4 ms·
We’d need to have a standard HTML element like <facial-rec> or something and let the browser handle mapping it to whatever specific hardware the device is using
by cgb223 6y ago
We’d need to have a standard HTML element like <facial-rec> or something and let the browser handle mapping it to whatever specific hardware the device is using
- rovr138 6y agoThe issue is that it's just a token that would simply say Passed/Fail. So it's trusting the client/browser.
- duskwuff 6y agoIt's more than that -- from what I'm seeing, it looks like it's a cryptographic token, presumably signed by a certificate that's embedded somewhere inaccessible in the device (probably in the secure element).
- crispyporkbites 6y agoIf the token is signed you could validate it with Apple (or the vendor that implemented the face recognition on the device, eg Samsung, Nokia, pinephone etc). You just need an open standard, you could even embed the url of the validating api in the token, so anyone could create their own Face ID provider.
- bfulgham 6y agoThat's precisely what the attestation section of the talk describes. This is all part of the WebAuthentication standard.