24 ms·

Face ID and Touch ID for the Web

757 points by Austin_Conlon 6y ago

obilgic 6y ago
What will Chrome do?
- oarsinsync 6y ago
  Probably the same as what they did with Apple Pay, and (re)launch a comparable function with Android?
- lern_too_spel 6y ago
  Other platforms have supported this for a long time. https://www.zdnet.com/google-amp/article/windows-10-says-hello-to-no-passwords-with-fido2-certification/ https://www.zdnet.com/google-amp/article/windows-10-says-hel...
- rektide 6y ago
  > What will Chrome do? Develop & give away a verifiable, open-source hardware & software solution for a silicon root of trust, with a focus on security through transparency[1]. Google will organize & make available the world's information on how to secure systems well. Yes, this is intended for, among other uses, implementation of a FIDO2 universal 2-factor security key[2]. [1] https://opentitan.org/ https://opentitan.org/ [2] https://github.com/lowRISC/opentitan/pull/1125/files#diff-6d73b518ad3908ac84c5aaed0ec365a548019f6f6d77165e2b878fa3daed0d59R123 https://github.com/lowRISC/opentitan/pull/1125/files#diff-6d...
- timdorr 6y ago
  This is a part of the Credentials Management API / WebAuthn API: https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent... They already support this for things like FIDO hardware keys and other biometric hardware. It's also supported by Firefox.
varbhat 6y ago
Is this only implemented in Apple devices Or is it cross platform ?
- hprotagonist 6y ago
  as far as i know both faceID and touchID require Secure Enclave, so that would be apple only.
  - pbreit 6y ago
    I think Mac Chrome can support Touch ID: https://www.iphoneincanada.ca/news/google-chrome-for-mac-fingerprint-support-2/ https://www.iphoneincanada.ca/news/google-chrome-for-mac-fin...
    - filoleg 6y ago
      Yep, it can. I don't know what logic it uses to request touchID vs. keychain password (because i occasionally see both), but, nonetheless, I definitely had Chrome TouchID pop-up quite a few times when I tried to autofill my credit card info.
- Nullabillity 6y ago
  Looks like it's "just" another authn method for using the phone itself (or more precisely, the "secure element") as a WebAuthn/FIDO2 dongle. So the specific UX is Apple-specific (although it could of course be replicated by others), but the API is generic (and already exists).
- eldridgea 6y ago
  This appears to be Apple's implementation of WebAuthn which is a standard specification. So while this page is about the specifics of this in Safari, the WebAuthn spec in general is widely implemented. If your device has a TPM/secure enclave/etc (most modern devices do) then it works already in Chrome/FF/Safari/Edge on desktop and Chrome on Android and Safari on iOS. If you want to see it in action you can try out a demo at https://webauthn.io https://webauthn.io
- 6y ago
mariomariomario 6y ago
I'm curious about "Apple Anonymous Attestation". Is Apple taking on any liability by providing this service or is this all done on hardware through private APIs?
- ArchOversight 6y ago
  It is only for Apple Devices, and all it does is allow them to easily disable attestation and thus (is this device used for auth secure) for a singular TouchID/FaceID. Instead of with Yubikey where if the attestation key is compromised, and it is blacklisted, they disable every single last device manufactured with said attestation key.
  - jiveturkey 6y ago
    > easily disable attestation all future attestations. U2F/webauthn doesn't actually provide a revocation mechanism. > Instead of with Yubikey where if the attestation key is compromised, and it is blacklisted, they disable every single last device manufactured with said attestation key. it is important to note that there is not a "the" attestation key. there are many. "disabling" one, to the extent that is even possible, disables only the group with that key.
- fuzzy2 6y ago
  Attestation is just a technical term in the WebAuthn API. Different authenticators can use different attestation data formats. Apple rolled their own, hence the name.
  - ArchOversight 6y ago
    Apple didn't just roll their own though, they improved upon it by allowing them to easily revoke attestation for a particular implementation without affecting all other devices out there. So if an attacker tampers with the physical device, they can revoke the key for that particular device so that it is no longer trusted (the way I am reading it) vs yubikey where if an attacker has messed with one key, there is no good way to revoke attestation for that one device.
6d6b73 6y ago
No. Thank you very much.
- deleted 6y ago
  [deleted]
- mttjj 6y ago
  Care to elaborate?
_jal 6y ago
I predict logs of Face ID attestations will feature in divorce lawsuits within a year of them becoming commonplace.
- charlescarver 6y ago
  Why?
  - overcast 6y ago
    Dating sites?
  - olliej 6y ago
    presumably because they think faceid has a picture of peoples faces.
blintz 6y ago
So happy Apple decided to go with an open standard here rather than something proprietary. This is good news for the FIDO2 ecosystem and I hope this leads to far greater support for FIDO2 authenticators of all types. There is another world in which Apple just pushed 'Sign in with Apple' and created yet another federated identity provider rather than true, 'secure element'-based FIDO2 authentication.
- rektide 6y ago
  I dunno. I mean, I do, it feels good. But it also is a very different kind of FIDO2 than what we've seen before. In a way that FIDO was designed for, that we hoped would happen. But it's still not entirely joy & mirth that we're here for me. It feels like a little like the first day we start to understand how "Big Tent" (in the OpenStack sense) FIDO2 ecosystem is. You can do whatever, make anything, and call it FIDO2; it's all duck typing: looks like a duck, quacks must be a duck. No implementation details are required, no transparency is needed, everything can be totally vendored way way up, and the standard will welcome you. Your platform is welcome here. This post is about how to use & prefer that platform, over the more common means available. For sure this is overwhelmingly a good thing. It's by design that we allow platform authenticators in WebAuthn. Apple is allowing their closed, proprietary security technologies to seamlessly work on the web without making webdevs jump through hoops. It's a good thing, and this will really help Web Authentication for sure. Still I have some wistfulness. It's a good user experience, it's great. It's a win for devs, it's a win for users. Still there's some larger context I can't quite put my finger on, when I see "authenticatorSelection: { authenticatorAttachment: "platform" }". The web is letting more of the native platform shine through, and that's good, but it also forgoes some of the knowability & commonality that resounds on so much of the rest of the web, and while the immediate impact is extremely good, I still think there's some kind of hard to describe ultra-slow-motion civilization-scale loss that's also passenger to this successful commingling of web and platform.
  - StavrosK 6y ago
    So what exactly is the concrete downside here, apart from the icky word "platform", that, in this context, means "a security chip that's not removable", ie as opposed to a Yubikey or such.
mkl95 6y ago
How secure is this?
- young_unixer 6y ago
  The s in "face ID" stands for security.
  - mkl95 6y ago
    I may use this when I find a cheap surgeon in case the "mathematical representation of my face" is leaked.
fullstop 6y ago
If I can use FIDO2 on my yubikeys in more places, it would be fantastic.
- 0xCMP 6y ago
  You can already use NFC and Lightning yubikeys on your iPhone. On iPad Pro there are issues using USB-C still in my experience. Being able to use FaceID on there now will be nice.
  - dwaite 6y ago
    There are three methods on iPhone: 1. NFC 2. USB - this is actually how it works with the lightning connector on iPhone in Safari - the Yubico model with a lightning port is working as a lightning to USB adapter in this case. 3. MFI (Made for iPhone) - some third party browsers can use the external accessory framework to talk to the Yubico model over the lightning port. Safari does not support this, but luckily can just use these keys as USB keys. I believe there is a hardware limitation that the MFI protocol only works over the lightning port and not the USB-C port, so they work for third party browsers on iPhone and not iPad Pro or the new iPad Air.
  - fullstop 6y ago
    Right, I am hoping that this leads to more websites utilizing FIDO2. Kind of like how Android Pay was around for many years but didn't actually take off until Apple Pay made it happen.
paul7986 6y ago
It's not supported by mobile or desktop Safari?
- olliej 6y ago
  It looks like it's a feature of the next release? Maybe the developer versions already have it?
mywittyname 6y ago
How does this work on laptop/desktop computers?
- ArchOversight 6y ago
  Like the laptops that Apple has built with TouchID built-in?
- olliej 6y ago
  Most (all?) new apple laptops have touchid, but I agree this seems most useful on iPhone/Pad which kind of makes sense as the majority of 2fa keys (yubi, etc) still plug in. That would surely be more awkward than using the already built in SEP and authentication system.
khana 6y ago
now everbody knows your face
jjcm 6y ago
