4 ms·

You don't seem to be aware of what is under discussion here. You just raised a huge strawman. Websites are not receiving your biometrics in this context, and y

You don't seem to be aware of what is under discussion here. You just raised a huge strawman. Websites are not receiving your biometrics in this context, and your biometrics would be meaningless to the website if captured and somehow provided. Your biometric signature is stored solely inside the Secure Enclave in the Apple device. If and only if the Secure Enclave recognizes you via your biometrics will the Enclave uses a non-transferrable key stored only in the Enclave to attest to the website that you are the user "JoeAltmaier". - The key is secret. - The key is kept in only one place. - The key can easily be discarded and a new one made. - The key is never given to anything outside of the Enclave, so... I'm not sure how it could be traced to you, besides the whole fact that it is being used to authenticate you, which is necessary. Sounds pretty acceptable to me as a password. The usability issue here is that a website needs to be able to accept a different password from each device you own, since the password is non-transferrable, and you might accidentally drop your iPhone to the bottom of the ocean. Good news: FIDO2 is an entire standard built around this concept, originally intended for use on YubiKeys and similar FIDO2-compliant USB sticks. Apple is building an implementation of FIDO2 that uses the iPhone that's already in the person's hand. If the Secure Enclave is compromised (which does happen sometimes), then Bad Things could happen... but that's also what happens when a password manager tool is compromised.

JoeAltmaier 6y ago
That's sophistry. The fact is, the laptop is 'secured' by biometrics, which can be spoofed. Having a key-to-the-key is not safe if the biometrics are not safe.
- coder543 6y ago
  It is not sophistry, and sophistry is not a word I've ever seen used in a genuine conversation, so I immediately doubt your sincerity in this conversation. If someone wants to fake biometrics on an iPhone, they have a very limited window of time to do so, and the user can lock out the biometrics in less than 3 seconds just by "squeezing" the phone. (power button + either volume key, 2 seconds later the biometrics are locked out.) It's much harder to fake the biometrics in that very brief window of time (maximum 48 hours) than it is to shoulder surf a password. Unless your threat model includes State Level Actors, biometric bypass is a very remote concern. If your threat model includes State Level Actors, you're probably screwed either way, since they can easily afford to shoulder surf you. For everyone else, the main concern is that someone not physically present will manage to acquire your password and log into your services. Passwords suck at this threat model. FIDO2 makes this scenario impossible without that remote person managing to execute a Secure Enclave 0day on your personal device... and even then, it's still way harder than acquiring your password. Not even the website you're authenticating against receives your FIDO2 key... websites always receive your password, which is awful for security. Some related info here: https://news.ycombinator.com/item?id=24830642 https://news.ycombinator.com/item?id=24830642
  - JoeAltmaier 6y ago
    Sure it was - sophistry is pretended an issue is simple by (deliberately) ignoring alternatives. If biometrics are fallible, it matters zero how secure the digital system behind it is. That's obvious, and a comment belaboring the digital security is beside the point. As for how hard to spoof, just google it. There are dozens of folks with techniques and hacks right now. It'll only get worse.
    - coder543 6y ago
      You are the one using sophistry, if anyone is using it. You are completely (and willfully!) ignoring how vulnerable passwords are in any threat model that invalidates a FIDO2 implementation of Face ID. No threat model invalidates the security of Face ID for the Web without similarly invalidating passwords. At least, you have chosen not to present such a threat model, which would help my (apparent) failure of imagination. You cannot protect your passwords from someone who would physically take your iPhone before you can lock it and who would have a life-size reconstruction of your face ready and waiting. Such a person could shoulder surf your passwords with far less effort, or compromise one of the dozens of websites the average user re-uses their passwords on. At a certain point, the person in this threat model will just pull out a wrench and beat you with it until you help them get into your account. https://xkcd.com/538/ https://xkcd.com/538/ If you can show how some random person on the other side of the internet having your fingerprint helps them get into a website using your account... that would be interesting discussion. As it is, they must have physical access to your device. Your biometrics are useless without physical access and rapid action, since the biometrics quickly become useless as the device falls into a state that requires the user's passcode. You're completely ignoring everything I actually said in my comments, so I'm done here.
