn and passwordless isn't exciting or useful, it's just that there are much bigger fish to fry (clipboard paste, terrible permissions management, non-shitty VPN support, trackers in apps) that Apple seems completely uninterested in addressing. There really is no excuse, at least not when you're tooting the privacy/security horn so loudly, but let stuff like this pass by. Edit: have y'all thought of an actual counterargument instead of just downvoting? Is it really too much to ask security engineers at Apple to focus on actual major privacy holes in their OS than things like this?

_fzslm 6y ago
i don't want to focus too much on why i think you're being downvoted but i would say it's probably because your message came across as quite reductive. > engineers don't work on something that's useful for everyday users, instead prioritizing what they find exciting and cool i get this, to some extent. i really do. but i don't think WebAuthn, sign in with apple, ios 14's recent microphone and camera usage indicators, etc. are not huge steps forward in terms of mobile privacy & security. (rough double negative. you get me.) i am pretty sure Apple knows about everything you stated, and would wager they are developing, or at least R&D'ing, effective, polished, "Apple" solutions to these problems. clipboard is a bit of an obscure one, but is absolutely a problem and must be addressed. but Apple is in the business of juggling user experience and privacy. it's quite difficult, because you don't want to get in the way of the user's intents and make things way hard to do. but you also don't want to make things so easy that bad actors can get away with bloody murder. granted, they still can, if they really want, but it's way harder. and slowly apple is killing the mice. it's a cat and mouse game. i think they're doing exactly what they should be. could they be doing more? hell yes. they should -always- strive to do more. but right now, this is better than last year, and the year before that, and the year... yknow.

motohagiography 6y ago

Linking biometrics to cryptographic authentication is difficult. When I worked on this problem about 5-6 years ago somewhere else, it came down to adding a separate applet for the biometric verification to the secure element, which then authenticated itself to the user authN applet, which was then authorized to generate the user authentication cryptogram. Biometrics are probabilistic samples of data, where cryptographic verification requires deterministic inputs. They are apples/oranges and that's what made this hard, so you need a connector for them. The attack on such a scheme means spoofing the biometric authenticator's validation message to the cryptographic authenticator, which, if this all occurs between applets on the same secure element, raises the bar for attacks.

someguyorother 6y ago
There are ways to use error-correcting codes to turn probabilistic samples into deterministic ones and mix them with a key. These are constructed so that you gain no information if you only know the key, or only know the biometric. See https://en.wikipedia.org/wiki/Fuzzy_extractor https://en.wikipedia.org/wiki/Fuzzy_extractor.
- motohagiography 6y ago
  Great papers linked from that. At the time, it seemed the sensor APIs didn't provide a key with sufficient entropy to be considered a cryptographic verification for the tokens we were using. We didn't take it further because the entropy of the biometric sample was going to be diminished by using it to generate a static key, even though the papers linked show you can compose a key with error correcting codes, and intuitively, you could use some kind of probabilistic filter to verify a set of bits in the sample via shamir secret sharing to provide a threshold for a key. It still relies on separate security domains between the biometric sample collection and the cryptographic verifier, and we'd be deep in to the engineering over the differences, but these papers are really useful for getting into the details. One of the early ones was a good intro to it: http://people.csail.mit.edu/madhu/papers/2002/ari-journ.pdf http://people.csail.mit.edu/madhu/papers/2002/ari-journ.pdf

tectec 6y ago

Does anyone know if iOS devices support multiple users/bio metrics per device and could log a specific user in when they are using a shared device? I'm wondering if this could be used for a shared iPad on a factory floor to log users into their own account on our web app.

turdnagel 6y ago
It's not really supported for Face ID - you can create an "alternate appearance" for Face ID but it doesn't work well if the people look very different. With TouchID you can register fingers from different people and it works fairly well, but again not really supported.
jacobr1 6y ago
Since we are really talking about WebAuthn and not just the iOS implementation, You probably could use alternative hardware (maybe android based) that supports the multiple-user biometric use-case. From the server/web-app side it still would just be WebAuthn. Looks like you use a separate device like this: https://www.ftsafe.com/Products/FIDO/Bio https://www.ftsafe.com/Products/FIDO/Bio That supports fido2, hooked to any tablet to make it work.