These all seem to be examples that use faceID/touchID as a password. That’s not what biometrics should be though, they should be the username. I hope that this is supported as a flow as well. Identify who you are with biometrics, and prove your access with a correlated password.
- arnarbi 6y ago
  First, the model in FIDO is that it's the piece of hardware (in this case, your laptop or iOS device) that is your authentication factor. The biometric is a local facility for unlocking that device and approving that specific action. Second, the primary threat identity providers (and their users) deal with are remote, impersonal hijacking of accounts, where the password is either guessed (because it existed in a leak) or the user was phished. That's the primary value of something like this. Attacks where someone can lift your fingerprints or has your device are real but much much less common.
- dlivingston 6y ago
  Maybe (probably) I’m just ignorant of the actual state of the industry, but it seems to me that biometrics have always been about providing full user authentication. I’m not personally aware of any instance where an alphanumeric password is still required as a secondary authenticator to biometrics.
  - DaiPlusPlus 6y ago
    > I’m not personally aware of any instance where an alphanumeric password is still required as a secondary authenticator to biometrics. It's straightforward to configure Active Directory / Group Policy to require biometric and password factors for interactive authentication. The main reason not to allow _only_ biometrics is to disincentivize chopping fingers off (well, it's more because [it's still surprisingly easy to fool biometric systems](https://www.theguardian.com/technology/2014/dec/30/hacker-fakes-german-ministers-fingerprints-using-photos-of-her-hands https://www.theguardian.com/technology/2014/dec/30/hacker-fa...)).
    - 6y ago
judge2020 6y ago
Neither sync nor keychain is mentioned in this post or in the WWDC presentation, so I'd like to ask if the credentials are synced between devices whatsoever, or if they're transferrable. While it'd be more secure to run it through a device's T2, a syncing/keychain-backed key would save a lot of the re-enrollment hassle for users who end up transferring their data to a new phone or need to enroll each of their devices for all of the web services they use.
- dwaite 6y ago
  They are no synchronized between devices. This is generally considered to be a no-no with FIDO (although Apple has not publicly announced whether they intend to be FIDO certified)
  - toomuchtodo 6y ago
    Apple is part of the FIDO alliance, I would assume they intend to be FIDO certified.
- 0xCMP 6y ago
  For simplified login situations (e.g. not requiring two factors for authentication) you'll probably have some kind of password or password-less (email) login flow where you can login at first and then enroll the FIDO2 device. Otherwise there is no way to login from any other device. An alternative is that you can authenticate a new device from an existing device along with a re-auth on that device to verify it's them. Discord has a feature similar to this with it's QR login system.
mortenjorck 6y ago
The UI probably needs to be more explicit about what's going on. I would imagine most non-technical users aren't well-versed in how Apple's Secure Enclave (or other competing solutions) manage authentication, and so I wouldn't be surprised if "allow example.com to use TouchID" would give many the impression that the website is asking to access their biometric data. Ideally, the prompt should reflect the actual model, though I'm not sure how one might pose that in an accessible and succinct way.
- easton 6y ago
  They could just have it say "example.com wants to use Touch ID to sign-in. Biometric data is not shared." with a help link that goes on to explain in laymens terms how your iPhone basically sends a password-ish thing to the website after you use Touch ID (similar to how Apple Pay sends a one-time use credit card number to a merchant).
  - asdff 6y ago
    Apple's UI designers would never tolerate such a helpful and wordy dialog box.
    - can16358p 6y ago
      I don't understand why they even ask it as a popup. I mean, you already get "touch to login" kind of text next to Touch ID on Touch Bar, if you don't want to login that way, simply don't touch it. Am I missing something extra about the purpose of this popup?
      - kevincox 6y ago
        Because who is looking at their touch bar constantly just in case a site is trying to login? It seems to me that every time it is active a dialog pops up. Especially when I am using an external monitor there is no way I would notice just that.
    - wpm 6y ago
dochtman 6y ago
Hope this will finally put some pressure on Mozilla to build TouchID support: https://bugzilla.mozilla.org/show_bug.cgi?id=1536482 https://bugzilla.mozilla.org/show_bug.cgi?id=1536482
- outworlder 6y ago
  Provided there's still someone still working there that's capable of implementing it.
ezekg 6y ago
Has anybody ever thought about how Face ID is pretty much a backdoor into your iPhone? Think back a few years to when Apple refused to open a felon's iPhone for the US government, because "they couldn't." If that happened now, they wouldn't even have to ask Apple, given the felon has Face ID enabled. Edit: I'm kind of surprised by the downvotes, given I thought HN was pretty big on personal privacy. Just thought I'd stir up the discussion, that's all. Edit 2: I personally think U2F is the way forward here, not Face ID or Touch ID or other biometrics.
- dawnerd 6y ago
  There's limitations. iOS requires a passcode after so long and after so many bad attempts or after a reboot. The time law enforcement would have to use your face to get in is pretty short.
- dwighttk 6y ago
  possibly, but they have to be quick about it: >To use Face ID, you must set up a passcode on your device. >You must enter your passcode for additional security validation when: >The device has just been turned on or restarted. >The device hasn’t been unlocked for more than 48 hours. >The passcode hasn’t been used to unlock the device in the last six and a half days and Face ID hasn't unlocked the device in the last 4 hours. >The device has received a remote lock command. >After five unsuccessful attempts to match a face. >After initiating power off/Emergency SOS by pressing and holding either volume button and the side button simultaneously for 2 seconds.
  - ezekg 6y ago
    I wasn't aware of some of these. Thanks for sharing.
- mcpherrinm 6y ago
  The risks of forced unlocking with FaceID have been discussed, including in court: https://appleinsider.com/articles/19/01/14/face-id-touch-id-unlocks-cant-be-compelled-by-law-enforcement-rules-federal-judge https://appleinsider.com/articles/19/01/14/face-id-touch-id-... The main alternative to biometric ID is a PIN. Those are seldomly changed, and are relatively easily shoulder-surfed. I've seen children who can't even read yet learn their parent's iPad PINs. If you're afraid of the police, surveillance needs to be your threat model. There's some ways to prevent being forced to use face unlock if you see it coming, by squeezing your phone: https://www.macworld.com/article/3236793/how-to-quickly-and-discreetly-disable-face-id-on-the-iphone-x.html https://www.macworld.com/article/3236793/how-to-quickly-and-...
young_unixer 6y ago
I would never use this for anything sensitive. Bad actors can get your face and your fingerprint. Some of them already have it (governments, banks, Apple, Facebook, etc). And changing your face or fingerprint is practically impossible.
- reaperducer 6y ago
  Apple has my face and fingerprint? I haven't heard this before and Google turns up nothing. Any source?
  - macintux 6y ago
    Your Apple device has a hash of your fingerprint and/or face at best. Apple itself has nothing of the sort.
  - young_unixer 6y ago
    You put your fingerprint into a black box and that black box phones home to Apple servers. From a security standpoint, we must assume that they have your fingerprint unless there's a way to prove that they don't. iOS is closed source so we can't prove that. From an epistemological point of view: I don't know if they have it. From a security point of view: they have your fingerprint.
    - mcpherrinm 6y ago
      Just because something's closed source doesn't mean we can't learn about it. The field of reverse engineering has been around for a long time, and the iPhone and Mac are two of the most studied devices around. Ultimately you do have to trust your platform if you're going to use a platform authenticator to some degree. But the alternative in the FIDO2/webauthn space is something like a Yubikey which has no biometrics; it just takes a simple tap. And can be easily removed from your computer. So in that comparison, the fingerprint is purely additive security. Even if it's adding nothing to a serious adversary, it's still dramatically reducing risk to a less-skilled local attacker.
    - 6y ago
Zaheer 6y ago
You can change a password but you can't change your fingerprint / palm / etc. Am I missing something? How is Face / Touch ID more secure that user + pass? What happens when biometric data is leaked?
- atty 6y ago