      - om2 6y ago
        Corroborating you point: Safari on iPhone will autofill passwords with just a biometric, so if you have an unlocked iPhone and a clone of the user's biometric, you can access websites and potentially even change their passwords. If it's timed out or user deliberately disabled the biometric, then you will need the passcode to be able to access anything.
- acdha 6y ago
  That's you not understanding the security model, not sophistry. The application is granting access based on a public-key exchange, which the key stored in a hardware store which cannot be retrieved even in the event of a system-level compromise[1]. The remote application does not see the biometric data or even know that it was involved in the process. It's also important to note that this does not mean anyone who grabs a laptop gets access to everything. The device still uses a password to unlock — you're forced to enter the password on boot before you can use biometrics later — and someone who stole an unlocked laptop could, for most users, have auto-fill supply the passwords _except_ on devices with biometrics which usually require that check every time (as iOS users have been reminded in this year of mask wearing). So let's walk through some common threats: 1. Password re-use: a major source of compromises, blocked by this system 2. Phishing: a major source of compromises, completely blocked by this system 3. Compromised email: also popular, blocked by this system except for the services which allow email-based MFA resets, in which case it'd be the same as a password. 4. Local system compromise (user or root-level): passwords are vulnerable, biometrics present a barrier when the attacker can't just do something like reuse the credentials stored in your browser's cookie store. Biometric data and FIDO keys cannot be extracted. 5. Stolen device, locked: both are probably secure as long as you don't have your password taped on the keyboard 6. Stolen device, unlocked: passwords are vulnerable if you have a password manager which doesn't require e.g. FaceID checks (which is what Safari does on supported devices), FIDO MFA is not usable if Touch ID or Face ID is configured. Biometric data and FIDO keys cannot be extracted. 1. https://support.apple.com/guide/security/secure-enclave-overview-sec59b0b31ff/web https://support.apple.com/guide/security/secure-enclave-over...
RonanTheGrey 6y ago
All that's well and good until companies start implementing their own FaceID then forcing you to use it [0] on the back of trusting Apple, even CALLING it the same thing. This app linked above (my bank) contains NONE of the security you've mentioned above. And, incidentally, for me, biometrics STILL fail every test that matters to me: If I am dead, a bad actor can still gain access to my accounts. With a password, they cannot. [0] https://apps.apple.com/us/app/bbva-m%C3%A9xico-bancomer-m%C3%B3vil/id374824226 https://apps.apple.com/us/app/bbva-m%C3%A9xico-bancomer-m%C3...
- RonanTheGrey 6y ago
  Rather than downvote me for pointing out how companies abuse this, explain how this is an improvement.
  - RonanTheGrey 6y ago
    Lol...
- acdha 6y ago
  > This app linked above (my bank) contains NONE of the security you've mentioned above. This misunderstanding is where you went wrong: your bank doesn’t have a choice about this. If they use FaceID, they don’t have a choice about implementing that - the app can ask it to perform the public-key authentication operation but there’s no way for the developer to choose to weaken the security of the system. Similarly, you should read up about how these systems incorporate liveness checks. A dead body will not pass those and, if you weren’t aware, Apple’s implementation requires a password after a reboot or a small number of failed tries. It’s presumably possible for a well-resourced attacker to bypass those but you’d have to think about how much more vulnerable you are if you use only a password which is much easier for an attacker with that level of resources to capture. If you’re worried about Tom Cruise recording a mask from your still-cooling body, think about how much easier it’d be to get a camera to record you entering it - which you do a lot more in public if you don’t use biometrics - and how trivially this could be done without your knowledge.

