26 ms·

Apple Passkey

817 points by samwillis 4y ago

deleted 4y ago
[deleted]
whoisjohnkid 4y ago
Woah this is awesome. Does anyone know if this is using web authn under the hood? Or is this a new spec? Would love to see Pub/Priv replace passwords
- aseipp 4y ago
  Yes, it uses WebAuthn under the hood. Passkeys have technically been available to developers for a while I think but very experimental still. I guess they've begun hitting new milestones. This is basically the biggest problem with WebAuthn today: the credentials are tied to the browser -- or really whatever application is using WebAuthn, browser or not, name aside -- which means that if you register for a service with Firefox, you have to re-register with Chrome. If the service is designed for it, it might associate multiple public keys to a single "user." So Passkeys are just a pretty natural combination of two things to fix that: "WebAuthn keys, but inside iCloud Keychain." Presumably any apps that integrate with iCloud Keychain can then use them as expected. Of course you can just export the key material, which in a sense is "all" Passkeys are doing: they're a formalization of how to export and manage those keys in keychain. But there are still some major issues: - Enrolling new devices from old ones. This is especially tricky for platform authenticators. For example I register for a website using FaceID on my iPhone, which uses the "platform" authenticator rather than the "cross-platform" authenticator, and now I need to now enroll my Macbook and Windows desktop. They both need new keypairs, because the original account is using a platform authenticator. And the new keypairs might be either platform or cross-platform authenticators. This is especially prevalent on browsers (apps can work around it with a more specific scheme; see below.) - Similarly: cross-platform software for sharing or syncing credentials. Something like 1password but with WebAuthn support for handling those cross-platform webauthn keys. Both of those require a lot of software and decision making to get it all working correctly, both on the side of operators and clients. For example, in your own application (not a browser), you could simply use a platform authenticator like FaceID to read a cross-platform WebAuthn credential from iCloud Keychain, which would avert part of problem 1. But in a browser, mac or iphone users would probably like to use FaceID/TouchID, which are only available as a platform authenticator, so you'd have to handle that case of new enrollment. There are also a million other issues, for example Windows Hello has like a million weird edge cases for how it works in and outside of the browser. macOS seems to be the furthest ahead here with the introduction of Passkeys, and the strong system-wide support for TouchID/FaceID/etc. I do not know what the state of Linux is; presumably you could integrate this with something like gnome-keyring but there's no synchronization service either. So we're still a ways away from actually eliminating passwords. WebAuthn works today but does need a lot of extra oil to make it smooth, and it's still not a primary authentication mechanism unless you're very careful about your userbase. But Passkeys are a good start and will mean you'll need passwords in less apps, and you'll be able to log in securely more quickly. It's a small but needed step.
  - tialaramex 4y ago
    > This is basically the biggest problem with WebAuthn today: the credentials are tied to the browser That's definitely not true. My Feitian ePass for example (very cheap USB dongle that lives with my house keys) works just fine to sign me into GitHub on this desktop PC w/ Firefox on Linux, it works fine via a USB-C to USB-A adaptor to sign in on my Android phone w/ Chrome, and likewise on the Windows laptop I use for work when I needed to access my personal site briefly at Christmas and that was the only laptop I'd brought with me. If you have credentials tied up in some proprietary system then, yeah, they're trapped in there, and in Apple's case they've decided to make it possible to move the credentials to another Apple device via iCloud.
    - floatboth 4y ago
      Yeah, since Apple's (and Google's) soft WebAuthn implementation is designed for syncing across devices, it should also work with many browsers on the same machine.
paxys 4y ago
What standard is this using? The doc doesn't specify.
- samwillis 4y ago
  According to the WWDC Keynote they are working with the FIDO Alliance on it: https://fidoalliance.org/ https://fidoalliance.org/
- scottlu2 4y ago
  Comment from the presentation: “Worked with fido alliance to work across platforms”.
- EtienneK 4y ago
  FIDO2/WebAuthN
- SEJeff 4y ago
  Under the covers, this is webauthn, which is based on FIDO2/U2F. I knew it was webauthn as soon as I read "relying party" and the two keypairs.
deleted 4y ago
[deleted]
elamje 4y ago
A more generalized solution: https://passage.id https://passage.id
hackererror404 4y ago
What happens if you lose your device or it breaks or something? Do you lose access to anything tied to it?
- xmdx 4y ago
  They said in the event that everything is synced on iCloud so all your devices can use the keys, which makes me think no, it's just a password manager, without the password bit. Maybe they create a separate key for each device, but then why mention iCloud syncing at all.
  - howinteresting 4y ago
    It's a password manager with cryptographic vendor lockin. There are definitely some benefits though, such as immunity from phishing. Surely we as the industry can bring them about in a way that doesn't involve cryptographic vendor lockin.
    - vorpalhex 4y ago
      The secrets can be exported - whether or not they will allow that though...
    - altairprime 4y ago
      The industry doesn’t seem to have a working software solution for mobile phone authentication secrets that both is 1) immune to persuading a user to export their data (to get phished), and 2) allows a user to export their data at any time (to prevent lock-in). What would it look like to do #2 safely, without enabling the phishing that we see today with #1?
      - danShumway 4y ago
        I get where you're coming from and you're not wrong, but at the same time, I don't buy this as an excuse for vendor lock-in here, because it seems like Apple is already backing up passkeys to iCloud. If Apple has decided that the risk of getting your passkeys phished out of your Apple iCloud Account is outweighed by the benefit of users being able to restore/sync login details immediately when they buy a new iOS device and log into it, then I think it's reasonable for users to expect the same treatment and the same experience when they're moving away from iOS. If Apple wasn't backing up any of the logins, and they had committed to when you trade in your phone and upgrade to the latest iPhone forcing you to manually re-create all of those keys one-by-one using your recovery option, then I'd accept not having an export option for Android/Linux/Windows. Otherwise, it will just seem really suspiciously convenient to me if they ultimately decide that exporting keys is acceptable risk unless it's to a competitor's device. As far as I can tell, there hasn't been any official confirmation that users won't be able to export them to non-iOS devices, so maybe it's all worry over nothing. But I don't think security is a justification to apply restrictions specifically only on devices outside of Apple's ecosystem.
whiteboardr 4y ago
For context: https://arstechnica.com/information-technology/2022/05/how-apple-google-and-microsoft-will-kill-passwords-and-phishing-in-1-stroke/ https://arstechnica.com/information-technology/2022/05/how-a...
- systemvoltage 4y ago
  > available to the masses in the form of a standard adopted by Apple, Google, and Microsoft that allows for cross-platform and cross-service passkeys. Any way to use this standard if you're not Apple/Google/Microsoft? I'd prefer an option that Apple/Google/Microsoft can call a service (that I control and authorize). I want to be able to self host such a service or have an open marketplace that can compete to serve this service.