  As far as Apple devices are concerned, biometric data never leaves the Secure Enclave, so risk of data leak is non-zero, but sufficiently low for everyday life. Compare that to the massive number of people who use password123 as their password for every account across the web, and yes, biometrics are far more secure. :) More secure than a random 30 character string? Probably not. And if you’re targeted by individuals who are sufficiently motivated to steal your biometrics and the physical device, then neither the password nor the biometrics will be enough to protect you.
- wmf 6y ago
  Biometric data is never leaked because it never leaves the secure enclave in the device.
  - henryfjordan 6y ago
    Your face can easily be mimicked. Biometric data is not stored in the phone, it is stored in you. See: https://www.macrumors.com/2018/12/16/3d-printed-head-android-face-id/ https://www.macrumors.com/2018/12/16/3d-printed-head-android...
    - kryptozinc 6y ago
      > The final model took a few days to generate at the cost of just over £300. "easily"
      - 10000truths 6y ago
        £300 is chump change in most any organization's budget.
Razengan 6y ago
I was just thinking: Could we replace CAPTCHA with Touch ID/Face ID when browsing a website on Apple devices? That would be a pretty quick and painless way to verify that I am, indeed, a human, with no unpaid labor involved.
- alexmingoia 6y ago
  Potentially, yes. Authenticators can provide a public certificate, so servers can accept attestations created through whitelisted authenticators. This would mean being forced to use proprietary hardware or closed-source authenticators, because that’s the only way to control authenticator certificates.
AshleysBrain 6y ago
It's a shame they have a messy pile of API-specific hacks to propagate the "user gesture". Chrome solved this problem with a change to the spec (which they called "User activation v2" [1]). It's basically two flags and a short timeout, and it covers basically all cases. Safari's approach means you have very specific codepaths, and if you do something async outside of that, tough luck, you can't use the feature and will have to nag the user to touch the screen again. This already affects APIs like clipboard (want to copy something that takes async work to generate? tough luck), limits APIs like OffscreenCanvas (want to move your game engine to a worker? tough luck, you lose access to all user gestures), and this too. Hopefully Apple can consider aligning with Chrome on this. [1] https://www.chromestatus.com/feature/5722065667620864 https://www.chromestatus.com/feature/5722065667620864
- Razengan 6y ago
  > It's a shame they have a messy pile of API-specific hacks to propagate the "user gesture". Chrome solved this problem with a change to the spec If Safari had changed the spec that comment would probably have begun with "It's a shame they had to change the spec..." > Safari's approach means you have very specific codepaths, and if you do something async...tough luck I'm no expert on it but this sounds more secure, no? > APIs like clipboard (want to copy something On a side note, I really wish non-explicit copy/pasting/clipboard snooping would die. iOS 14 has exposed a bunch of apps that read your clipboard without any explicit paste action. It's creepy and we can only hope that it's not malicious. A bunch of big names including Discord are guilty of this.
  - kevincox 6y ago
    > If Safari had changed the spec that comment would probably have begun with "It's a shame they had to change the spec..." I don't follow. They are breaking the spec anyways. A simple timeout would be equally spec-breaking and a lot easier to understand and use. The weird async-callback-chaining doesn't actually limit any nefarious behaviour. It just requires the code author to carefully stay inside their arbitrary happy-path. A simple timeout after a user gesture is just simpler. Furthermore this is something that you can't test without buying a thousand dollar device.
dzhiurgis 6y ago
Cmon apple, just add NFC to macbooks already. Fido cards are the most obvious solution to this.
- anuila 6y ago
  I don’t know what I’m talking about, but isn’t the Secure Enclave already a solution to this? Fido cards just sound like an external solution that all iPhones and new MacBooks already have integrated (T2)
  - dzhiurgis 6y ago
    Sure works when you have only one computer in your life (aka almost nobody). It’s especially bad with Apple with 3 different usb standards. Contactless is the future.
    - BHSPitMonkey 6y ago
      What's stopping you from linking more than just one physical FIDO-enabled device to a particular site/service? Most MFA implementations I've seen already allow this, and it seems especially important if you want to minimize the pain of losing/damaging that one sacred card.
      - dzhiurgis 6y ago
        I don't carry any keys so those massive dongles would be pain. Plus must is not ALL which breaks everything.
        warkdarrior 6y ago
        Mobile phones can be FIDO enabled. (see https://developers.google.com/identity/fido/android/native-apps https://developers.google.com/identity/fido/android/native-a... )
      - sneak 6y ago
        AWS, for example, only permits one MFA device per IAM user account. I have four computers and four tokens. :/
WoefullyInept 6y ago
Why would anyone use this except apple? It's bad for users, bad for websites, but good for apple.
dividuum 6y ago
I toyed around with this on https://passwordless.dev/usernameless https://passwordless.dev/usernameless on iOS 14 and now I have two test users to choose from on the 'Do you want to sign in www.passwordless.dev" using a saved account?' prompt. I have yet to find a way to remove those test accounts again.
- xfalcox 6y ago
  Removing is covered in the article: > Credentials can only be cleared for all via Safari > History > Clear History… on Mac Safari or Settings > Safari > Clear History and Website Data on iOS & iPadOS.
  - dividuum 6y ago
    Thanks for the quick response. I thought I tried that and just made sure I did. The following did not work for me: Settings > Safari > Clear History and Website Data > Searching for "passwordless.dev" > Edit > Removing the "passwordless.dev" row. The two accounts are still there when reopening passwordless.dev and clicking on "Sign in". I'm probably missing something obvious. Edit: Oh. I guess the "for all" in the article mean that this only works if I clear the complete history for all sites? I did not try that. Edit2: Cleared all website data. The two test accounts are still there.
    - Nextgrid 6y ago
      Also confirming that clearing all history & website data does not clear it on iOS.
drexlspivey 6y ago
This comes 3 days after a leak that alleged that iPhone 13 will bring back Touch ID via in-screen fingerprinting https://www.techradar.com/uk/news/move-over-iphone-12-apples-iphone-13-may-feature-under-display-touch-id https://www.techradar.com/uk/news/move-over-iphone-12-apples...
- madeofpalk 6y ago
  Hasn't this been leaked for like the past 3 years?
  - cflewis 6y ago
    Yes, this has been a perennial rumor which is probably propagated by how much people don't like Face ID all that much. Face ID is fine when it works, and sucks when it doesn't. And mask wearing has really accelerated it being much worse, and we'll be wearing masks as a standard piece of dress for another two years I guess. I do miss Touch ID, but that had its own problems (gloves, wet fingers). So one would hope there is a solution that has both. I'd personally be just peachy with a fingerprint sensor on the back just like the Pixel line used to have. I mean, how much is a fingerprint sensor manufacturing cost? $5?
- deleted 6y ago
  [deleted]
- MobileVet 6y ago
  Please please please be true. TouchID is objectively superior to FaceId, by a long shot. It is my soap box... but TouchID RARELY failed and could be activated BEFORE you had the phone in front of you. FaceID fails constantly and MUST be in view to start the unlock process. TouchID has a single failure mode (and a half) that isn't that common. Wet / dampness. Solution, dry your finger, try again. Gloves are the 'half' mode as what can you expect, you can't access the finger. FaceID has no less than 3 FREQUENT failures and a myriad of other smaller less frequent ones. Occlusion, distance and light. Occlusion - Have your face resting on your palm... fail. Have a hat on, fail. Have a mask on... Distance is an interesting one, but for those of us with terrible eyesight, it is constant. Phone call / text at night? Put the phone up to my face to see... FaceID fail (too close). I have to move it back away so I can't read it to unlock... hoping it did unlock before I move it forward again to read it. Light - This really shows up when outdoors in the sun. The IR sensor gets washed out and can't work. It isn't that bad, but it does happen frequently enough to notice. The other thing that is SO annoying about FaceID is that is has no idea WHEN you want to use it... see a face 'I must SCAN IT!' Oh, that is someone else, now you are locked out and need your password. Pick up your phone, SCAN! Oh, that is your pocket, now you need your password. The latter can be turned off, the former, not so much. I ALMOST bought an 8 instead of a Xs when I finally upgraded, but OLED pushed me over the edge. I do love the screen, but I scorn FaceID daily and was hoping for TouchId to return to the 12. Fingers crossed for the 13, lol.
bjt2n3904 6y ago
If passwords are the original sin, then Face ID and Touch ID are Sodom and Gomorrah. Authentication is something you KNOW. Strong authentication is something you KNOW, and something you HAVE. Something you ARE is great for identification, but terrible for authentication. Something you are cannot be changed like a password.
