4 ms·
Going to have to give serious thought to where I will and won't use this. There are a lot of implications - no ability to automate and giving others data on yo
by _jal 6y ago
Going to have to give serious thought to where I will and won't use this.
There are a lot of implications - no ability to automate and giving others data on you were provably in front of some machine are two big ones.
- duskwuff 6y agoThat's a really interesting point. If this really does allow a web user to prove that a human interacted with the computer, it'd make for a really nice CAPTCHA replacement.
- jiveturkey 6y agoit doesn't do that, since there's no attestation.
- Tepix 6y agoDid you watch the video?
- jiveturkey 6y agowhere he says it is "not included"? (because the Apple secure enclave does not attest keys.) also where he falsely alludes to other attestations being identifying? sure, they can be, but they generally aren't.
- bfulgham 6y agoYes there is. The video covers this clearly.
- thephyber 6y agoFrom the server side, isn't this just a WebAuth integration? How does the server know for sure if the client is on an iOS Safari browser on an iPhone with FaceID or a custom browser on any OS and any non-locked-down hardware being run with Selenium?
- blintz 6y agoAttestation. If a website requests it, the device will provide cryptographic proof that you used a specific vendor’s device to store the resident credential. The proof is a certificate signed with a vendor’s secret attestation key.
- jacobr1 6y agoThe question is more along the lines of: does this provide more security than passwords for real users? Stealing a password is probably more easily done than stealing a private key that is never transmitted. The primary threat model is protecting the credentials of real users rather than protecting against fraudulent users (though some considerations have been made for that too).
- thephyber 6y agoWhile what you say is true, it doesn't seem relevant to this thread.
- 0xCMP 6y agoIt won't be the only sign in method unless the point is to only allow _that specific device_ to connect.