28 ms·

So happy Apple decided to go with an open standard here rather than something proprietary. This is good news for the FIDO2 ecosystem and I hope this leads to fa

by blintz 6y ago

So happy Apple decided to go with an open standard here rather than something proprietary. This is good news for the FIDO2 ecosystem and I hope this leads to far greater support for FIDO2 authenticators of all types. There is another world in which Apple just pushed 'Sign in with Apple' and created yet another federated identity provider rather than true, 'secure element'-based FIDO2 authentication.

rektide 6y ago
I dunno. I mean, I do, it feels good. But it also is a very different kind of FIDO2 than what we've seen before. In a way that FIDO was designed for, that we hoped would happen. But it's still not entirely joy & mirth that we're here for me. It feels like a little like the first day we start to understand how "Big Tent" (in the OpenStack sense) FIDO2 ecosystem is. You can do whatever, make anything, and call it FIDO2; it's all duck typing: looks like a duck, quacks must be a duck. No implementation details are required, no transparency is needed, everything can be totally vendored way way up, and the standard will welcome you. Your platform is welcome here. This post is about how to use & prefer that platform, over the more common means available. For sure this is overwhelmingly a good thing. It's by design that we allow platform authenticators in WebAuthn. Apple is allowing their closed, proprietary security technologies to seamlessly work on the web without making webdevs jump through hoops. It's a good thing, and this will really help Web Authentication for sure. Still I have some wistfulness. It's a good user experience, it's great. It's a win for devs, it's a win for users. Still there's some larger context I can't quite put my finger on, when I see "authenticatorSelection: { authenticatorAttachment: "platform" }". The web is letting more of the native platform shine through, and that's good, but it also forgoes some of the knowability & commonality that resounds on so much of the rest of the web, and while the immediate impact is extremely good, I still think there's some kind of hard to describe ultra-slow-motion civilization-scale loss that's also passenger to this successful commingling of web and platform.
- StavrosK 6y ago
  So what exactly is the concrete downside here, apart from the icky word "platform", that, in this context, means "a security chip that's not removable", ie as opposed to a Yubikey or such.
  - sneak 6y ago
    Websites will, at their option, be able to require Apple hardware to use them.
    - reaperhulk 6y ago
      Attestation has allowed a website to lock to a specific vendor for 5+ years.
    - jrmann100 6y ago
      Last I checked, Windows won't let you use self-signed attestation keys for your homemade devices.
  - rektide 6y ago
    perhaps it's a totem, a reminder, that not all tech is interested in working together, that unlike the web itself you are entering an Apple or an Atari or Acorn specific encampment, for some random examples.
yegle 6y ago
"Sign in with Apple" requires a developer account with Apple. Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". (FWIW, the only 2fa with "Sign in with Apple", if you don't own any Apple hardware, is SMS.)
- dwaite 6y ago
  Apple did not terminate Epic's SiwA account, and several journalists have sources within Apple that say that Apple never sent the message Epic claimed to receive that said access was going away.
  - virtue3 6y ago
    https://developer.apple.com/forums/thread/123774 https://developer.apple.com/forums/thread/123774 Not the only ones that randomly gets their accounts terminated. Based on how apple has -insane- fragmentation and security for different aspects of the company, I would doubt any employee that isn't directly tied into the store accounts would know the whole details. (Source: GF worked for the department that did art/design for the apple stores, no one had access to their room, and they had more secure rooms that only a few employees had access to). FWIW google has the same issues. Don't trust a company with an account that you can't get a human on the phone for to review shit.
    - toomuchtodo 6y ago
      I use Sign In with Apple everywhere I can (so many of my passwords are in haveibeenpwned datasets), and if Apple blacklisted a provider I use, I’d expect the service to email me to migrate to their own email/password identity provider (if I didn’t hide my email from them with SIWA), with a link to the migration process in the email.
      - dkonofalski 6y ago
        Same except that, if Apple blacklisted a provider, I'd want to know why they got blacklisted. At this point, I trust Apple as a neutral third party more than I trust most other companies since Apple isn't incentivized to sell my info.
brightball 6y ago
Really excited about this too. When we were adding 2FA options at my company we pushed to use Webauthn instead of just a QR code/OTP approach. News like this where we can tell people "it already works because we made the right decision" is fun.
madeofpalk 6y ago
This doesnt really surprise me - Apple has a history of implementing, or moving to, standards for their platform features in Safari. I think about Apple Pay for web - it started out as a proprietary API, and then the Payment Request API standard was developed and they added support for that. It's in Apple's interest to help develop and support standards like this because they mean more adoption of their platform features.
- kinkrtyavimoodh 6y ago
  I am still waiting for them to move to USB-C
  - hk__2 6y ago
    > I am still waiting for them to move to USB-C What do you mean? All Mac models introduced since 2016 support USB-C. https://support.apple.com/en-us/HT201736 https://support.apple.com/en-us/HT201736
    - chadlavi 6y ago
      Not OC, but they probably mean iPhones. I wish iPhones would switch to USB-C too; my iPhone is now the only device I own that isn't USB-C.
      - jimmydorry 6y ago
        In another generation or two, I would expect it to be port-less (wireless). This generation was the one to change to USB-C if it were on their roadmap... but I guess time will tell.
      - ksec 6y ago
        I would actually pay extra $10 for an Portless iPhone or iPhone without USB-C.
      - kube-system 6y ago
        I hope they don't switch. I think Lightning is a better engineered connector -- it is very durable and attaches much more positively. I am 100% on board with USB-C on computers -- but the use cases that apply to a laptop/desktop are very different than how people use phones.
robomartin 6y ago
Having just devoted about 12 hours to helping my wife migrate to a password manager from an ad-hoc collection of access control approaches (you don't want to know), I emerged horrified by the range and domain of what I can only call incompetence and a total lack of common sense and UI intelligence. I wrote about it here (long post): https://news.ycombinator.com/item?id=24827031 https://news.ycombinator.com/item?id=24827031 I haven't quite processed this entirely yet. Part of me feels one or more adults on the world stage need to get behind what I will call a canonical approach to login, authentication, account recovery, password policies, etc. In some ways I equate this mess to what happened back when fire hydrants were not compatible with every hose coupling fire departments used. In other words, it was a mess and people got hurt. Standardization is good. Or can be good. After this weekend I can't help but think that this is another area where the web needs to seek standardization. I get the feeling that every n-th developer is rolling their own approach and the result is an absolute mess. Not advocating for an Apple solution, just saying that I had a revelation this past weekend and what I learned does not speak kindly of how this important aspect of online life is being handled.
- frenchy 6y ago
  I think a big part of the problem here is that the vast majority of the time, nobody wants to pay for security. The end result is that you end up with 2 kinds of players in this market: - "small" players like Mozzila who don't have a big enough marketing budget or leverage from existing products to drive adoption. - large companies who are willing to throw large sums of money into this with the goal of monopolizing auth, and using that monopoly to manipulate related markets. In the non-Apple cases (Google, Facebook, Microsoft), it also involves collecting data on users for ad targetting.