- ericpauley 6y ago
  At least, in the case of biometric authentication on device, the ability to use biometrics expires automatically when the device is turned off (and other times), so biometric credential theft has a limited window of vulnerability. This contrasts with many fixed biometric authentication systems that aren't used as often as a cell phone.
  - bjt2n3904 6y ago
    Maybe... but if I steal your fingerprint, I have it forever. And the courts can't yet force you to reveal secrets from your mind. But you can be compelled to use your fingerprint to unlock things.
    - laurent92 6y ago
      In USA? I’m not even sure. In France there are many circumstances where you must reveal your phone password or any hard drive’s encryption key, if there is legit suspicion it has been used for general criminality (case in court with a cannabis dealer).
- ryukafalz 6y ago
  The “something you have” is the key stored in the secure enclave/yubikey/whatever. That’s the real authenticator in this scenario. That it’s (maybe) unlocked biometrically is nice, but secondary.
- robinson-wall 6y ago
  In this case Face/Touch ID represents something you have (the iOS device with a persisted credential in its secure enclave), and something you are (fingerprint/face).
mehmetkose 6y ago
PWA's will be a huge deal in near future
kinkrtyavimoodh 6y ago
I am not comfortable with Apple getting any control over the web. Thankfully, so far the web is mostly free from Apple's clutches and they can run their fiefdom only in the App universe. I shudder to think of a future where websites will have to implement some version of Apple's In-App Purchases program and give 30% of the revenue to Apple or else they won't be allowed to render on Apple devices.
oezi 6y ago
Does anyone know why Webauth does not support a message associated with the authentication? Shouldn't the user be informed in a secure way what they are authenticating for? Currently only site and user name are supported to be shown to the user. For payments (PSD2 for instance) it is a requirement to also provide information about the transaction for instance.
- EtienneK 6y ago
  Last time I checked, WebAuthN does not support UAF transaction signing yet - only via extensions and thus we don't see it in the browser implementations. Hopefully it gets added to the spec in the future.
znpy 6y ago
I've come to appreciate DigitalOcean's approach on the matter. Until you configure a 2FA device (TOPT in my case) they'll send you a temporary code to your email address. So password alone is worthless, and mailbox ownership is verified on every login. Also, I made a point never to use the "login with X" feature, no matter what X is. I always sign up with my own email.
- lilyball 6y ago
  I really hate the "we're going to send a code to your email" approach because it so often breaks. Case in point, I tried to log into Patreon earlier today, they insisted on sending a code, and it never arrived. I tried several times, no email. I have a record of every email sent to my address for the past several years regardless of spam status so I can be 100% positive they simply never sent it. In the end I had to give up. I can't log into Patreon today, because of their insistence on sending me an email even though I'm logging in from a computer I've used many times before.
  - gwillen 6y ago
    I'm curious -- do you host your own email, or use a lesser-known email provider? I am increasingly seeing failures where sites seem to be blackholing outgoing email, I suspect based on the destination domain, and unaware that they are even doing this / extremely insistent that they are not. I've gotten login-email failures like you describe from a couple of sites, and seemingly similar failures from those "email your kid this story" sharing systems on two news sites my mother uses. In all these cases, the messages simply never arrive at the destination SMTP server.
    - lilyball 6y ago
      I have a custom domain that uses Gmail as its mail provider (for legacy reasons related to the other users of this domain), and my Gmail account is configured to never mark anything as spam and to forward everything to Fastmail. This means that no matter what I do with my email, I can log into the gmail account and see every email I've received for years sitting in my inbox. I don't really recommend this setup, I'd really prefer to cut Google out of the path entirely, but I can't do that without abandoning my email address.
headmelted 6y ago
Oh cool, the new ARM MacBooks coming next month have Face ID. Sweet.
user396492 6y ago
Any bullying or power abuse situation may easily exploit biometric authentication against the victim. Kids bullying other kids, domestic abuse, authorities etc. Now, if biometric authentication becomes the norm, how will a wife suffering domestic abuse justify using a password?
- askvictor 6y ago
  I agree with you, but am not sure a password works too well in such situations either - the abuser would presumably just beat the victim until they enter their password?
  - lotsofpulp 6y ago
    Yes, I don’t see it helping in situations where the attacker has a long term relationship with victim. https://xkcd.com/538/ https://xkcd.com/538/ However, I think touchID is susceptible to being robbed since if you have your bank account or Apple Pay enabled to transfer cash with touchID as authentication, then you can be robbed while you’re passed out drunk or roofied or whatever.
    - ascagnel_ 6y ago
      One of the benefits of Face ID is that it supports an attention check, which should be harder to coerce if you’re passed out/drugged.
mrwnmonm 6y ago
Honest question, Why I feel I have to be an advanced programmer to understand all of that? I see a lot of confusion in the comments, so it is not just me. Why the article couldn't be simpler? Maybe I am just stupid, I don't know.
- syspec 6y ago
  It seems like it's really written for potential implementers already in that field. I love technical content that does not shy away from from going in depth
deleted 6y ago
[deleted]
zxcvbn4038 6y ago
Last I checked Apple only supported U2F and similar in Safari - the WebKit exposed for the other iOS browsers use can’t access those features. Did that change in iOS 14?
- sitharus 6y ago
  According to the article > Like Face ID and Touch ID for the web, security key support is available in Safari, SFSafariViewController and ASWebAuthenticationSession.
  - zxcvbn4038 6y ago
    Ok, looks like ASWebAuthenticationSession is the one Chrome for iOS uses, hopefully that means we’ll gain u2f, TouchID, and FaceTime then.
tialaramex 6y ago
Overall I'm hopeful that people will actually put the (relatively little) work in to actually deliver WebAuthn on more web sites because it has both better security and a nicer UX flow. Win win. But, as to this particular article: The code snippet elides two really important values: userIdBuffer and challengeBuffer. I get why - they're complicated and not very exciting to the intended audience. But they're also vitally important, so I think it would have been worth putting it non-zero effort. userIdBuffer needs to be some sort of unchanging unique identifier for the user. Probably pick suitably large random values in an indexed table or something. It might be tempting to stick the row ID from your user table or similar in here, but that's actually a bad idea you'll likely regret. challengeBuffer needs to be actual random bytes. Hey, the Javascript interpreter has... No. The random bytes need to be chosen fresh by the backend server where you're authenticating users. And they must be actual cryptographic quality randomness, not a Mersenne Twister from your utility library.
Animats 6y ago
Should there be a non-anonymous option, for social media sites where you have to log in under your real name? Verified by face recognition and fingerprints?
- jassany 6y ago
  I cant tell if you're being sarcastic lol.
can16358p 6y ago
Why does it exactly show a popup saying "website wants to use Touch ID"? It could just say "Touch ID to login" on the Touch Bar and wouldn't it be enough? If the user prefers otherwise, they simply won't touch. Doesn't the popup create extra friction (unless I'm missing something)?
- thejsa 6y ago
  My understanding is that the permissions popup is used for the registration flow (generating & enrolling a key into the Secure Enclave), and after that if there are existing credentials, it's just 'Touch ID to login'.
sriku 6y ago
We've built and use https://thumbsignin.com https://thumbsignin.com (TSI for short) on our intranet apps for simple (i.e. one step and secure) authentication using our mobile phones. ThumbSignin is FIDO certified and we've worked to add more authentication means for enterprises as time passed (TSI is 2 years old now I think). Disclosure: I work for Pramati Technologies which developed and owns ThumbSignin.
khushisharma 6y ago
Get Packers and Movers Jaipur List of Top Reliable, 100% Affordable, Verified and Secured Service Provider. Get Free ###Packers and Movers Jaipur Price Quotation instantly and Save Cost and Time. Packers and Movers Jaipur Reviews and Compare Charges for household Shifting, Home/Office Relocation, *Car Transportation, Pet Relocation, Bike SHifting @ https://jaipurpackersandmovers.in/ https://jaipurpackersandmovers.in/
deleted 6y ago
[deleted]