jacobr1 6y ago

This really is just bringing WebAuthn to Safari. I've been using it via chrome w/ TouchID for our corporate okta SSO and it has been working great. WebAuthn is really just a way to make public-key/private-key crypto scale. The user never really knows about or interacts with the keys. The website doesn't store a password, they store a public key. The user doesn't know about the private key (paired to the public key) they just know how to unlock the private key via the yubikey or biometric device. The site sends some data to the user to sign, and they do so with the private key, then the site verifies the data was signed by the private key, boom: authenticated.

sneak 6y ago
To think we could have had this a decade+ ago with TLS client certificates, if web browsers weren't perpetually stuck in the past.
- tialaramex 6y ago
  Client certificates suck in a bunch of ways that WebAuthn, specifically designed to solve this problem, does not. Example: If the certificate used to sign into Hacker News as "sneak" is also used to sign into PornHub then I can correlate that to discern that "sneak" on HN uses PornHub. Whereas you can't do that with WebAuthn credentials - a separate credential is spun up for every single registration, it's completely useless everywhere except the one site it was issued for and can't be correlated to other credentials except via a cryptographic attack on the underlying primitives (ie breaking WebAuthn itself).
  - ryukafalz 6y ago
    There's no reason a browser couldn't have generated a new self-signed client certificate for each site, though; the fact that they don't offer that as an option is just a browser design decision.
    - sirn 6y ago
      ...which means a login is now tied to a browser, and you have to come up with a way to securely export or sync private key (bad idea?) or a way to link another browser to a login. Also user losing access to all their websites by accidentally uninstalling a browser doesn't sounds very user friendly.

noodlesUK 6y ago

One of the reasons this is so important is that it makes it far harder to phish people. The webauthn APIs include the web origin in the authentication process, so it’s not possible to use something like modlishka to phish people. If we use magic links or something similar like a QR code for adding new devices, or more users also have roaming authenticators with PINs, webauthn will massively massively reduce phishing success where it’s implemented, as it’s pretty easy to make website that doesn’t have phishable credentials at all.

zaroth 6y ago

Apple is considering this to be multi-factor authentication all in one click, the something you have (the phone) and the something you are (FaceID or TouchID). For the site perspective, if you ask for attestation then you will have cryptographic evidence of this. No more SMS 2FA! Apple is promising to do something extra with their attestation process which they call "Apple Anonymous Attestation" to mitigate the issue where attestation allows tracking the same device across different websites even if they are using different usernames. Not included in the current release, but "coming soon". The process of enrolling an authenticator is presented as a "one and done" event, but of course the devil is in the details. Shared accounts would need multiple authenticators, and what happens when you upgrade your phone or lose your phone? I guess this gets handled like a password reset. You probably will want users to be able to add/remove authenticators, which means also having to name them. The enrollment process in this video highlights the upgrade path from a password login to a FaceID/TouchID login, but doesn't give us the UI flow of a new login. It seems like sites would need to implement a standard registration page and then perhaps swap out the password field with a Next button which would prompt for the FaceID/TouchID enrollment. Makes me wonder how does this compete with or tie into the 'Signin with Apple' if a site wants to offer one-click registration? Will my Mac and iOS devices automatically and securely sync the private keys between their respective Secure Enclaves so that I can signin from any of my devices after enrolling on just one? Lastly, how about the case when returning to a site where the user is on their enrolled device, but there isn't a cookie present. It looks like the site can detect that the device supports Webauthn, but I'm not sure if it can automatically detect that the device already has an account enrolled with the site? The call to 'credentials.get' includes the 'credentialIdBuffer' which is a value provided by the platform authenticator and saved during registration. But in the video they make it sound like 'credentialIdBuffer' is actually optional? It's not even clear to me in the official WebAuthn spec [1] if this value is required, or if the authenticator will just use the RP domain to present the user a list of available credentials? Ultimately I'm wondering if a user without a cookie will still have to type in their username before the site can prompt them for FaceID/TouchID authentication. [1] - https://w3c.github.io/webauthn/#dom-publickeycredentialrequestoptions-allowcredentials https://w3c.github.io/webauthn/#dom-publickeycredentialreque...

