4 ms·
Giving my finger and face prints to the browser, the software with the biggest attack surface in the world, connected to internet no less, feels off to me.
by BiteCode_dev 6y ago
Giving my finger and face prints to the browser, the software with the biggest attack surface in the world, connected to internet no less, feels off to me.
- lemoncucumber 6y agoNative apps have long been able to use TouchID/FaceID and have never been able to access the actual finger/face print data. There's no way that iOS exposes your actual finger or face print to websites.
- brandonhorst 6y agoAll of that is managed by the Secure Enclave in exactly the same way that it is for all over auth on Apple devices. The browser doesn't touch it at all.
- thowawaymom 6y agoOh the almighty Secure Enclave, bow down to the Enclave... Do you even know what the heck an enclave is and how does it work? It's nuts that when a figure of authority uses a fancy shiny new word to describe some magic black box and the masses follow with no questions asked.
- nicky0 6y agoThe concept has been around for years now, it is well understood.
- orf 6y agoDo you know how it works?
- thowawaymom 6y agoThat's the point, not many do
- sosborn 6y agoThis might help: https://www.blackhat.com/docs/us-16/materials/us-16-Mandt-Demystifying-The-Secure-Enclave-Processor.pdf https://www.blackhat.com/docs/us-16/materials/us-16-Mandt-De...
- buzzerbetrayed 6y agoK, but that doesn't mean the person you responded to doesn't know how it works. You are the one that doesn't know how it works, so why are you expecting people to listen to your opinion about the Secure Enclave?
- ThePowerOfFuet 6y agoPDF page 8: https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/apple-platform-security-guide.pdf https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/app...
- pgoggijr 6y agopretty straightforward to understand: https://support.apple.com/guide/security/secure-enclave-overview-sec59b0b31ff/web https://support.apple.com/guide/security/secure-enclave-over...
- KMnO4 6y agoThey're not giving your fingerprint or face image to the browser. They're simply providing the ability to authenticate using iOS hardware.
- anon102010 6y agoThat's not how this works on apple. Basically your fingerprint scan is not sent to the browser, just the authenticated result of the scan (ie, yes, the fingerprint was so and so's). There have been some past complaints here about how Apple used to tie their fingerprint sensor into the secure element (third party folks couldn't substitute them). I actually liked that rule from a security standpoint, but obviously unpopular here. Same approach with faceid / touchID for the web.
- ThePowerOfFuet 6y agoYou're not giving them to the browser! https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/apple-platform-security-guide.pdf https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/app...