by blintz 6y ago

rektide 6y ago

I dunno. I mean, I do, it feels good. But it also is a very different kind of FIDO2 than what we've seen before. In a way that FIDO was designed for, that we hoped would happen. But it's still not entirely joy & mirth that we're here for me. It feels like a little like the first day we start to understand how "Big Tent" (in the OpenStack sense) FIDO2 ecosystem is. You can do whatever, make anything, and call it FIDO2; it's all duck typing: looks like a duck, quacks must be a duck. No implementation details are required, no transparency is needed, everything can be totally vendored way way up, and the standard will welcome you. Your platform is welcome here. This post is about how to use & prefer that platform, over the more common means available. For sure this is overwhelmingly a good thing. It's by design that we allow platform authenticators in WebAuthn. Apple is allowing their closed, proprietary security technologies to seamlessly work on the web without making webdevs jump through hoops. It's a good thing, and this will really help Web Authentication for sure. Still I have some wistfulness. It's a good user experience, it's great. It's a win for devs, it's a win for users. Still there's some larger context I can't quite put my finger on, when I see "authenticatorSelection: { authenticatorAttachment: "platform" }". The web is letting more of the native platform shine through, and that's good, but it also forgoes some of the knowability & commonality that resounds on so much of the rest of the web, and while the immediate impact is extremely good, I still think there's some kind of hard to describe ultra-slow-motion civilization-scale loss that's also passenger to this successful commingling of web and platform.