alanwaketan 6y ago

EGreg 6y ago

What exactly does attestation do vs not having it? Can someone here explain clearly?

jacobr1 6y ago
With passwords, the "proof" or "attestation" is that nobody knows my secret password. In practice this tends to be weak. Some reasons this is so includes: - the password is low-entropy/complexity, so it is guessable or brute-forcible. - the password is typed into the system, so keyloggers might observe it - the password might be stored insecurity by the server - the password is transmitted over the network and might be intercepted - the password is transmitted over the network, possibly to unintended recipients (like a phishing site) and thus is intercepted. One alternative is employing public-key/private-key crypto. The server sends some random data to the user. The user signs that data with their private key (this is the attestation part). Only the signed data, which is generated for this single authentication attempt is transmitted. And during registration only the public key is transmitted. The public key is used by the service to verify the attested data. The private key remains secret the entire time. Likely it remains secret even to the user's machine because it lives in separate hardware, such as a yubikey or secure-enclave. The key is also something that isn't going to be guessed because we are using modern algos with large bit-sizes.
- EGreg 6y ago
  Sure but how is that different from JUST logging in with touchID or faceID? Without attestation?
  - dannyw 6y ago
    If you don't have attestation, then I can write some JavaScript code that "return true" for the authentication callback, and log into any and every account.
  - jacobr1 6y ago
    There is no mechanism for that. The biometric hardware is local to your machine. I suppose the hardware could emit a "biometric fingerprint" that is transmitted to the server. And if anyone acquired your fingerprint they could unlock any site. Ok, so you could add some site specific salt to the process before sending the data. This is pretty close to just having a local password manager where the master key is biometric rather than a password. But touch/faceID aren't implemented that way. They intentionally don't expose the biometric profile, that is kept local to the secure enclave. They instead just give you access to the secure enclaves keystore. Rather than signing data you could just use uniquely generated public keys like a password, or do something like signing a websites name with a private key to generate a password. However, these approaches don't really make sense. The advantage of public-key cryptography is that you prove who you are WITHOUT SHARING the private/secret key. This is much more secure, because it prevents threat actors that don't have access to the private key from replicating the "proof" or signing process. This is what attestation is about. You can design alternative attestation schemes, but webauthn is pretty simple.

apl002 6y ago

I miss touch id. Face ID is one of my least favorite things apple has done

irrational 6y ago

My company recently started using Okta. This is the first time I've heard of webAuthn. Is there any relationship between Okta and WebAuthn?

lukeramsden 6y ago
Not as far as I'm aware, WebAuthn is a standard, and Okta is an authn provider. You can use WebAuthn with many other things, like the Yubikey.

LockAndLol 6y ago

The last I read, if you wanted security then Face ID and Touch ID definitely weren't the way to go. I'd rather see Apple pick up something like SQRL[0] than continue down this path of pseudo-security. They work, but it's like having a half-blind doorman who can't tell if you're wearing a mask or if it's your real face. 0: https://www.grc.com/sqrl/sqrl.htm https://www.grc.com/sqrl/sqrl.htm