757 points by Austin_Conlon 6y ago

obilgic 6y ago

What will Chrome do?

oarsinsync 6y ago
Probably the same as what they did with Apple Pay, and (re)launch a comparable function with Android?
lern_too_spel 6y ago
Other platforms have supported this for a long time. https://www.zdnet.com/google-amp/article/windows-10-says-hello-to-no-passwords-with-fido2-certification/ https://www.zdnet.com/google-amp/article/windows-10-says-hel...
rektide 6y ago
> What will Chrome do? Develop & give away a verifiable, open-source hardware & software solution for a silicon root of trust, with a focus on security through transparency[1]. Google will organize & make available the world's information on how to secure systems well. Yes, this is intended for, among other uses, implementation of a FIDO2 universal 2-factor security key[2]. [1] https://opentitan.org/ https://opentitan.org/ [2] https://github.com/lowRISC/opentitan/pull/1125/files#diff-6d73b518ad3908ac84c5aaed0ec365a548019f6f6d77165e2b878fa3daed0d59R123 https://github.com/lowRISC/opentitan/pull/1125/files#diff-6d...
timdorr 6y ago
This is a part of the Credentials Management API / WebAuthn API: https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent... They already support this for things like FIDO hardware keys and other biometric hardware. It's also supported by Firefox.

varbhat 6y ago

Is this only implemented in Apple devices Or is it cross platform ?

hprotagonist 6y ago
as far as i know both faceID and touchID require Secure Enclave, so that would be apple only.
- pbreit 6y ago
  I think Mac Chrome can support Touch ID: https://www.iphoneincanada.ca/news/google-chrome-for-mac-fingerprint-support-2/ https://www.iphoneincanada.ca/news/google-chrome-for-mac-fin...
  - filoleg 6y ago
    Yep, it can. I don't know what logic it uses to request touchID vs. keychain password (because i occasionally see both), but, nonetheless, I definitely had Chrome TouchID pop-up quite a few times when I tried to autofill my credit card info.
Nullabillity 6y ago
Looks like it's "just" another authn method for using the phone itself (or more precisely, the "secure element") as a WebAuthn/FIDO2 dongle. So the specific UX is Apple-specific (although it could of course be replicated by others), but the API is generic (and already exists).
eldridgea 6y ago
This appears to be Apple's implementation of WebAuthn which is a standard specification. So while this page is about the specifics of this in Safari, the WebAuthn spec in general is widely implemented. If your device has a TPM/secure enclave/etc (most modern devices do) then it works already in Chrome/FF/Safari/Edge on desktop and Chrome on Android and Safari on iOS. If you want to see it in action you can try out a demo at https://webauthn.io https://webauthn.io
6y ago

mariomariomario 6y ago

I'm curious about "Apple Anonymous Attestation". Is Apple taking on any liability by providing this service or is this all done on hardware through private APIs?

ArchOversight 6y ago
It is only for Apple Devices, and all it does is allow them to easily disable attestation and thus (is this device used for auth secure) for a singular TouchID/FaceID. Instead of with Yubikey where if the attestation key is compromised, and it is blacklisted, they disable every single last device manufactured with said attestation key.
- jiveturkey 6y ago
  > easily disable attestation all future attestations. U2F/webauthn doesn't actually provide a revocation mechanism. > Instead of with Yubikey where if the attestation key is compromised, and it is blacklisted, they disable every single last device manufactured with said attestation key. it is important to note that there is not a "the" attestation key. there are many. "disabling" one, to the extent that is even possible, disables only the group with that key.
fuzzy2 6y ago
Attestation is just a technical term in the WebAuthn API. Different authenticators can use different attestation data formats. Apple rolled their own, hence the name.
- ArchOversight 6y ago
  Apple didn't just roll their own though, they improved upon it by allowing them to easily revoke attestation for a particular implementation without affecting all other devices out there. So if an attacker tampers with the physical device, they can revoke the key for that particular device so that it is no longer trusted (the way I am reading it) vs yubikey where if an attacker has messed with one key, there is no good way to revoke attestation for that one device.

6d6b73 6y ago

No. Thank you very much.

deleted 6y ago
[deleted]
mttjj 6y ago
Care to elaborate?

_jal 6y ago

I predict logs of Face ID attestations will feature in divorce lawsuits within a year of them becoming commonplace.

charlescarver 6y ago
Why?
- overcast 6y ago
  Dating sites?
- olliej 6y ago
  presumably because they think faceid has a picture of peoples faces.

blintz 6y ago

So happy Apple decided to go with an open standard here rather than something proprietary. This is good news for the FIDO2 ecosystem and I hope this leads to far greater support for FIDO2 authenticators of all types. There is another world in which Apple just pushed 'Sign in with Apple' and created yet another federated identity provider rather than true, 'secure element'-based FIDO2 authentication.

rektide 6y ago
I dunno. I mean, I do, it feels good. But it also is a very different kind of FIDO2 than what we've seen before. In a way that FIDO was designed for, that we hoped would happen. But it's still not entirely joy & mirth that we're here for me. It feels like a little like the first day we start to understand how "Big Tent" (in the OpenStack sense) FIDO2 ecosystem is. You can do whatever, make anything, and call it FIDO2; it's all duck typing: looks like a duck, quacks must be a duck. No implementation details are required, no transparency is needed, everything can be totally vendored way way up, and the standard will welcome you. Your platform is welcome here. This post is about how to use & prefer that platform, over the more common means available. For sure this is overwhelmingly a good thing. It's by design that we allow platform authenticators in WebAuthn. Apple is allowing their closed, proprietary security technologies to seamlessly work on the web without making webdevs jump through hoops. It's a good thing, and this will really help Web Authentication for sure. Still I have some wistfulness. It's a good user experience, it's great. It's a win for devs, it's a win for users. Still there's some larger context I can't quite put my finger on, when I see "authenticatorSelection: { authenticatorAttachment: "platform" }". The web is letting more of the native platform shine through, and that's good, but it also forgoes some of the knowability & commonality that resounds on so much of the rest of the web, and while the immediate impact is extremely good, I still think there's some kind of hard to describe ultra-slow-motion civilization-scale loss that's also passenger to this successful commingling of web and platform.
- StavrosK 6y ago
  So what exactly is the concrete downside here, apart from the icky word "platform", that, in this context, means "a security chip that's not removable", ie as opposed to a Yubikey or such.

mkl95 6y ago

How secure is this?

young_unixer 6y ago
The s in "face ID" stands for security.
- mkl95 6y ago
  I may use this when I find a cheap surgeon in case the "mathematical representation of my face" is leaked.

fullstop 6y ago

If I can use FIDO2 on my yubikeys in more places, it would be fantastic.

0xCMP 6y ago
You can already use NFC and Lightning yubikeys on your iPhone. On iPad Pro there are issues using USB-C still in my experience. Being able to use FaceID on there now will be nice.
- dwaite 6y ago
  There are three methods on iPhone: 1. NFC 2. USB - this is actually how it works with the lightning connector on iPhone in Safari - the Yubico model with a lightning port is working as a lightning to USB adapter in this case. 3. MFI (Made for iPhone) - some third party browsers can use the external accessory framework to talk to the Yubico model over the lightning port. Safari does not support this, but luckily can just use these keys as USB keys. I believe there is a hardware limitation that the MFI protocol only works over the lightning port and not the USB-C port, so they work for third party browsers on iPhone and not iPad Pro or the new iPad Air.
- fullstop 6y ago
  Right, I am hoping that this leads to more websites utilizing FIDO2. Kind of like how Android Pay was around for many years but didn't actually take off until Apple Pay made it happen.

paul7986 6y ago

It's not supported by mobile or desktop Safari?

olliej 6y ago
It looks like it's a feature of the next release? Maybe the developer versions already have it?

mywittyname 6y ago

How does this work on laptop/desktop computers?