  - dane-pgp 4y ago
  - duskwuff 4y ago
    Apple Passkey is an implementation of WebAuthn. It's a feature which their devices support (and will soon be able to synchronize through iCloud), not a service -- there's nothing that needs to be "hosted". https://webauthn.io/ https://webauthn.io/
microtonal 4y ago
Beta support for Passkey is already in the current macOS/iOS releases: https://developer.apple.com/documentation/authenticationservices/public-private_key_authentication/supporting_passkeys https://developer.apple.com/documentation/authenticationserv... I am already using Passkeys on some websites.
- samwillis 4y ago
  Yes, it looks like it’s been around for a couple of months, after a somewhat quiet announcement. It’s the first I had heard of it though.
  - microtonal 4y ago
    There was a WWDC session last year about Passkey: https://developer.apple.com/videos/play/wwdc2021/10106/ https://developer.apple.com/videos/play/wwdc2021/10106/
  - jackson1442 4y ago
    Since Fall 2019 actually! (at least that's when I first used it)
    - microtonal 4y ago
      I think you are confusing this with U2F support using the secure element, which has been added much earlier (I have also been using it for years already). The difference between that and Passkey is that Passkey syncs private keys between Apple devices through iCloud Keychain. The older U2F support is per-device.
- firloop 4y ago
  Yup, I think the bigger announcement today is around it becoming available on non-Apple devices.
- toomuchtodo 4y ago
  Is there a list of web properties that support passkeys?
jjcm 4y ago
They also demoed this working directly in Safari - does anyone know how to support this in languages other than swift/obj-c? Can this be done with js?
- floatboth 4y ago
  As an RP, there is nothing Apple specific for you to do, just WebAuthn.
howinteresting 4y ago
Importantly, if you switch platforms you lose all your auth tokens and have to reauth everywhere. It ultimately is yet another way to do vendor lockin, except it has the FIDO alliance's blessing this time. The competition, password managers like 1password and bitwarden, do not have any sort of vendor lockin. You can freely export your passwords from one manager and into another.
- FollowingTheDao 4y ago
  Oh, I see now. Don't think I will be using it.
- teeray 4y ago
  Plus, password managers have fantastic backwards compatibility even on old, crufty sites that will never be updated. We really should be working to allow better, standardized integration with password managers (communicating password length and alphabet requirements, well-known URIs to do zero-touch credential rotation, etc.) rather than trying to do "Log in with BIGCORP" in another way.
  - realityking 4y ago
    There are some efforts to make things easier for password manager. E.g. differentiation new password, old password and 2FA token fields: https://developer.apple.com/documentation/security/password_autofill/enabling_password_autofill_on_an_html_input_element https://developer.apple.com/documentation/security/password_... I believe some password managers also look at the regex attribute to understand required or disallowed characters. For resetting passwords there‘s at least a way to deep link to the right page: https://web.dev/change-password-url/ https://web.dev/change-password-url/
- Apocryphon 4y ago
  As a long-time Safari user who uses keychain heavily in lieu of 1Password or other managers, I probably will migrate to using Passkey because it sounds pretty seamless. But the lock-in point seems like a founded critique. Does anyone disagree with this claim?
jeroenhd 4y ago
The page doesn't state it explicitly; is this Apple's implementation for FIDO2?
- jdminhbg 4y ago
  The video presentation said it was part of the FIDO standard.
  - jeroenhd 4y ago
    Ah, okay. I'm not interested in Apple's periodic product ads so I didn't really understand why this was linked again, especially since it's been available for a while now.
    - threeseed 4y ago
      It is linked because it was covered in the keynote. And what is new is that it looks to become a widely supported FIDO standard i.e. Google/Microsoft are onboard whereas before it was an iOS/macOS only technology.
      - jeroenhd 4y ago
        Their announcement last month already indicated that it would become widely supported Soon (TM): https://www.apple.com/newsroom/2022/05/apple-google-and-microsoft-commit-to-expanded-support-for-fido-standard/ https://www.apple.com/newsroom/2022/05/apple-google-and-micr... I'm sort of expecting Google to follow suit with the next Android release, and perhaps Microsoft after that when the next iteration of Windows 11 drops (or at the same time, as Microsoft doesn't have a mobile market and relies on Android and iOS integrations).
    - MBCook 4y ago
      It’s been available in beta/nightly form for a little while, I think. But at todays WWDC presentation they announced it as an official complete feature for the next releases of their OSes. (That’s why there is so much Apple stuff, presentation just eneed about 15m ago)
albertgoeswoof 4y ago
Does anyone know if this is different to Webauthn? You can already login with touchid/faceid, with the private key stored in apples keychain. Lots of sites support it, I just added it as 2FA to Mailpace (https://blog.mailpace.com/blog/why-we-use-webauthn-for-2fa/ https://blog.mailpace.com/blog/why-we-use-webauthn-for-2fa/), making it passwordless login instead of 2FA is trivial and fully supported by webauthn. What’s different about this?
- jrockway 4y ago
  Reading the linked page, it certainly looks very similar. I've also implemented WebAuthn from scratch and the term "relying party" is burned into my brain, and this document also uses that term. It's a reasonable term to use in any authentication context, though, so not a smoking gun I guess. WebAuthn continues to work great on iOS and Mac OS, so I'm not sure there's a good reason to add some other new standard. (Though I do have the controversial opinion of wanting Apple to share my credentials between all devices. I have my iPad, iPhone, Macbook, and portable security key all enrolled in SSO. I don't mind this but I feel like it probably hinders adoption over an easily-hackable pasword that you just remember.)
  - tialaramex 4y ago
    Relying Party is the jargon for the entity that gets to rely on the fancy cryptographic technology to determine something that would otherwise be difficult / expensive / unreliable. They're relying on the maths working, and on certain other parties doing their jobs correctly. Everybody here is a Relying Party when they use HTTPS. The Web PKI promises that this is really news.ycombinator.com to you, the HN reader, so long as the math works (RSA, Elliptic Curve Cryptography and likely AES) and so long as your browser vendor did their job, and the Issuing CA (DigiCert) did their job. Relying Parties should ideally know why their trust is well-founded. For example, in the Web PKI examining this cryptography is the job of the Internet Research Task Force (related to the IETF), the browser vendors are responsible to you directly, and the Root CAs are overseen by m.d.s.policy, run by Mozilla on behalf of their users and everybody else's users.
- anony999 4y ago
colemcallister 4y ago
I wonder what this means for services like Plaid and other aggregators. Will apps / websites continue on with standard username/password option?
- vorpalhex 4y ago
  I'm ok if Plaid loses their model.
- samcat116 4y ago
  I feel like a bank implementing this before they did Oauth (the proper way for those sorts of services like Plaud) would be kinda strange.
LunarCamper 4y ago
Does this explain at least some of the Okta drop in share price?
protomyth 4y ago