jmull 6y ago
> The last I read, if you wanted security then Face ID and Touch ID definitely weren't the way to go. Sounds vague and overly general. I don't think anyone can take this seriously without some more information.
- LockAndLol 6y ago
  You are but a duck-search away Face ID defeated with glasses and tape https://appleinsider.com/articles/19/08/08/face-id-security-defeated-with-glasses-and-tape https://appleinsider.com/articles/19/08/08/face-id-security-... Touch ID defeated by lifted fingerprints 2013: https://arstechnica.com/information-technology/2013/09/defeating-apples-touch-id-its-easier-than-you-may-think/ https://arstechnica.com/information-technology/2013/09/defea... 2016: https://appleinsider.com/articles/13/09/22/apples-touch-id-already-bypassed-with-established-fake-finger-technique https://appleinsider.com/articles/13/09/22/apples-touch-id-a... 2019: https://www.forbes.com/sites/daveywinder/2019/11/02/smartphone-security-alert-as-hackers-claim-any-fingerprint-lock-broken-in-20-minutes/ https://www.forbes.com/sites/daveywinder/2019/11/02/smartpho... Biometric "security" on phones is a gimmick.
  - jmull 6y ago
    These demos are useful to help understand the limitations of these security measures, but hardly invalidate them. E.g. from the first article you linked: > the attack is only really useful against unconscious victims, requiring both physical access and the tricky move of placing glasses on their face without waking them up. All authentication mechanisms have limitations, BTW.

nimbius 6y ago

I dont see a problem with this as part of MFA, but here in the US our fifth amendment protections are pretty lax, and only cover passwords (sometimes). If the police wanted to force your fingerprint or face ID to log into a website (say, maybe a protest message board), they can do it just the same as they can force your blood draw during a DUI with a warrant from a judge.

nojito 6y ago
The only way they can do that is with a warrant and if you own the website.

supernova87a 6y ago

So for the non-developer, is this basically as if any participating website could send an 2FA request to your iPhone (like the role of the SMS code but more secure), have the iPhone verify you by face/touch, and then confirm back to the website and let you in? (also like Google does with their app?). Or even take the place of a password?

tialaramex 6y ago
Done the way Apple describes it this (optionally) replaces the entire login sequence. Username, password, second factor, all replaced by tapping one button. When you register for this feature, your Apple device gives the site an ID (a really huge random-looking number) and a public key. The site associates this ID and key with your user. On subsequent visits you do something (e.g. press "Face Sign In" button on the site) and then your device authenticates you (with Face ID/ Touch ID) and if you pass it sends the same ID, and some signed stuff about this authentication. The site matches the ID, finds your user, checks the signed stuff is OK with the public key is stored before, and you're in - no other steps and very secure. WebAuthn can do simpler journeys that only replace the second factor or as a single factor but with the user still needing to provide their username first, but Apple is pushing developers to have this lovely journey that suits the Face ID/ Touch ID experience on an Apple product.

ixtli 6y ago

Anonymous attestation is really interesting because, afaict, there really isn't a way to do this right now if my application wants to authenticate a "normal" user with a "normal" phone.

StavrosK 6y ago

If anyone wants to deploy this server-side, I made a Django library that's very easy to use: https://gitlab.com/stavros/django-webauthin https://gitlab.com/stavros/django-webauthin You can see a demo login here: https://www.pastery.net/ https://www.pastery.net/ It allows the user to log in without a username or a password (untested on any Apple device as I don't have any, please file bugs if it doesn't work).

zhoujianfu 6y ago
Hmm, on an iPhone it asked me to hold my authentication device near the top of the phone, it didn’t use faceid at all... :/
- aeontech 6y ago
  Are you on the new OS seed build?
  - kalleboo 6y ago
    I get the same thing, and I'm on the iOS 14 beta
jedisct1 6y ago
Doesn't work (yes, on iOS 14).

gorgoiler 6y ago

Isn’t this a classic example of the fragility of biometrics? If I move to a new device, iOS should be required to give up whatever secret key my face translates to, so I can log into websites. Simplistically, if iOS silently turned my face into the web password “g0rG0il3r”, when I eventually migrate from iOS to something new, I’ll have to be able take my face password with me, thus exposing that my face was only ever equivalent to a password in the first place?

snuxoll 6y ago
WebAuthN is not supposed to be the only way you log into a service. The credentials are permanently tied to your Authenticator of choice, which can be lost or stolen at any time. If you change devices you just provision the new one for your account after signing in with a traditional username/password(/2nd-factor).
- GoMonad 6y ago
  FIDO/WebAuthn has been designed to be first factor authentication (passwordless) as well as 2FA. Though, I agree lost and stolen devices are a problem whose solution space needs more exploring than simply multiple auth devices.
  - bfulgham 6y ago
    This is, of course, an active thread of discussion in the WebAuthentication working group.
    - GoMonad 6y ago
      Can you point me to that discussion? I'd love to read more about it.