ArchOversight 6y ago
Like the laptops that Apple has built with TouchID built-in?
olliej 6y ago
Most (all?) new apple laptops have touchid, but I agree this seems most useful on iPhone/Pad which kind of makes sense as the majority of 2fa keys (yubi, etc) still plug in. That would surely be more awkward than using the already built in SEP and authentication system.

khana 6y ago

now everbody knows your face

jjcm 6y ago

These all seem to be examples that use faceID/touchID as a password. That’s not what biometrics should be though, they should be the username. I hope that this is supported as a flow as well. Identify who you are with biometrics, and prove your access with a correlated password.

arnarbi 6y ago
First, the model in FIDO is that it's the piece of hardware (in this case, your laptop or iOS device) that is your authentication factor. The biometric is a local facility for unlocking that device and approving that specific action. Second, the primary threat identity providers (and their users) deal with are remote, impersonal hijacking of accounts, where the password is either guessed (because it existed in a leak) or the user was phished. That's the primary value of something like this. Attacks where someone can lift your fingerprints or has your device are real but much much less common.
dlivingston 6y ago
Maybe (probably) I’m just ignorant of the actual state of the industry, but it seems to me that biometrics have always been about providing full user authentication. I’m not personally aware of any instance where an alphanumeric password is still required as a secondary authenticator to biometrics.
- DaiPlusPlus 6y ago
  > I’m not personally aware of any instance where an alphanumeric password is still required as a secondary authenticator to biometrics. It's straightforward to configure Active Directory / Group Policy to require biometric and password factors for interactive authentication. The main reason not to allow _only_ biometrics is to disincentivize chopping fingers off (well, it's more because [it's still surprisingly easy to fool biometric systems](https://www.theguardian.com/technology/2014/dec/30/hacker-fakes-german-ministers-fingerprints-using-photos-of-her-hands https://www.theguardian.com/technology/2014/dec/30/hacker-fa...)).
  - 6y ago

judge2020 6y ago

Neither sync nor keychain is mentioned in this post or in the WWDC presentation, so I'd like to ask if the credentials are synced between devices whatsoever, or if they're transferrable. While it'd be more secure to run it through a device's T2, a syncing/keychain-backed key would save a lot of the re-enrollment hassle for users who end up transferring their data to a new phone or need to enroll each of their devices for all of the web services they use.

dwaite 6y ago
They are no synchronized between devices. This is generally considered to be a no-no with FIDO (although Apple has not publicly announced whether they intend to be FIDO certified)
- toomuchtodo 6y ago
  Apple is part of the FIDO alliance, I would assume they intend to be FIDO certified.
0xCMP 6y ago
For simplified login situations (e.g. not requiring two factors for authentication) you'll probably have some kind of password or password-less (email) login flow where you can login at first and then enroll the FIDO2 device. Otherwise there is no way to login from any other device. An alternative is that you can authenticate a new device from an existing device along with a re-auth on that device to verify it's them. Discord has a feature similar to this with it's QR login system.

mortenjorck 6y ago

The UI probably needs to be more explicit about what's going on. I would imagine most non-technical users aren't well-versed in how Apple's Secure Enclave (or other competing solutions) manage authentication, and so I wouldn't be surprised if "allow example.com to use TouchID" would give many the impression that the website is asking to access their biometric data. Ideally, the prompt should reflect the actual model, though I'm not sure how one might pose that in an accessible and succinct way.

easton 6y ago
They could just have it say "example.com wants to use Touch ID to sign-in. Biometric data is not shared." with a help link that goes on to explain in laymens terms how your iPhone basically sends a password-ish thing to the website after you use Touch ID (similar to how Apple Pay sends a one-time use credit card number to a merchant).
- asdff 6y ago
  Apple's UI designers would never tolerate such a helpful and wordy dialog box.
  - can16358p 6y ago
    I don't understand why they even ask it as a popup. I mean, you already get "touch to login" kind of text next to Touch ID on Touch Bar, if you don't want to login that way, simply don't touch it. Am I missing something extra about the purpose of this popup?
    - kevincox 6y ago
      Because who is looking at their touch bar constantly just in case a site is trying to login? It seems to me that every time it is active a dialog pops up. Especially when I am using an external monitor there is no way I would notice just that.
  - wpm 6y ago

dochtman 6y ago

Hope this will finally put some pressure on Mozilla to build TouchID support: https://bugzilla.mozilla.org/show_bug.cgi?id=1536482 https://bugzilla.mozilla.org/show_bug.cgi?id=1536482

outworlder 6y ago
Provided there's still someone still working there that's capable of implementing it.

ezekg 6y ago

Has anybody ever thought about how Face ID is pretty much a backdoor into your iPhone? Think back a few years to when Apple refused to open a felon's iPhone for the US government, because "they couldn't." If that happened now, they wouldn't even have to ask Apple, given the felon has Face ID enabled. Edit: I'm kind of surprised by the downvotes, given I thought HN was pretty big on personal privacy. Just thought I'd stir up the discussion, that's all. Edit 2: I personally think U2F is the way forward here, not Face ID or Touch ID or other biometrics.

dawnerd 6y ago
There's limitations. iOS requires a passcode after so long and after so many bad attempts or after a reboot. The time law enforcement would have to use your face to get in is pretty short.
dwighttk 6y ago
possibly, but they have to be quick about it: >To use Face ID, you must set up a passcode on your device. >You must enter your passcode for additional security validation when: >The device has just been turned on or restarted. >The device hasn’t been unlocked for more than 48 hours. >The passcode hasn’t been used to unlock the device in the last six and a half days and Face ID hasn't unlocked the device in the last 4 hours. >The device has received a remote lock command. >After five unsuccessful attempts to match a face. >After initiating power off/Emergency SOS by pressing and holding either volume button and the side button simultaneously for 2 seconds.
- ezekg 6y ago
  I wasn't aware of some of these. Thanks for sharing.
mcpherrinm 6y ago
The risks of forced unlocking with FaceID have been discussed, including in court: https://appleinsider.com/articles/19/01/14/face-id-touch-id-unlocks-cant-be-compelled-by-law-enforcement-rules-federal-judge https://appleinsider.com/articles/19/01/14/face-id-touch-id-... The main alternative to biometric ID is a PIN. Those are seldomly changed, and are relatively easily shoulder-surfed. I've seen children who can't even read yet learn their parent's iPad PINs. If you're afraid of the police, surveillance needs to be your threat model. There's some ways to prevent being forced to use face unlock if you see it coming, by squeezing your phone: https://www.macworld.com/article/3236793/how-to-quickly-and-discreetly-disable-face-id-on-the-iphone-x.html https://www.macworld.com/article/3236793/how-to-quickly-and-...

young_unixer 6y ago

I would never use this for anything sensitive. Bad actors can get your face and your fingerprint. Some of them already have it (governments, banks, Apple, Facebook, etc). And changing your face or fingerprint is practically impossible.

reaperducer 6y ago
Apple has my face and fingerprint? I haven't heard this before and Google turns up nothing. Any source?
- macintux 6y ago
  Your Apple device has a hash of your fingerprint and/or face at best. Apple itself has nothing of the sort.
- young_unixer 6y ago
  You put your fingerprint into a black box and that black box phones home to Apple servers. From a security standpoint, we must assume that they have your fingerprint unless there's a way to prove that they don't. iOS is closed source so we can't prove that. From an epistemological point of view: I don't know if they have it. From a security point of view: they have your fingerprint.
  - mcpherrinm 6y ago
    Just because something's closed source doesn't mean we can't learn about it. The field of reverse engineering has been around for a long time, and the iPhone and Mac are two of the most studied devices around. Ultimately you do have to trust your platform if you're going to use a platform authenticator to some degree. But the alternative in the FIDO2/webauthn space is something like a Yubikey which has no biometrics; it just takes a simple tap. And can be easily removed from your computer. So in that comparison, the fingerprint is purely additive security. Even if it's adding nothing to a serious adversary, it's still dramatically reducing risk to a less-skilled local attacker.
  - 6y ago

Zaheer 6y ago

You can change a password but you can't change your fingerprint / palm / etc. Am I missing something? How is Face / Touch ID more secure that user + pass? What happens when biometric data is leaked?

atty 6y ago
As far as Apple devices are concerned, biometric data never leaves the Secure Enclave, so risk of data leak is non-zero, but sufficiently low for everyday life. Compare that to the massive number of people who use password123 as their password for every account across the web, and yes, biometrics are far more secure. :) More secure than a random 30 character string? Probably not. And if you’re targeted by individuals who are sufficiently motivated to steal your biometrics and the physical device, then neither the password nor the biometrics will be enough to protect you.
wmf 6y ago
Biometric data is never leaked because it never leaves the secure enclave in the device.
- henryfjordan 6y ago
  Your face can easily be mimicked. Biometric data is not stored in the phone, it is stored in you. See: https://www.macrumors.com/2018/12/16/3d-printed-head-android-face-id/ https://www.macrumors.com/2018/12/16/3d-printed-head-android...
  - kryptozinc 6y ago
    > The final model took a few days to generate at the cost of just over £300. "easily"
    - 10000truths 6y ago
      £300 is chump change in most any organization's budget.

