3 ms·

So for the non-developer, is this basically as if any participating website could send an 2FA request to your iPhone (like the role of the SMS code but more sec

So for the non-developer, is this basically as if any participating website could send an 2FA request to your iPhone (like the role of the SMS code but more secure), have the iPhone verify you by face/touch, and then confirm back to the website and let you in? (also like Google does with their app?). Or even take the place of a password?

tialaramex 6y ago
Done the way Apple describes it this (optionally) replaces the entire login sequence. Username, password, second factor, all replaced by tapping one button. When you register for this feature, your Apple device gives the site an ID (a really huge random-looking number) and a public key. The site associates this ID and key with your user. On subsequent visits you do something (e.g. press "Face Sign In" button on the site) and then your device authenticates you (with Face ID/ Touch ID) and if you pass it sends the same ID, and some signed stuff about this authentication. The site matches the ID, finds your user, checks the signed stuff is OK with the public key is stored before, and you're in - no other steps and very secure. WebAuthn can do simpler journeys that only replace the second factor or as a single factor but with the user still needing to provide their username first, but Apple is pushing developers to have this lovely journey that suits the Face ID/ Touch ID experience on an Apple product.