aarongray 6y ago

A fingerprint can be a personal password or it can be a government ID, but it can’t be both. Since the U.S. government already has something like 200 million fingerprints on file, and many foreign governments collect fingerprints whenever you travel, these fingerprints are sometimes leaked en masse (https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach#Theft_of_fingerprints https://en.wikipedia.org/wiki/Office_of_Personnel_Management...), and because they can never be changed, biometrics aren't my personal choice for a secure method of authentication.

hn_throwaway_99 6y ago
But I think you missed the point about the second factor, because there are really 2 factors here: 1. Something you have (e.g. your phone, in this case the Secure Enclave that stores the private key). 2. Something you 'know', e.g. your fingerprint. Just having the fingerprint itself is not sufficient.
- the_svd_doctor 6y ago
  This is key. I just hope this never changes and we never end up in a situation where the fingerprint is all that is used. Because for most non technical user, my bank app asking my fingerprint to unlock the app is exactly that. They don't really get the difference.
- aarongray 6y ago
  That's a good point that it is more nuanced. The issue I think is that organized crime and unscrupulous governments are getting better at connecting these things so they are not as cleanly separated as they have been in the past. Just look at China. Essentially spyware and viruses are installed at checkpoints on people's phones and biometric tracking is becoming very commonplace. I don't think it will be long before organized crime begins to get better at this too. As such, being able to change that "something you know" is a very powerful countermeasure.
someguyorother 6y ago
In addition, fingerprints and faces are particularly bad biometrics for keeping secrets, because attackers can get hold of them without you noticing. E.g. anyone can take a picture of you in a crowd, or lift your fingerprints if they can get to somewhere you've been. But they can't do a surreptitious retinal scan on you.

GekkePrutser 6y ago

Great to see Apple is focusing on Webauthn this time instead of rolling something themselves that only works inside their walled garden. Android is doing the same thing: Android phones are now also capable of being a FIDO2 authenticator for Webauthn. Now what we need is many more sites actually offering it :) I'm already using it for Office 365 but that's really the only one so far that I use that offers it.

exabrial 6y ago

Face Id is a terrible idea in the age of westerners wearing masks or south Asian countries

EGreg 6y ago

Can a person have more than one account? Does google have a similar thing? Because overnight we can finally stop sybil attacks! Right?

coronadisaster 6y ago

Face or finger data is akin a login name... What is the password in that case? Because if you cant change your password, that could be a problem

Ayesh 6y ago
Face/finger data is never revealed to the web sites. You can read webauthn for more information.
EtienneK 6y ago
The biometric data never leaves your device. Your biometric is only used to unlock a private key stored in the secure enclave of your phone. This private key is then used to sign a server-sent challenge. The phone sends this signed challenge back to the server, where the server can validate it using the public key. The public/private key gets generated by the phone upon first registration with the server.
- coronadisaster 6y ago
  So if someone has your phone and your face, not only can they unlock your phone but also the services that you are using?

tonyhb 6y ago

Called it, but it took longer than expected: https://news.ycombinator.com/item?id=18141918 https://news.ycombinator.com/item?id=18141918 The Safari team do move slowly.

hubert1234 6y ago

Sometimes it feels like I'm the only one that doesn't trust biometric sensors. I mean it's basically magic. If for any reason the face detection algorithm doesnt match your face anymore you have the equivalent problem of losing the master password to your entire password store.