Unless I can back it up and import it into a new device from a competitor, then there is no way I am going to use this unless forced. I do not trust one company anymore.
- heckyeahs 4y ago
- donarb 4y ago
  There's nothing to backup/import. If you have an iPhone, you use your fingerprint or Face ID. If you sell your iPhone and buy an Android, you use your fingerprint or face recognition on that device.
  - xavdid 4y ago
    I haven't dug into the docs yet, but I don't quite follow this. How does it know that the ex-iPhone owner and current Android owner are the same person (and should have access to the same account)?
    - judge2020 4y ago
      If you did switch ecosystems, you'd probably need to do the whole re-enroll dance on every website that had your previous key. I don't see any sort of passkey backup/import functionality coming anytime soon simply because people don't change ecosystems that often, and those that do can simply keep both their iCloud and Android-based passkeys on services.
      - Mindwipe 4y ago
        I would wager the majority of iPhone users use Windows on their main machines.
        judge2020 4y ago
        Passkey works on non-Apple devices by showing a QR code on that device, having the iPhone scan it, then a BLE connection being established to allow the phone to remotely sign webauthn requests. I only mention ‘switching ecosystems’ in the sense of moving between Apple and Android mobile devices.
zxcvgm 4y ago
This is based on the open standards WebAuthn and FIDO2, where the credentials (“passkeys”) are synced via iCloud Keychain. Currently you need remember to register at least 2 security keys, in case one is lost/misplaced. The syncing of passkeys in iCloud solves this backup problem. https://fidoalliance.org/apple-google-and-microsoft-commit-to-expanded-support-for-fido-standard-to-accelerate-availability-of-passwordless-sign-ins/ https://fidoalliance.org/apple-google-and-microsoft-commit-t...
- gsibble 4y ago
  How will this work on Linux?
  - psanford 4y ago
    FIDO usb devices just use the HID protocol so they work fine on linux. Chrome and Firefox both support them. I wrote a FIDO implementation that protects the signing key using the system's TPM specifically for linux: https://github.com/psanford/tpm-fido https://github.com/psanford/tpm-fido There is no reason why you couldn't implement a similar syncing strategy in a tool like this if you wanted to.
    - balena 4y ago
      Isn't this approach significantly less secure than Apple's though? As far as I understand the secure enclave coprocessor in Apple devices stores key material and implements user verification (TouchID etc.), right? Instead software like tpm-fido bridges (in software) a user verification mechanism (maybe even a fingerprint reader) and the system's TPM. But such a system can be interposed with mere root access, and the TPM tricked in giving out its secrets, no? Please correct me if I'm getting it wrong, but Apple's approach is instead resistant even to full kernel compromise, precisely because the communication between TouchID/FaceID and the secure enclave cannot be interposed. I'm a tpm-fido user myself by the way, thank you psanford!
      - psanford 4y ago
0x0 4y ago
Is this the return of the html tag <keygen> ?
epaulson 4y ago
I can be onboard with this if Apple opens up an iCloud API for syncing, so I can sync a non-Apple device through iCloud, and if I leave Apple and iCloud behind, my non-Apple devices keep working, even if I never sync through iCloud again.
- mceachen 4y ago
  C'mon. Non-Apple devices aren't _even remotely_ a priority for them. Just look how bad Apple Music is on Android and web.
  - eddieroger 4y ago
    I'm going to sound like an Apple apologize, but what's wrong with Apple Music on the web? I just launched it (for the second time in a while), and after signing in, was presented with a familiar looking UI and all my playlists, and was playing searched-for music in under a minute. I know Apple prioritizes their platforms first, but this doesn't seem like an example of Apple failing a competing platform.
  - shralpmeister 4y ago
    The AppleTV app on my LG TV is the best third party app on it, IMO. Looks and works great.
    - corrral 4y ago
      Their Roku and AndroidTV apps are also good. I'm not sure I've ever even used the service on a piece of Apple hardware, and it's never been a problem.
  - nobodywasishere 4y ago
    Apple Music on Android is actually really good, I use it daily. On some level it was a priority for them for market share, to compete with Spotify. I don't see the "competitor" in this space (cloud) though that would drive that necessity.
- stetrain 4y ago
largehotcoffee 4y ago
Thank god the touchbar continues to disappear
- deleted 4y ago
  [deleted]
mhoad 4y ago
How do I leave the Apple ecosystem if I go all in on this? Sounds like major vendor lock in under a deceptive title of “open standards” but I’m hoping I’m wrong here. Does anybody happen to know yet?
- Ajedi32 4y ago
  Yeah, that's going to be the next big ecosystem challenge for WebAuthn in my opinion. Ideally platforms would support 3rd party password managers, so you could manage your keys without having to tie your credential database to any one specific platform. I'm sure as the popularity of WebAuthn grows there'll be more and more demand for cross-platform compatibility until eventually the big players are forced to implement it, but it's going to be kind of rough in the short term until then.
  - ChadNauseam 4y ago
    That would be nice. I used Hanko for one service I built that uses WebAuthn+email, so new devices get a one-time code in their email and existing just use WebAuthn. It would be kind of nice not to have to rely on email, but it's better than making people remember passwords.
  - mhoad 4y ago
    Except Apple are kind of notorious about avoiding cross platform compatibility which is why I ask. Find them hard to trust at this point. I can already hear them making the “we can’t because it will impact users security” argument in my head.
    - stetrain 4y ago
      For normal passwords they currently seem to support third party password managers just fine, including direct integration in Safari and the iOS keyboard. You can also export everything from iCloud Keychain to use with another password manager. They could always use Passkeys as an opportunity to lock things down but it would be in direct contrast to what they have been doing with password management recently.
mwcampbell 4y ago
While we're talking about authentication: Once the user is logged in, how practical is it for native apps on Apple platforms to use something more secure than bearer tokens to authenticate with the service on each request? I'm reminded of https://mjg59.dreamwidth.org/59704.html https://mjg59.dreamwidth.org/59704.html
atonse 4y ago
My wife signed up for calm.com using Sign in with Apple. Thanks to this, I am not able to occasionally use her login to listen to the wonderful music. There's just no way in hell I'm paying the $60 a year or whatever they're asking to listen to a couple songs every now and then. In a normal setting, she'd add her login to her 1password and I'd be able to use Calm.com, and who knows, I would've grown to love it, and gotten myself a second subscription. But since this experience has been so confoundingly annoying, Calm.com won't get a penny from me. (Not even sure I want to blame them... but rather how it's impossible for my wife to just "share" that credential with me even if she wanted to) Not being able to share a certain type of login (for this kind of family sharing scenario) has really soured me on the more personal use cases for these technologies, even though they are really solid from the tech side. Like people often say, most products are competing with Word, Excel, and email, authentication is competing with me just being able to tell a human my username and password. Again, there are many instances where being able to share these credentials seamlessly between non-power users is totally legit. When I sit with my dad to help her log in to his patient portal to get some medical info. Or when my mom wants help to review her Verizon cell phone bill. Or when I get my wife's credentials to cancel a hotel reservation. How are they going to solve the totally legitimate sharing use cases? Using PKI actually gives you a wonderful set of tools to do this (underlying implementation could be that we generate a temp cert that expires in 24 hours, signed by her original credential certificate saying it's a shared credential, etc) I really hope these are the use cases that get more fleshed out before these technologies reach mainstream.