Razengan 6y ago

I was just thinking: Could we replace CAPTCHA with Touch ID/Face ID when browsing a website on Apple devices? That would be a pretty quick and painless way to verify that I am, indeed, a human, with no unpaid labor involved.

alexmingoia 6y ago
Potentially, yes. Authenticators can provide a public certificate, so servers can accept attestations created through whitelisted authenticators. This would mean being forced to use proprietary hardware or closed-source authenticators, because that’s the only way to control authenticator certificates.

AshleysBrain 6y ago

It's a shame they have a messy pile of API-specific hacks to propagate the "user gesture". Chrome solved this problem with a change to the spec (which they called "User activation v2" [1]). It's basically two flags and a short timeout, and it covers basically all cases. Safari's approach means you have very specific codepaths, and if you do something async outside of that, tough luck, you can't use the feature and will have to nag the user to touch the screen again. This already affects APIs like clipboard (want to copy something that takes async work to generate? tough luck), limits APIs like OffscreenCanvas (want to move your game engine to a worker? tough luck, you lose access to all user gestures), and this too. Hopefully Apple can consider aligning with Chrome on this. [1] https://www.chromestatus.com/feature/5722065667620864 https://www.chromestatus.com/feature/5722065667620864

Razengan 6y ago
> It's a shame they have a messy pile of API-specific hacks to propagate the "user gesture". Chrome solved this problem with a change to the spec If Safari had changed the spec that comment would probably have begun with "It's a shame they had to change the spec..." > Safari's approach means you have very specific codepaths, and if you do something async...tough luck I'm no expert on it but this sounds more secure, no? > APIs like clipboard (want to copy something On a side note, I really wish non-explicit copy/pasting/clipboard snooping would die. iOS 14 has exposed a bunch of apps that read your clipboard without any explicit paste action. It's creepy and we can only hope that it's not malicious. A bunch of big names including Discord are guilty of this.
- kevincox 6y ago
  > If Safari had changed the spec that comment would probably have begun with "It's a shame they had to change the spec..." I don't follow. They are breaking the spec anyways. A simple timeout would be equally spec-breaking and a lot easier to understand and use. The weird async-callback-chaining doesn't actually limit any nefarious behaviour. It just requires the code author to carefully stay inside their arbitrary happy-path. A simple timeout after a user gesture is just simpler. Furthermore this is something that you can't test without buying a thousand dollar device.

dzhiurgis 6y ago

Cmon apple, just add NFC to macbooks already. Fido cards are the most obvious solution to this.

anuila 6y ago
I don’t know what I’m talking about, but isn’t the Secure Enclave already a solution to this? Fido cards just sound like an external solution that all iPhones and new MacBooks already have integrated (T2)
- dzhiurgis 6y ago
  Sure works when you have only one computer in your life (aka almost nobody). It’s especially bad with Apple with 3 different usb standards. Contactless is the future.
  - BHSPitMonkey 6y ago
    What's stopping you from linking more than just one physical FIDO-enabled device to a particular site/service? Most MFA implementations I've seen already allow this, and it seems especially important if you want to minimize the pain of losing/damaging that one sacred card.
    - dzhiurgis 6y ago
      I don't carry any keys so those massive dongles would be pain. Plus must is not ALL which breaks everything.
      - warkdarrior 6y ago
        Mobile phones can be FIDO enabled. (see https://developers.google.com/identity/fido/android/native-apps https://developers.google.com/identity/fido/android/native-a... )
    - sneak 6y ago
      AWS, for example, only permits one MFA device per IAM user account. I have four computers and four tokens. :/

WoefullyInept 6y ago

Why would anyone use this except apple? It's bad for users, bad for websites, but good for apple.

dividuum 6y ago

I toyed around with this on https://passwordless.dev/usernameless https://passwordless.dev/usernameless on iOS 14 and now I have two test users to choose from on the 'Do you want to sign in www.passwordless.dev" using a saved account?' prompt. I have yet to find a way to remove those test accounts again.

xfalcox 6y ago
Removing is covered in the article: > Credentials can only be cleared for all via Safari > History > Clear History… on Mac Safari or Settings > Safari > Clear History and Website Data on iOS & iPadOS.
- dividuum 6y ago
  Thanks for the quick response. I thought I tried that and just made sure I did. The following did not work for me: Settings > Safari > Clear History and Website Data > Searching for "passwordless.dev" > Edit > Removing the "passwordless.dev" row. The two accounts are still there when reopening passwordless.dev and clicking on "Sign in". I'm probably missing something obvious. Edit: Oh. I guess the "for all" in the article mean that this only works if I clear the complete history for all sites? I did not try that. Edit2: Cleared all website data. The two test accounts are still there.
  - Nextgrid 6y ago
    Also confirming that clearing all history & website data does not clear it on iOS.

drexlspivey 6y ago

This comes 3 days after a leak that alleged that iPhone 13 will bring back Touch ID via in-screen fingerprinting https://www.techradar.com/uk/news/move-over-iphone-12-apples-iphone-13-may-feature-under-display-touch-id https://www.techradar.com/uk/news/move-over-iphone-12-apples...

madeofpalk 6y ago
Hasn't this been leaked for like the past 3 years?
- cflewis 6y ago
  Yes, this has been a perennial rumor which is probably propagated by how much people don't like Face ID all that much. Face ID is fine when it works, and sucks when it doesn't. And mask wearing has really accelerated it being much worse, and we'll be wearing masks as a standard piece of dress for another two years I guess. I do miss Touch ID, but that had its own problems (gloves, wet fingers). So one would hope there is a solution that has both. I'd personally be just peachy with a fingerprint sensor on the back just like the Pixel line used to have. I mean, how much is a fingerprint sensor manufacturing cost? $5?
deleted 6y ago
[deleted]
MobileVet 6y ago
Please please please be true. TouchID is objectively superior to FaceId, by a long shot. It is my soap box... but TouchID RARELY failed and could be activated BEFORE you had the phone in front of you. FaceID fails constantly and MUST be in view to start the unlock process. TouchID has a single failure mode (and a half) that isn't that common. Wet / dampness. Solution, dry your finger, try again. Gloves are the 'half' mode as what can you expect, you can't access the finger. FaceID has no less than 3 FREQUENT failures and a myriad of other smaller less frequent ones. Occlusion, distance and light. Occlusion - Have your face resting on your palm... fail. Have a hat on, fail. Have a mask on... Distance is an interesting one, but for those of us with terrible eyesight, it is constant. Phone call / text at night? Put the phone up to my face to see... FaceID fail (too close). I have to move it back away so I can't read it to unlock... hoping it did unlock before I move it forward again to read it. Light - This really shows up when outdoors in the sun. The IR sensor gets washed out and can't work. It isn't that bad, but it does happen frequently enough to notice. The other thing that is SO annoying about FaceID is that is has no idea WHEN you want to use it... see a face 'I must SCAN IT!' Oh, that is someone else, now you are locked out and need your password. Pick up your phone, SCAN! Oh, that is your pocket, now you need your password. The latter can be turned off, the former, not so much. I ALMOST bought an 8 instead of a Xs when I finally upgraded, but OLED pushed me over the edge. I do love the screen, but I scorn FaceID daily and was hoping for TouchId to return to the 12. Fingers crossed for the 13, lol.

