7 ms·
So roughly speaking this is WebAuthn for a web site, with the iphone acting as the dongle. It's a really good idea. I can see there being a big demand for jus
by lifeisstillgood 6y ago
So roughly speaking this is WebAuthn for a web site, with the iphone acting as the dongle.
It's a really good idea. I can see there being a big demand for just simplifying signin - I can easily see a time where it is worth not having the hassle of managing multiple signin processes and just choosing webauth or nothing.
Edit: to be clear this won't affect B2C sites whose monetisation is based on getting as many people as possible. But imagine a saas business charging upwards of 100 bucks a month - they have something valuable to protect, and the security story just got a lot easier
- monocasa 6y agoWebauthn actually fully supports this model as "platform authenticators", ie hardware security modules built into the client system. You see this on the windows side too where "Windows Hello" integrates with the TPM and acts as a platform authenticator as well. No need to speak roughly.
- tialaramex 6y agoYup. A site can even say "I want a platform authenticator" or "I specifically don't want a platform authenticator" during registration using the Javascript API. Most sites should just not care, but it's an option if you've determined there's a specific reason it matters in your application.
- DaiPlusPlus 6y ago> A site can even say "I want a platform authenticator" or "I specifically don't want a platform authenticator" during registration using the Javascript API. Websites should not depend on JavaScript for something that should be able to be done declaratively. (Amongst other things - we shouldn't need to use `fetch`/`XMLHttpRequest` when a <form> would work just-as-well - but if only <form> let us use more than just GET and POST, and supported more types of serialization, and supported asynchronous form submission - and bring back <keygen>!).
- judge2020 6y ago* you don't need the TPM for Windows Hello to act as your security key. I can't enable BitLocker because there's no TPM yet I have Hello enrolled as a key for GH.
- sroussey 6y agoI’m not sure if that makes me happy or sad to hear..
- threentaway 6y agoYou can use BitLocker with just a password, not sure why you're implying you need a TPM.
- monocasa 6y agohttps://www.howtogeek.com/237232/what-is-a-tpm-and-why-does-windows-need-one-for-disk-encryption/ https://www.howtogeek.com/237232/what-is-a-tpm-and-why-does-... And yes, there is a way to use it without a TPM technically, but it's not accessible by the computer's management GUIs, and you need to create custom GPOs and apply them.
- EE84M3i 6y agoIs this how passwords.google.com prompts me with my Android phone lock when I want to access a password in plaintext? I've always wondered that.
- monocasa 6y agoI think that's a custom pathway but built on the same primitives. That being said, I'm not 100% on that.
- masklinn 6y agoIs it webauthn or is it once again proprietary tech?
- mc32 6y agoDoes this mean integration with SaaS IDPs?
- threentaway 6y agoIf they support WebAuthn it should.
- BillinghamJ 6y agoIt'd be really nice to see this working with iCloud Keychain at some point too - so you can have FIDO working as a secure platform thing but with syncing and dealing with the problem of effectively losing your keys over time etc
- lstamour 6y agoWebAuthn is generally about device authentication with credentials that can’t leave the device, though that could change depending on where and how the hardware gets/stores it’s tokens. Or if you rely on a third-party, like Apple, to store the tokens for you and use OAuth with an mfa indicator in the attestation? General advice: If worried about losing a device, try to register more than one. Even iCloud Keychain requires other hardware for authentication... same problem applies. Only way out is having a backup like taking ID to an Apple Store as a way to regain access... that varies right now by provider, but who knows. Maybe Login with Apple will go WebAuthn-compatible in future? (Haven’t watched this video yet.) If you’re an enterprise and worried about key authenticity or varying WebAuthN standards, you can look for specific types of keys or even request specific serial numbers of FIDO2 dongles from the web browser, etc.
- BillinghamJ 6y agoNot really a problem for me - I keep a set of six CTAP2 keys registered on everything with careful labelling etc. But for normal people, we do need to get more of the balance into the usability side I think. The thing with iCloud Keychain is it can comfortably be recovered without breaking the end-to-end encryption with only a single remaining device, and many Apple users have as many as 3-4 devices in the circle of trust It seems ideally some kind of "roaming platform" additional option would be good in the webauthn standard
- lstamour 6y agoI agree, but it sounds like we’re trying to get the web browser to simplify and implement OAuth2 and OpenID Connect via WebAuthn ... If we already have OpenID Connect, the only advantage to end users under that scenario is a login-with-Apple ease-of-use improvement. Seems more likely that we’ll continue using OAuth2 and OIDC server side for this, for now... but maybe we’ll end up standardizing the ways MFA is requested and presented by providers...
- philsnow 6y agoios/macos already let you copy/paste between them if you have bluetooth enabled on both sides and are signed in the same icloud account on both. I wonder if they're planning to let me authenticate/webauthn on macos using my phone as a platform authenticator?
- pram 6y agoThe magical cross device copy and paste is one of my favorite unsung features.
- macintux 6y agoUnfortunately it’s been a little finicky for me, but when it works, it’s a great tool.
- navanchauhan 6y agoIt works 100% of the time when I have both WiFi and Bluetooth on, when do you face problems?
- jammmety 6y agoIt doesn't work if both devices are connected to different WiFi networks. But Airdrop works without being connected to any AP…
- navanchauhan 6y agoYes, either you are both connected to the same WiFi network or both of you are not, kind of weird
- dwaite 6y agoPossibly - there is functionality to expose an authenticator over bluetooth or NFC, both of which would work for an iPhone or watch to act for an authenticator even into a windows laptop. There are UX issues there that have to be solved yet. Also, while I haven't gotten my hands deep in what Apple has done yet I suspect this is a browser-level feature and not a platform-level feature, where say your phone would pop up a "do you want to authenticate" screen when held near another computer with BLE the same way you get "do you want to use Apple Pay" today. Platform level support would allow me to use this directly within other applications and browsers, rather than just from Safari and the SFSafariViewController/ASWebAuthenticationSession Safari-managed views.
- the_gipsy 6y agoFYI, fingerprint for WebAuthn already worked on Android, I tried it with my pixel phone.
- dillondoyle 6y agoI can't find docs - but I assume one can authenticate with only their laptop. Most new ones have fingerprint already and likely they will bring FaceID to mac os soon
- searchableguy 6y agoCan someone explain how does it work behind the scenes? As I see it, data is stored in a secure enclave separate from the processor and OS. It only provides a match value based on the generated digital private key. So phones will create a separate pair for every site and send the public key with credentials so the server can verify it with the device. Wouldn't apple have to open source their hardware as well?
- lode 6y agoThis uses WebAuthn (https://webauthn.guide https://webauthn.guide - https://webauthn.io https://webauthn.io). The video has a great description starting at 1:40. Here, the iPhone functions as a platform authenticator, like a U2F usb/nfc key would. Why would they need to open source their hardware for this?
- searchableguy 6y agoI was talking about face ID and how apple handles the data using secure enclave.