- biztos 4y ago
  Is that not a use-case for Family Sharing? Apple says you can "download content" bought by other family members[0], but I guess this doesn't work for subscriptions? That's a real missed opportunity. I would expect them to at least allow the app developer to opt in to sharing. Selling two licenses into a household has to be pretty rare, whereas having happy-family customers is great word of mouth. "My wife uses FooApp and now I use it too!" [0]: https://support.apple.com/en-us/HT201085 https://support.apple.com/en-us/HT201085
  - zippergz 4y ago
throwaway92394 4y ago
Does anyone know how this/FIDO/Webauthn affect privacy? How well supported are alt accounts? Are they easy to tell they're from the same signer? I figure privacy is fine as long as the implementations allow you to select which account to login with. Is this currently a thing? From everything I read it seems like the current implementations are only meant to support one identity? EDIT: These are great responses, also curious if anyone is aware if Apple's current implementation supports multiple identities?
- blamestross 4y ago
  FIDO/WebauthN are generally "the good guys" when it comes to privacy bc "bring your own secure hardware key" is always an option. I'm kinda torn over the "use your cellphone as a key" approaches as not privacy friendly but we can't actually prevent them (you can always simulate a key).
  - dane-pgp 4y ago
    > you can always simulate a key But you can't simulate an attestation that you're using a device from one of the "approved" manufacturers in the cartel. This is basically DRM for human identity. https://nitter.net/sleevi_/status/1392903827712512001 https://nitter.net/sleevi_/status/1392903827712512001
- jtcasper 4y ago
  FIDO2/WebAuthn don't have anything to do with user management from an application architecture perspective. They leave all the work of combining the attestation credentials and your application's concept of a "user" to the application. This means you can (and should as a designer) have multiple sets of credentials for one "user", multiple distinct credentials that you (the user) can register to multiple separate "user"s in the application, etc. I believe all FIDO2 authenticators (like hardware keys) should generate a new hardware / key ID for each request for pairing a new credential. I know that my key does that, when I was working on implementing WebAuthn for $DAYJOB. https://developers.yubico.com/WebAuthn/ https://developers.yubico.com/WebAuthn/ is a good jumping off point.
- 4y ago
yieldcrv 4y ago
I think we need a browser level or OS level notification about which passwordless service we used last time. Did we use Gmail, Twitter, Signin with Apple, Github, Linkedin, or do I actually have something stored in my password manager associated with an email and if so, did I store it in the browser's password manager, the OS's password manager, or my third party password manager?
- dstroot 4y ago
  Such a great point. I forget all the time. Next auth service I write will remember this for you and prompt you based on the service you used last time. Take my upvote!
- dkonofalski 4y ago
  Why do you use more than one password manager? I have disabled all password managers in every app that I use except for the one I store things in. I have multiple folders with their own passwords too but they're all stored via the same solution.
  - yieldcrv 4y ago
    Because Google Chrome on iOS pops up asking to remember a password Safari on iOS suggests a password even if I'm trying to paste on in from my password manager OSX can be the same way They all sync and I never bothered to disable them because I never thought about it, but sometimes I'm in a rush with a service I think I'll never use again and use the suggested solution in one of the browsers
    - jerf 4y ago
      Unfortunately, and I hate to "victim blame" (though you say you are not yet a victim), I think you have to take some responsibility and use a password manager with deliberation. IMHO the browsers all make this worse by giving you something that seems to work and your first notice that it doesn't anymore is when it stops, which is a terrible way for a security feature to work, but obviously they have incentives to lock you in, and boy oh boy is this one of the biggest ways that a browser can lock you in. I think you should resist sooner rather than later and switch to something cross-browser and third-party. But it's up to you, of course.
gigatexal 4y ago
Any word if something like this can be shared with Bitwarden?
- Rafert 4y ago
  Why not, it seems to be coming to 1Password: https://www.youtube.com/watch?v=lYFxfchhR1g https://www.youtube.com/watch?v=lYFxfchhR1g
pronlover723 4y ago
How does this bode for anonymity and multiple identities? I'm imagining a world where all PCs/Macs/Smartphones have FIDO/WebAuthn and there's no other way to log in. Can I setup up multiple IDs on my iPhone and decide which services get to be associated with which id? I get that supposedly iPhone (etc) will (may?) give out a different number to each service but they'll still be associated with a single account at Apple's level. Further, it's likely these services will ask for more info and Apple will give it to them. As it is I have a different id for almost every service. I'd like to keep it that way.
- psanford 4y ago
  FIDO logins are not shared across relying parties (sites), each site gets its own (that's what makes FIDO phishing proof). If you want a single identity that multiple sites know about you'd, login using a third party identity provider where you'd use your passkey. FIDO2 resident keys do support multiple identities for a single relying party (site).
- dane-pgp 4y ago
  > I'm imagining a world where all PCs/Macs/Smartphones have FIDO/WebAuthn and there's no other way to log in. You won't have to imagine that for long, because that's the world we are sprinting towards. Once practically everyone has accepted and adopted this system, governments (having already banned E2EE messaging apps by this point) will complain that Big Tech are allowing cyber-terrorists to maintain anonymous identities online and not doing enough to protect the children. The offices of Apple, Google, and Microsoft would then receive calls from the national tax/anti-trust authorities saying the government was thinking of launching an audit/investigation into those companies and wouldn't it be a shame if something happened to their profit margin that year. Within a few months we'd see these companies all "voluntarily" release software updates which add a "Citizen ID" field to every FIDO interaction, with those IDs being issued by a government API and verified using a bank card and facial recognition.
  - deleted 4y ago
    [deleted]
gumby 4y ago
Can I use a password manager like 1password it’s FIDO2 the way I currently can in iOS/macOS? iCloud Keychain is the most barebones of password manager
- stetrain 4y ago
  Seems like this will be possible: https://blog.1password.com/1password-is-joining-the-fido-alliance/ https://blog.1password.com/1password-is-joining-the-fido-all...
  - gumby 4y ago