bjt2n3904 6y ago

If passwords are the original sin, then Face ID and Touch ID are Sodom and Gomorrah. Authentication is something you KNOW. Strong authentication is something you KNOW, and something you HAVE. Something you ARE is great for identification, but terrible for authentication. Something you are cannot be changed like a password.

ericpauley 6y ago
At least, in the case of biometric authentication on device, the ability to use biometrics expires automatically when the device is turned off (and other times), so biometric credential theft has a limited window of vulnerability. This contrasts with many fixed biometric authentication systems that aren't used as often as a cell phone.
- bjt2n3904 6y ago
  Maybe... but if I steal your fingerprint, I have it forever. And the courts can't yet force you to reveal secrets from your mind. But you can be compelled to use your fingerprint to unlock things.
  - laurent92 6y ago
    In USA? I’m not even sure. In France there are many circumstances where you must reveal your phone password or any hard drive’s encryption key, if there is legit suspicion it has been used for general criminality (case in court with a cannabis dealer).
ryukafalz 6y ago
The “something you have” is the key stored in the secure enclave/yubikey/whatever. That’s the real authenticator in this scenario. That it’s (maybe) unlocked biometrically is nice, but secondary.
robinson-wall 6y ago
In this case Face/Touch ID represents something you have (the iOS device with a persisted credential in its secure enclave), and something you are (fingerprint/face).

mehmetkose 6y ago

PWA's will be a huge deal in near future

kinkrtyavimoodh 6y ago

I am not comfortable with Apple getting any control over the web. Thankfully, so far the web is mostly free from Apple's clutches and they can run their fiefdom only in the App universe. I shudder to think of a future where websites will have to implement some version of Apple's In-App Purchases program and give 30% of the revenue to Apple or else they won't be allowed to render on Apple devices.

oezi 6y ago

Does anyone know why Webauth does not support a message associated with the authentication? Shouldn't the user be informed in a secure way what they are authenticating for? Currently only site and user name are supported to be shown to the user. For payments (PSD2 for instance) it is a requirement to also provide information about the transaction for instance.

EtienneK 6y ago
Last time I checked, WebAuthN does not support UAF transaction signing yet - only via extensions and thus we don't see it in the browser implementations. Hopefully it gets added to the spec in the future.

znpy 6y ago

I've come to appreciate DigitalOcean's approach on the matter. Until you configure a 2FA device (TOPT in my case) they'll send you a temporary code to your email address. So password alone is worthless, and mailbox ownership is verified on every login. Also, I made a point never to use the "login with X" feature, no matter what X is. I always sign up with my own email.

lilyball 6y ago
I really hate the "we're going to send a code to your email" approach because it so often breaks. Case in point, I tried to log into Patreon earlier today, they insisted on sending a code, and it never arrived. I tried several times, no email. I have a record of every email sent to my address for the past several years regardless of spam status so I can be 100% positive they simply never sent it. In the end I had to give up. I can't log into Patreon today, because of their insistence on sending me an email even though I'm logging in from a computer I've used many times before.
- gwillen 6y ago
  I'm curious -- do you host your own email, or use a lesser-known email provider? I am increasingly seeing failures where sites seem to be blackholing outgoing email, I suspect based on the destination domain, and unaware that they are even doing this / extremely insistent that they are not. I've gotten login-email failures like you describe from a couple of sites, and seemingly similar failures from those "email your kid this story" sharing systems on two news sites my mother uses. In all these cases, the messages simply never arrive at the destination SMTP server.
  - lilyball 6y ago
    I have a custom domain that uses Gmail as its mail provider (for legacy reasons related to the other users of this domain), and my Gmail account is configured to never mark anything as spam and to forward everything to Fastmail. This means that no matter what I do with my email, I can log into the gmail account and see every email I've received for years sitting in my inbox. I don't really recommend this setup, I'd really prefer to cut Google out of the path entirely, but I can't do that without abandoning my email address.

headmelted 6y ago

Oh cool, the new ARM MacBooks coming next month have Face ID. Sweet.

user396492 6y ago

Any bullying or power abuse situation may easily exploit biometric authentication against the victim. Kids bullying other kids, domestic abuse, authorities etc. Now, if biometric authentication becomes the norm, how will a wife suffering domestic abuse justify using a password?

askvictor 6y ago
I agree with you, but am not sure a password works too well in such situations either - the abuser would presumably just beat the victim until they enter their password?
- lotsofpulp 6y ago
  Yes, I don’t see it helping in situations where the attacker has a long term relationship with victim. https://xkcd.com/538/ https://xkcd.com/538/ However, I think touchID is susceptible to being robbed since if you have your bank account or Apple Pay enabled to transfer cash with touchID as authentication, then you can be robbed while you’re passed out drunk or roofied or whatever.
  - ascagnel_ 6y ago
    One of the benefits of Face ID is that it supports an attention check, which should be harder to coerce if you’re passed out/drugged.

mrwnmonm 6y ago

Honest question, Why I feel I have to be an advanced programmer to understand all of that? I see a lot of confusion in the comments, so it is not just me. Why the article couldn't be simpler? Maybe I am just stupid, I don't know.

syspec 6y ago
It seems like it's really written for potential implementers already in that field. I love technical content that does not shy away from from going in depth

deleted 6y ago

[deleted]

zxcvbn4038 6y ago

Last I checked Apple only supported U2F and similar in Safari - the WebKit exposed for the other iOS browsers use can’t access those features. Did that change in iOS 14?

sitharus 6y ago
According to the article > Like Face ID and Touch ID for the web, security key support is available in Safari, SFSafariViewController and ASWebAuthenticationSession.
- zxcvbn4038 6y ago
  Ok, looks like ASWebAuthenticationSession is the one Chrome for iOS uses, hopefully that means we’ll gain u2f, TouchID, and FaceTime then.

tialaramex 6y ago

Overall I'm hopeful that people will actually put the (relatively little) work in to actually deliver WebAuthn on more web sites because it has both better security and a nicer UX flow. Win win. But, as to this particular article: The code snippet elides two really important values: userIdBuffer and challengeBuffer. I get why - they're complicated and not very exciting to the intended audience. But they're also vitally important, so I think it would have been worth putting it non-zero effort. userIdBuffer needs to be some sort of unchanging unique identifier for the user. Probably pick suitably large random values in an indexed table or something. It might be tempting to stick the row ID from your user table or similar in here, but that's actually a bad idea you'll likely regret. challengeBuffer needs to be actual random bytes. Hey, the Javascript interpreter has... No. The random bytes need to be chosen fresh by the backend server where you're authenticating users. And they must be actual cryptographic quality randomness, not a Mersenne Twister from your utility library.

Animats 6y ago

Should there be a non-anonymous option, for social media sites where you have to log in under your real name? Verified by face recognition and fingerprints?

jassany 6y ago
I cant tell if you're being sarcastic lol.

can16358p 6y ago

Why does it exactly show a popup saying "website wants to use Touch ID"? It could just say "Touch ID to login" on the Touch Bar and wouldn't it be enough? If the user prefers otherwise, they simply won't touch. Doesn't the popup create extra friction (unless I'm missing something)?

thejsa 6y ago
My understanding is that the permissions popup is used for the registration flow (generating & enrolling a key into the Secure Enclave), and after that if there are existing credentials, it's just 'Touch ID to login'.

sriku 6y ago

We've built and use https://thumbsignin.com https://thumbsignin.com (TSI for short) on our intranet apps for simple (i.e. one step and secure) authentication using our mobile phones. ThumbSignin is FIDO certified and we've worked to add more authentication means for enterprises as time passed (TSI is 2 years old now I think). Disclosure: I work for Pramati Technologies which developed and owns ThumbSignin.

khushisharma 6y ago

Get Packers and Movers Jaipur List of Top Reliable, 100% Affordable, Verified and Secured Service Provider. Get Free ###Packers and Movers Jaipur Price Quotation instantly and Save Cost and Time. Packers and Movers Jaipur Reviews and Compare Charges for household Shifting, Home/Office Relocation, *Car Transportation, Pet Relocation, Bike SHifting @ https://jaipurpackersandmovers.in/ https://jaipurpackersandmovers.in/

deleted 6y ago

[deleted]