3 ms·

From the server side, isn't this just a WebAuth integration? How does the server know for sure if the client is on an iOS Safari browser on an iPhone with Face

• blintz 6y ago
  Attestation. If a website requests it, the device will provide cryptographic proof that you used a specific vendor’s device to store the resident credential. The proof is a certificate signed with a vendor’s secret attestation key.
  • Siira 6y ago
    Can't the key get stolen if it's on the client?
    • amluto 6y ago
      Yes, but it’s probably stored in the Secure Enclave, so it’ll be hard work.
      • bfulgham 6y ago
        Correct. The key material is stored in the Secure Enclave.
  • deleted 6y ago
    [deleted]
• jacobr1 6y ago
  The question is more along the lines of: does this provide more security than passwords for real users? Stealing a password is probably more easily done than stealing a private key that is never transmitted. The primary threat model is protecting the credentials of real users rather than protecting against fraudulent users (though some considerations have been made for that too).
  • thephyber 6y ago
    While what you say is true, it doesn't seem relevant to this thread.