    Excellent. I actually like Apple's practice in this regard: they have a barebones/baseline functionality but allow third parties to provide a value added replacement that can be a first class replacement.* Apple is almost there with mail, addressbook, and calendar but perhaps surprisingly they aren't as seamless as it is with passwords. * For example this allowed me to plug 1password into my parents' phones and computers and use the shared vaults to make sure I could help them get unstuck from various web sites. Plus when they pass on I'll still be able to help the surviving parent to get access to things they need from the other parent's device. The apple one is disabled so they can't even accidentally get something confusingly stored in it.
camkego 4y ago
For those in the know, will I be able to export my private keys and data from Passkey somehow, so that if I wanted to, I could switch to another FIDO device or system? I would speculate Apple is not going to support this, and Apple will retain control of the private keys, and do the request signing like an old-school USB FIDO device, but I don't know for sure.
- stetrain 4y ago
  They allow export of everything else in iCloud keychain so I don’t expect this will be different.
hex9893628af 4y ago
What I would like to know is if this takes off, will I finally be able to use my Yubikey on all the same sites that suppprt Apple Passkey?
- EscargotCult 4y ago
  Probably. Google and GitHub already support WebAuthn for 2FA so it's relatively trivial for them to ditch passwords altogether and use WebAuthn as the single credential.
here4funzies 4y ago
If this is about "[hardware devices] for generating and authenticating accounts" like WebAuthn FIDO et al what happens when I upgrade my Macbook. Do I revert back to password in order to associate the new private key (or hardware generate password) with my existing account?
- stetrain 4y ago
  The keys are synced through iCloud Keychain, presumably also to your new Mac.
tgsovlerkhgsel 4y ago
Hopefully this will be compatible with WebAuthN in practice and encourage web sites to implement it (in a compatible manner). It often does take Apple's heft to force a change across the web. Most importantly, hopefully web sites will implement support for multiple authenticators, so you can actually use this safely without relying on a cloud-synced solution. I hope this pushes out other, less secure and more tedious 2FA methods. However, once it becomes popular, sign in with WebAuthN only will likely not be enough, as attackers learn to attack it (e.g. stealing software-based tokens, adding a cloud-synced device, hijacking already-authenticated sessions from compromised machines)
saos 4y ago
How does this impact 1Password going forward?
- stetrain 4y ago
  1Password is also part of FIDO. I assume if you want to use 1Password on Apple devices to store passkeys that should work fine, just like it does for passwords today. https://blog.1password.com/1password-is-joining-the-fido-alliance/ https://blog.1password.com/1password-is-joining-the-fido-all...
  - Rafert 4y ago
    They've already put this WebAuthn teaser up: https://www.youtube.com/watch?v=lYFxfchhR1g https://www.youtube.com/watch?v=lYFxfchhR1g
dyml 4y ago
This is wonderful news! If anyone is interested in experimenting we built an API that makes it very simple to add WebAuthn (passkeys) to your existing web app. It’s available at https://passwordless.dev https://passwordless.dev Note: We also maintain the open source fido2-net-lib, the API just lowers the friction for devs.
- smorks 4y ago
  i use fido2-net-lib for a personal auth site, it works great! thanks for all your work!
  - dyml 4y ago
    Hey! Happy to hear Making this tech available has been our goal since inception
- dorianmariefr 4y ago
  I've used this gem for rails apps https://github.com/cedarcode/webauthn-ruby https://github.com/cedarcode/webauthn-ruby
- ashtonbaker 4y ago
  This is really cool! And well-timed - I have a project coming up this would be perfect for. The only thing I wonder is, if a user didn’t have biometrics on their device, how would they authenticate? Would I have to maintain a backup system for these users?
  - judge2020 4y ago
    In general they just need _something_. If Windows Hello has even a pin number, Chrome and FF webauthn prompts will use Windows Hello as a TPM provider (assuming the website is using actual Webauthn and not the older U2F-compatible standard, which some sites still use for compatibility, eg google). If they don't have anything, then they will definitely need at least a usb hardware key.
  - dyml 4y ago
acka 4y ago
Sorry for the somewhat but not quite off topic post, but can we please prevent HN from becoming yet another Apple billboard? There are more than enough of those already. Thank you. Yes I've heard that there may be some Apple manifestation going on or something but to have every little Apple tidbit hoisted directly to the front page (at least 7 articles and counting) is a bit much imho. Downvote me if you must, but I think it is important to have my opinion heard, and I don't think I am the only one.
- majewsky 4y ago
  That's just how Apple does their announcements: in big piles at few dates. The alternative would be to dribble them out slowly. As someone who is not particularly interested in Apple news either, I actually prefer this. Better get it out of the way in one fell swoop than have one announcement every other week that dominates the discussion all the time. Things being as they are, there are 3-4 Apple events per year, and so there are 48-49 weeks without big Apple news.
- simplify 4y ago
  This post is related to a large number of developers and startups (read: HN users), many of which have at least an iOS app or support safari. I don't see what the problem is.
  - acka 4y ago
    My reply was not directed at this post in particular, but at the worryingly large number of Apple related posts making it to the front page lately. It makes me worry that HN is becoming biased towards favouring news about Apple's activities above other interesting subjects. Companies release new products all the time, I'm not sure that HN is the proper place to discuss them unless they are truly innovative or newsworthy.
appleaday1 4y ago
So they emphasized that this is going to kill "phishing" I doubt it.
- motohagiography 4y ago
  Phishing is an artifact of stealing and reusing passwords. Even if you need to enter a PIN, there is nothing reusable that you provide to the site you are logging into.
kingcharles 4y ago
Can you use this without biometrics? I don't use biometrics because they are not protected by the Fifth Amendment in the USA.
sholladay 4y ago
What I want is to use the device password instead of biometrics. So the device itself and its TPM are the FIDO authenticator, the thing I have in 2FA terms, and the device password is the thing I know. Personally, I feel I can better protect a password than my fingerprint. But I still want the benefits of 2FA and public key crypto where the app/website doesn’t receive any sensitive information. I’d be okay with pressing a button to prove user presence. I’d avoid syncing the keypairs between devices, instead enrolling a new keypair for each device. I guess that last part could be annoying but it’s pretty much how I use SSH today and it’s not that bad.
- samcat116 4y ago
  That first part is literally how it works. If you have your Mac closed (so you can't access TouchID), it asks for your Mac password.
  - sholladay 4y ago
    I’ll have to try that. Wish there was a way without an external display. I’d like this on my phone, too.
    - samcat116 4y ago
      You can also just not setup touchid or faceid and it’ll use device password/passcode
alerighi 4y ago
I don't get what it's all about this passwordless. I make my browser (Firefox) generate strong password and store them in its password manager, this is synchronized with end to end encryption to all my devices, I have only to remember a master password. It's kind of the same but it works with every website. It is not complicated, doesn't require certificates that you may loose, and that sort of things.