StavrosK 6y ago
So what exactly is the concrete downside here, apart from the icky word "platform", that, in this context, means "a security chip that's not removable", ie as opposed to a Yubikey or such.
- sneak 6y ago
  Websites will, at their option, be able to require Apple hardware to use them.
  - reaperhulk 6y ago
    Attestation has allowed a website to lock to a specific vendor for 5+ years.
  - jrmann100 6y ago
    Last I checked, Windows won't let you use self-signed attestation keys for your homemade devices.
- rektide 6y ago
  perhaps it's a totem, a reminder, that not all tech is interested in working together, that unlike the web itself you are entering an Apple or an Atari or Acorn specific encampment, for some random examples.

yegle 6y ago

"Sign in with Apple" requires a developer account with Apple. Having saw Epic's developer account terminated by Apple, I would definitely stay away from any "Sign in with Apple". (FWIW, the only 2fa with "Sign in with Apple", if you don't own any Apple hardware, is SMS.)

dwaite 6y ago
Apple did not terminate Epic's SiwA account, and several journalists have sources within Apple that say that Apple never sent the message Epic claimed to receive that said access was going away.
- virtue3 6y ago
  https://developer.apple.com/forums/thread/123774 https://developer.apple.com/forums/thread/123774 Not the only ones that randomly gets their accounts terminated. Based on how apple has -insane- fragmentation and security for different aspects of the company, I would doubt any employee that isn't directly tied into the store accounts would know the whole details. (Source: GF worked for the department that did art/design for the apple stores, no one had access to their room, and they had more secure rooms that only a few employees had access to). FWIW google has the same issues. Don't trust a company with an account that you can't get a human on the phone for to review shit.
  - toomuchtodo 6y ago
    I use Sign In with Apple everywhere I can (so many of my passwords are in haveibeenpwned datasets), and if Apple blacklisted a provider I use, I’d expect the service to email me to migrate to their own email/password identity provider (if I didn’t hide my email from them with SIWA), with a link to the migration process in the email.
    - dkonofalski 6y ago
      Same except that, if Apple blacklisted a provider, I'd want to know why they got blacklisted. At this point, I trust Apple as a neutral third party more than I trust most other companies since Apple isn't incentivized to sell my info.

brightball 6y ago

Really excited about this too. When we were adding 2FA options at my company we pushed to use Webauthn instead of just a QR code/OTP approach. News like this where we can tell people "it already works because we made the right decision" is fun.

madeofpalk 6y ago

This doesnt really surprise me - Apple has a history of implementing, or moving to, standards for their platform features in Safari. I think about Apple Pay for web - it started out as a proprietary API, and then the Payment Request API standard was developed and they added support for that. It's in Apple's interest to help develop and support standards like this because they mean more adoption of their platform features.

kinkrtyavimoodh 6y ago
I am still waiting for them to move to USB-C
- hk__2 6y ago
  > I am still waiting for them to move to USB-C What do you mean? All Mac models introduced since 2016 support USB-C. https://support.apple.com/en-us/HT201736 https://support.apple.com/en-us/HT201736
  - chadlavi 6y ago
    Not OC, but they probably mean iPhones. I wish iPhones would switch to USB-C too; my iPhone is now the only device I own that isn't USB-C.
    - jimmydorry 6y ago
      In another generation or two, I would expect it to be port-less (wireless). This generation was the one to change to USB-C if it were on their roadmap... but I guess time will tell.
    - ksec 6y ago
      I would actually pay extra $10 for an Portless iPhone or iPhone without USB-C.
    - kube-system 6y ago
      I hope they don't switch. I think Lightning is a better engineered connector -- it is very durable and attaches much more positively. I am 100% on board with USB-C on computers -- but the use cases that apply to a laptop/desktop are very different than how people use phones.

robomartin 6y ago

Having just devoted about 12 hours to helping my wife migrate to a password manager from an ad-hoc collection of access control approaches (you don't want to know), I emerged horrified by the range and domain of what I can only call incompetence and a total lack of common sense and UI intelligence. I wrote about it here (long post): https://news.ycombinator.com/item?id=24827031 https://news.ycombinator.com/item?id=24827031 I haven't quite processed this entirely yet. Part of me feels one or more adults on the world stage need to get behind what I will call a canonical approach to login, authentication, account recovery, password policies, etc. In some ways I equate this mess to what happened back when fire hydrants were not compatible with every hose coupling fire departments used. In other words, it was a mess and people got hurt. Standardization is good. Or can be good. After this weekend I can't help but think that this is another area where the web needs to seek standardization. I get the feeling that every n-th developer is rolling their own approach and the result is an absolute mess. Not advocating for an Apple solution, just saying that I had a revelation this past weekend and what I learned does not speak kindly of how this important aspect of online life is being handled.

frenchy 6y ago
I think a big part of the problem here is that the vast majority of the time, nobody wants to pay for security. The end result is that you end up with 2 kinds of players in this market: - "small" players like Mozzila who don't have a big enough marketing budget or leverage from existing products to drive adoption. - large companies who are willing to throw large sums of money into this with the goal of monopolizing auth, and using that monopoly to manipulate related markets. In the non-Apple cases (Google, Facebook, Microsoft), it also involves collecting data on users for ad targetting.