JoeAltmaier 6y ago

That's sophistry. The fact is, the laptop is 'secured' by biometrics, which can be spoofed. Having a key-to-the-key is not safe if the biometrics are not safe.

coder543 6y ago
It is not sophistry, and sophistry is not a word I've ever seen used in a genuine conversation, so I immediately doubt your sincerity in this conversation. If someone wants to fake biometrics on an iPhone, they have a very limited window of time to do so, and the user can lock out the biometrics in less than 3 seconds just by "squeezing" the phone. (power button + either volume key, 2 seconds later the biometrics are locked out.) It's much harder to fake the biometrics in that very brief window of time (maximum 48 hours) than it is to shoulder surf a password. Unless your threat model includes State Level Actors, biometric bypass is a very remote concern. If your threat model includes State Level Actors, you're probably screwed either way, since they can easily afford to shoulder surf you. For everyone else, the main concern is that someone not physically present will manage to acquire your password and log into your services. Passwords suck at this threat model. FIDO2 makes this scenario impossible without that remote person managing to execute a Secure Enclave 0day on your personal device... and even then, it's still way harder than acquiring your password. Not even the website you're authenticating against receives your FIDO2 key... websites always receive your password, which is awful for security. Some related info here: https://news.ycombinator.com/item?id=24830642 https://news.ycombinator.com/item?id=24830642
- JoeAltmaier 6y ago
  Sure it was - sophistry is pretended an issue is simple by (deliberately) ignoring alternatives. If biometrics are fallible, it matters zero how secure the digital system behind it is. That's obvious, and a comment belaboring the digital security is beside the point. As for how hard to spoof, just google it. There are dozens of folks with techniques and hacks right now. It'll only get worse.
  - coder543 6y ago
    You are the one using sophistry, if anyone is using it. You are completely (and willfully!) ignoring how vulnerable passwords are in any threat model that invalidates a FIDO2 implementation of Face ID. No threat model invalidates the security of Face ID for the Web without similarly invalidating passwords. At least, you have chosen not to present such a threat model, which would help my (apparent) failure of imagination. You cannot protect your passwords from someone who would physically take your iPhone before you can lock it and who would have a life-size reconstruction of your face ready and waiting. Such a person could shoulder surf your passwords with far less effort, or compromise one of the dozens of websites the average user re-uses their passwords on. At a certain point, the person in this threat model will just pull out a wrench and beat you with it until you help them get into your account. https://xkcd.com/538/ https://xkcd.com/538/ If you can show how some random person on the other side of the internet having your fingerprint helps them get into a website using your account... that would be interesting discussion. As it is, they must have physical access to your device. Your biometrics are useless without physical access and rapid action, since the biometrics quickly become useless as the device falls into a state that requires the user's passcode. You're completely ignoring everything I actually said in my comments, so I'm done here.
    - om2 6y ago
      Corroborating you point: Safari on iPhone will autofill passwords with just a biometric, so if you have an unlocked iPhone and a clone of the user's biometric, you can access websites and potentially even change their passwords. If it's timed out or user deliberately disabled the biometric, then you will need the passcode to be able to access anything.
acdha 6y ago
That's you not understanding the security model, not sophistry. The application is granting access based on a public-key exchange, which the key stored in a hardware store which cannot be retrieved even in the event of a system-level compromise[1]. The remote application does not see the biometric data or even know that it was involved in the process. It's also important to note that this does not mean anyone who grabs a laptop gets access to everything. The device still uses a password to unlock — you're forced to enter the password on boot before you can use biometrics later — and someone who stole an unlocked laptop could, for most users, have auto-fill supply the passwords _except_ on devices with biometrics which usually require that check every time (as iOS users have been reminded in this year of mask wearing). So let's walk through some common threats: 1. Password re-use: a major source of compromises, blocked by this system 2. Phishing: a major source of compromises, completely blocked by this system 3. Compromised email: also popular, blocked by this system except for the services which allow email-based MFA resets, in which case it'd be the same as a password. 4. Local system compromise (user or root-level): passwords are vulnerable, biometrics present a barrier when the attacker can't just do something like reuse the credentials stored in your browser's cookie store. Biometric data and FIDO keys cannot be extracted. 5. Stolen device, locked: both are probably secure as long as you don't have your password taped on the keyboard 6. Stolen device, unlocked: passwords are vulnerable if you have a password manager which doesn't require e.g. FaceID checks (which is what Safari does on supported devices), FIDO MFA is not usable if Touch ID or Face ID is configured. Biometric data and FIDO keys cannot be extracted. 1. https://support.apple.com/guide/security/secure-enclave-overview-sec59b0b31ff/web https://support.apple.com/guide/security/secure-enclave-over...

RonanTheGrey 6y ago

All that's well and good until companies start implementing their own FaceID then forcing you to use it [0] on the back of trusting Apple, even CALLING it the same thing. This app linked above (my bank) contains NONE of the security you've mentioned above. And, incidentally, for me, biometrics STILL fail every test that matters to me: If I am dead, a bad actor can still gain access to my accounts. With a password, they cannot. [0] https://apps.apple.com/us/app/bbva-m%C3%A9xico-bancomer-m%C3%B3vil/id374824226 https://apps.apple.com/us/app/bbva-m%C3%A9xico-bancomer-m%C3...

RonanTheGrey 6y ago
Rather than downvote me for pointing out how companies abuse this, explain how this is an improvement.
- RonanTheGrey 6y ago
  Lol...
acdha 6y ago
> This app linked above (my bank) contains NONE of the security you've mentioned above. This misunderstanding is where you went wrong: your bank doesn’t have a choice about this. If they use FaceID, they don’t have a choice about implementing that - the app can ask it to perform the public-key authentication operation but there’s no way for the developer to choose to weaken the security of the system. Similarly, you should read up about how these systems incorporate liveness checks. A dead body will not pass those and, if you weren’t aware, Apple’s implementation requires a password after a reboot or a small number of failed tries. It’s presumably possible for a well-resourced attacker to bypass those but you’d have to think about how much more vulnerable you are if you use only a password which is much easier for an attacker with that level of resources to capture. If you’re worried about Tom Cruise recording a mask from your still-cooling body, think about how much easier it’d be to get a camera to record you entering it - which you do a lot more in public if you don’t use biometrics - and how trivially this could be done without your knowledge.