- judge2020 4y ago
  In general "passkey breach" events aren't possible.
- ghughes 4y ago
  The point is to make it harder to export your credentials to another platform. An iOS refugee with a keychain full of passkeys will have to do a password reset for every account, instead of a relatively simple export/import into a third-party password manager.
- sideshownz 4y ago
  Try explaining a password manager to your nana, and having her use it. Then explain to her how she can install it on her phone and have it synchronised across all her devices. Password managers are awesome, but way too technical to become mainstream. You shouldn't have to install 3rd party software for something so fundamental. The password system really needs an overhaul and hopefully this will go along way towards fixing it.
  - makeitdouble 4y ago
    > Try explaining a password manager to your nana It's an interesting issue, and wildly varies depending on who manages her devices. For instance if she has an iPhone with a windows computer, a third party manager brings uniformity to how she deals with login on any device she happens to use. Same if she happens to use a Chromebook. Or even if she uses an older Apple device, I'm assuming passkeys won't come to previous OSes, and upgrading a 2018 MBP just to get passkeys would come with a lot of trade-offs. Perhaps I'm seeing it as, it's already a complex mess already, and Apple didn't come with a silver buller to solve all that complexity in one swoop. PS: password managers are fairly straightforward to explain: it's a digital equivalent of the password notebook they keep in the side drawer
soheil 4y ago
I hope 1password gets annihilated by this move. I really liked what they built but over the past few years they have been very user hostile to ensure their extensions fail the Chrome binary signature. When you build a product that people start relying on it's very much of a dick move to go out of your way and make them not work anymore in hopes that they start dishing out a monthly subscription fee. Imagine if Gmail started charging money to read your email.
- r00fus 4y ago
  I have used 1p for several years now and it works great for e.g. me and my wife, but fails repeatedly for my parents who are just not savvy enough to deal with all the little sharp edges that a password manager can't handle (e.g. over stringent or under stringent password rules, the ability to save in all situations like password reset/update interstitials, etc). I am hoping that if Passkey becomes mainstream they can finally stop pestering me when they hit an edge case. I doubted Apple's touchID and FaceID but honestly, without it my parents would be a lot more vulnerable. My hope is that this gets them to strong auth everywhere instead of really weak passwords.
1f60c 4y ago
I don’t understand how passkeys aren’t stored on external servers and can’t be phished, and yet they sync via iCloud Keychain (which is a nice thing to have). How does that work? Or do you have to trust Apple not to get hacked?
- theluketaylor 4y ago
  It is webauthn under the hood if you want to do further googling. When setting up a credential the secure enclave in your apple device generates a public/private keypair. The public key is sent to the web service for storage and the private key is stored securely and synced between apple devices using end to end encryption. When you want to login the website sends a message to be signed, the apple device prompts for finger or face id to unlock the private key and the message is signed and returned to the website. The website uses the public key to verify only you could have signed the message. If an attacker dumps the website database all they get is a public key which is useless without the private key. It's unphishable since the browser checks the origin hostname before the faceid prompt. Spell-alikes like g00gle.com will prompt for their own unique key that you don't have since it was never created. Apple's security doesn't matter since they never had the private key; it is sent between Apple devices using end to end encryption.
cpressland 4y ago
Could Passkeys ever be used for SSH? I purchased a Yubikey to use as an ed25519-sk key but found the implementation to be too drastic of a change to my workflow to be comfortable with. TouchID / FaceID for SSH would be a totally palatable solution however.
- comex 4y ago
  Interesting question. Though, if you don't specifically need syncing, there are already apps for storing SSH keys in the Secure Enclave, such as Secretive: https://github.com/maxgoedjen/secretive https://github.com/maxgoedjen/secretive
- flxfxp 4y ago
  1Password supports this: https://blog.1password.com/1password-ssh-agent/ https://blog.1password.com/1password-ssh-agent/
jaimex2 4y ago
Whatever happened to the idea of NFC auth rings you wear?
ulfw 4y ago
How do I deal with this when I move from an Apple to a non-Apple device (Android, Chromebook, Linux, Windows, whatever)? With passwords it's straightforward. I just log in.
password4321 4y ago
Several WebAuthn Software authenticators: https://github.com/herrjemand/awesome-webauthn#software-authenticators https://github.com/herrjemand/awesome-webauthn#software-auth... https://news.ycombinator.com/item?id=31272867#31274677 https://news.ycombinator.com/item?id=31272867#31274677 > FIDO security keys that explicitly support backing up and restoring their master secrets?
gingericha 4y ago
Maybe only tangentially related, but does anyone user Apple Keychain as their primary password manager? Is that even a viable option if you're completely within the Apple ecosystem?
- mrsuprawsm 4y ago
  It's definitely a viable option, and probably the simplest/easiest password manager to use if you're only using Apple devices (of course, that is by design).
- ulimn 4y ago
  I mainly use Bitwarden for my passwords, but for things I usually open in Safari (for example food ordering sites which accept Apple Pay) I also save the password in Keychain so it's easier / faster to log in (in case Bitwarden is locked and I would have to unlock it (Face ID) with the app instead of the extension).
- pram 4y ago
  Yes I started using Keychain exclusively after the LastPass app got progressively shittier. No issues so far, and really no differences. Even tells you when something gets compromised.
  - basisword 4y ago
    Any tips on transferring data from e.g. LastPass to Keychain? Also, are you now tied in to Safari on all devices or is it interoperable with other browsers at all?
    - simongr3dal 4y ago
      There’s a csv import and export, it’s supposed to be compatible with things like 1password, chrome and a few others.
      - basisword 4y ago
        I didn't know that was available (I don't think it was last time I checked). Thanks, worked quite well with the exception of a bunch of conflicts it wouldn't import.
weberer 4y ago
>As the authenticator, your Apple device generates a unique public-private key pair for every account it creates on a service. The authenticator retains the private key and shares its public key with the server, known as the relying party. Its about time something like this really took off. Hopefully it will get rid of dumb hacks like text message verification that a lot of companies use. Plus database leaks will no longer be a big deal since they can't really do anything with just a public key.
- native_samples 4y ago
  This was around for a long time in the form of SSL client certs, but that never took off for all sorts of reasons. Presumably Apple nailed the UX problems but the general issue of how to back up your keys, get back access if you lose them, the confusion created by not having passwords etc were real isses.
deleted 4y ago
[deleted]
bergenty 4y ago
throwawaymanbot 4y ago
smcleod 4y ago
I hope they add support for Yubikey integration for iCloud with this.
xtat 4y ago
trust apple? I'll pass