Cogito 6y ago
It's a little different, I think. You could have it set up where your face is the one-and-only thing that identifies you, but that doesn't seem to be the case in practice. Instead, we have the multipart authentication used in many places today: something you know (password), something you are (biometric fingerprint/face), and something you have (your physical device, your email account, your phone number). Any one of these has downsides (stolen password, biometric misidentification or duplication, redirected phone number) but in combination with the others makes it much harder to circumvent authentication. Almost all systems have some kind of fallback that rely on a 'something you know' like a master password, and can optionally only be changed if you have other authentication methods (like physically having the device in your hands). Having multipart authentication allows for a better user experience (look at your phone and it unlocks) with an acceptable amount of risk (you have to have your phone and be you in order to unlock it), with systems to fallback to if something fails (get the super secret password off that slip of paper you hid in your mother-in-laws garden shed behind the loose brick in the wall). The typcial authentication flows are both more secure and more convenient, and the user is responsible for the security of the backup.
neuronic 6y ago
Forgive my ignorance: isn't this solved by fallbacks, at least on the iPhone/MacBook itself (don't know about webauthn)? If my finger is rejected multiple times, I am asked for the password instead.

buoyantair 6y ago

I wonder how these face detection algorithms work for transgender folks...

robertoandred 6y ago
Have transgender people had issues with FaceID?
fiblye 6y ago
Unless they're getting extensive facial surgery, their phones will acknowledge them.

erickhill 6y ago

Unfortunately Face ID has become much less useful since many of us began using face masks. I wish I had touch ID back on my iPhone.

gmantg 6y ago

There's surprising support here for the faceid stuff, despite it's clearly made to normalize using biometric data for everything and make one step towards the survelliance state. But let's pretend we are more concerned with security of this approach: how is it better than a ring with a chip you'd wear and use for auth? If this identity is compromised, you could just get another ring. And you wouldn't need to give your real identity to apple.

threentaway 6y ago
All biometric processing happens locally. You aren't sending your fingerprint or face, they simply unlock the private key in the enclave.
- gmantg 6y ago
  Sure, at this point Apple's solution likely works this way: they care about their reputation. But even a secure faceid opens the Pandora box: today it's just iPhone users, 5 years later it's everywhere, including in solutions from Huawei and 10 years later it's the law. Afaik, Delta airlines already trying to use faceid. And once faceid is required to buy gas and groceries, your complete and nuanced dossier will be available for sale on all these data exchange brokerages. In this beautiful future, faceid is needed to unlock any car and it would play you ads for 3 mins while it's starting.
planb 6y ago
> How is it better than a ring with a chip you'd wear and use for auth? Normal people would actually use it. And this is in fact not different. The phone IS the ring. You just unlock it using your biometrics (and of course, the data is NOT given to Apple)

sytelus 6y ago

FaceID is one of the most important technology invented. Imagine if Apple somehow was open to license it and make it universal like Bill Gates wanted to make PCs universal. It can make driver licenses, passports, credit cards, student IDs, insurance IDs - all of these can be things of past. You go to grocery store and simply pay using your face. You want to pay online? Simply look at FaceID device that is now standard with all new computers sold. This is 100s of billions worth of business to make so much legacy gone. Security and identity is now (hopefully) solved but unfortunately still all behind walled garden.

jsf01 6y ago
Why did fingerprinting never catch on in that way? That tech has existed for ages. Way cheaper to implement as well. Seems like it would also be less prone to false positives compared to facial recognition, but that’s just speculation on my part.
- teruakohatu 6y ago
  Fingerprints are left everywhere and even photographed from a distance. It is harder to 3D scan a face then recreate it in such a way as to fool Face ID although I am sure it is possible.
- searchableguy 6y ago
  Touch ID has been hacked multiple times. It's not reliable. 0] The probability that a random person in the population could look at your iPhone or iPad Pro and unlock it using Face ID is approximately 1 in 1,000,000 with a single enrolled appearance. As an additional protection, Face ID allows only five unsuccessful match attempts before a passcode is required. The statistical probability is different for twins and siblings that look like you and among children under the age of 13, because their distinct facial features may not have fully developed. If you're concerned about this, we recommend using a passcode to authenticate. For comparison, touch ID has a probability of 1 in 50,000. 0] https://support.apple.com/en-in/HT208108 https://support.apple.com/en-in/HT208108
teddyh 6y ago