817 points by samwillis 4y ago

deleted 4y ago

[deleted]

Woah this is awesome. Does anyone know if this is using web authn under the hood? Or is this a new spec? Would love to see Pub/Priv replace passwords

aseipp 4y ago
Yes, it uses WebAuthn under the hood. Passkeys have technically been available to developers for a while I think but very experimental still. I guess they've begun hitting new milestones. This is basically the biggest problem with WebAuthn today: the credentials are tied to the browser -- or really whatever application is using WebAuthn, browser or not, name aside -- which means that if you register for a service with Firefox, you have to re-register with Chrome. If the service is designed for it, it might associate multiple public keys to a single "user." So Passkeys are just a pretty natural combination of two things to fix that: "WebAuthn keys, but inside iCloud Keychain." Presumably any apps that integrate with iCloud Keychain can then use them as expected. Of course you can just export the key material, which in a sense is "all" Passkeys are doing: they're a formalization of how to export and manage those keys in keychain. But there are still some major issues: - Enrolling new devices from old ones. This is especially tricky for platform authenticators. For example I register for a website using FaceID on my iPhone, which uses the "platform" authenticator rather than the "cross-platform" authenticator, and now I need to now enroll my Macbook and Windows desktop. They both need new keypairs, because the original account is using a platform authenticator. And the new keypairs might be either platform or cross-platform authenticators. This is especially prevalent on browsers (apps can work around it with a more specific scheme; see below.) - Similarly: cross-platform software for sharing or syncing credentials. Something like 1password but with WebAuthn support for handling those cross-platform webauthn keys. Both of those require a lot of software and decision making to get it all working correctly, both on the side of operators and clients. For example, in your own application (not a browser), you could simply use a platform authenticator like FaceID to read a cross-platform WebAuthn credential from iCloud Keychain, which would avert part of problem 1. But in a browser, mac or iphone users would probably like to use FaceID/TouchID, which are only available as a platform authenticator, so you'd have to handle that case of new enrollment. There are also a million other issues, for example Windows Hello has like a million weird edge cases for how it works in and outside of the browser. macOS seems to be the furthest ahead here with the introduction of Passkeys, and the strong system-wide support for TouchID/FaceID/etc. I do not know what the state of Linux is; presumably you could integrate this with something like gnome-keyring but there's no synchronization service either. So we're still a ways away from actually eliminating passwords. WebAuthn works today but does need a lot of extra oil to make it smooth, and it's still not a primary authentication mechanism unless you're very careful about your userbase. But Passkeys are a good start and will mean you'll need passwords in less apps, and you'll be able to log in securely more quickly. It's a small but needed step.
- tialaramex 4y ago
  > This is basically the biggest problem with WebAuthn today: the credentials are tied to the browser That's definitely not true. My Feitian ePass for example (very cheap USB dongle that lives with my house keys) works just fine to sign me into GitHub on this desktop PC w/ Firefox on Linux, it works fine via a USB-C to USB-A adaptor to sign in on my Android phone w/ Chrome, and likewise on the Windows laptop I use for work when I needed to access my personal site briefly at Christmas and that was the only laptop I'd brought with me. If you have credentials tied up in some proprietary system then, yeah, they're trapped in there, and in Apple's case they've decided to make it possible to move the credentials to another Apple device via iCloud.
  - floatboth 4y ago
    Yeah, since Apple's (and Google's) soft WebAuthn implementation is designed for syncing across devices, it should also work with many browsers on the same machine.

paxys 4y ago

What standard is this using? The doc doesn't specify.

samwillis 4y ago
According to the WWDC Keynote they are working with the FIDO Alliance on it: https://fidoalliance.org/ https://fidoalliance.org/
scottlu2 4y ago
Comment from the presentation: “Worked with fido alliance to work across platforms”.
EtienneK 4y ago
FIDO2/WebAuthN
SEJeff 4y ago
Under the covers, this is webauthn, which is based on FIDO2/U2F. I knew it was webauthn as soon as I read "relying party" and the two keypairs.

deleted 4y ago

[deleted]

elamje 4y ago

A more generalized solution: https://passage.id https://passage.id

hackererror404 4y ago

What happens if you lose your device or it breaks or something? Do you lose access to anything tied to it?

xmdx 4y ago
They said in the event that everything is synced on iCloud so all your devices can use the keys, which makes me think no, it's just a password manager, without the password bit. Maybe they create a separate key for each device, but then why mention iCloud syncing at all.
- howinteresting 4y ago
  It's a password manager with cryptographic vendor lockin. There are definitely some benefits though, such as immunity from phishing. Surely we as the industry can bring them about in a way that doesn't involve cryptographic vendor lockin.
  - vorpalhex 4y ago
    The secrets can be exported - whether or not they will allow that though...
  - altairprime 4y ago
    The industry doesn’t seem to have a working software solution for mobile phone authentication secrets that both is 1) immune to persuading a user to export their data (to get phished), and 2) allows a user to export their data at any time (to prevent lock-in). What would it look like to do #2 safely, without enabling the phishing that we see today with #1?
    - danShumway 4y ago
      I get where you're coming from and you're not wrong, but at the same time, I don't buy this as an excuse for vendor lock-in here, because it seems like Apple is already backing up passkeys to iCloud. If Apple has decided that the risk of getting your passkeys phished out of your Apple iCloud Account is outweighed by the benefit of users being able to restore/sync login details immediately when they buy a new iOS device and log into it, then I think it's reasonable for users to expect the same treatment and the same experience when they're moving away from iOS. If Apple wasn't backing up any of the logins, and they had committed to when you trade in your phone and upgrade to the latest iPhone forcing you to manually re-create all of those keys one-by-one using your recovery option, then I'd accept not having an export option for Android/Linux/Windows. Otherwise, it will just seem really suspiciously convenient to me if they ultimately decide that exporting keys is acceptable risk unless it's to a competitor's device. As far as I can tell, there hasn't been any official confirmation that users won't be able to export them to non-iOS devices, so maybe it's all worry over nothing. But I don't think security is a justification to apply restrictions specifically only on devices outside of Apple's ecosystem.

whiteboardr 4y ago

For context: https://arstechnica.com/information-technology/2022/05/how-apple-google-and-microsoft-will-kill-passwords-and-phishing-in-1-stroke/ https://arstechnica.com/information-technology/2022/05/how-a...

systemvoltage 4y ago
> available to the masses in the form of a standard adopted by Apple, Google, and Microsoft that allows for cross-platform and cross-service passkeys. Any way to use this standard if you're not Apple/Google/Microsoft? I'd prefer an option that Apple/Google/Microsoft can call a service (that I control and authorize). I want to be able to self host such a service or have an open marketplace that can compete to serve this service.
- dane-pgp 4y ago
- duskwuff 4y ago
  Apple Passkey is an implementation of WebAuthn. It's a feature which their devices support (and will soon be able to synchronize through iCloud), not a service -- there's nothing that needs to be "hosted". https://webauthn.io/ https://webauthn.io/

microtonal 4y ago

Beta support for Passkey is already in the current macOS/iOS releases: https://developer.apple.com/documentation/authenticationservices/public-private_key_authentication/supporting_passkeys https://developer.apple.com/documentation/authenticationserv... I am already using Passkeys on some websites.

samwillis 4y ago
Yes, it looks like it’s been around for a couple of months, after a somewhat quiet announcement. It’s the first I had heard of it though.
- microtonal 4y ago
  There was a WWDC session last year about Passkey: https://developer.apple.com/videos/play/wwdc2021/10106/ https://developer.apple.com/videos/play/wwdc2021/10106/
- jackson1442 4y ago
  Since Fall 2019 actually! (at least that's when I first used it)
  - microtonal 4y ago
    I think you are confusing this with U2F support using the secure element, which has been added much earlier (I have also been using it for years already). The difference between that and Passkey is that Passkey syncs private keys between Apple devices through iCloud Keychain. The older U2F support is per-device.
firloop 4y ago
Yup, I think the bigger announcement today is around it becoming available on non-Apple devices.
toomuchtodo 4y ago
Is there a list of web properties that support passkeys?

jjcm 4y ago

They also demoed this working directly in Safari - does anyone know how to support this in languages other than swift/obj-c? Can this be done with js?

floatboth 4y ago
As an RP, there is nothing Apple specific for you to do, just WebAuthn.

howinteresting 4y ago

Importantly, if you switch platforms you lose all your auth tokens and have to reauth everywhere. It ultimately is yet another way to do vendor lockin, except it has the FIDO alliance's blessing this time. The competition, password managers like 1password and bitwarden, do not have any sort of vendor lockin. You can freely export your passwords from one manager and into another.

FollowingTheDao 4y ago
Oh, I see now. Don't think I will be using it.
teeray 4y ago
Plus, password managers have fantastic backwards compatibility even on old, crufty sites that will never be updated. We really should be working to allow better, standardized integration with password managers (communicating password length and alphabet requirements, well-known URIs to do zero-touch credential rotation, etc.) rather than trying to do "Log in with BIGCORP" in another way.
- realityking 4y ago
  There are some efforts to make things easier for password manager. E.g. differentiation new password, old password and 2FA token fields: https://developer.apple.com/documentation/security/password_autofill/enabling_password_autofill_on_an_html_input_element https://developer.apple.com/documentation/security/password_... I believe some password managers also look at the regex attribute to understand required or disallowed characters. For resetting passwords there‘s at least a way to deep link to the right page: https://web.dev/change-password-url/ https://web.dev/change-password-url/
Apocryphon 4y ago
As a long-time Safari user who uses keychain heavily in lieu of 1Password or other managers, I probably will migrate to using Passkey because it sounds pretty seamless. But the lock-in point seems like a founded critique. Does anyone disagree with this claim?

jeroenhd 4y ago

The page doesn't state it explicitly; is this Apple's implementation for FIDO2?

jdminhbg 4y ago
The video presentation said it was part of the FIDO standard.
- jeroenhd 4y ago
  Ah, okay. I'm not interested in Apple's periodic product ads so I didn't really understand why this was linked again, especially since it's been available for a while now.
  - threeseed 4y ago
    It is linked because it was covered in the keynote. And what is new is that it looks to become a widely supported FIDO standard i.e. Google/Microsoft are onboard whereas before it was an iOS/macOS only technology.
    - jeroenhd 4y ago
      Their announcement last month already indicated that it would become widely supported Soon (TM): https://www.apple.com/newsroom/2022/05/apple-google-and-microsoft-commit-to-expanded-support-for-fido-standard/ https://www.apple.com/newsroom/2022/05/apple-google-and-micr... I'm sort of expecting Google to follow suit with the next Android release, and perhaps Microsoft after that when the next iteration of Windows 11 drops (or at the same time, as Microsoft doesn't have a mobile market and relies on Android and iOS integrations).
  - MBCook 4y ago
    It’s been available in beta/nightly form for a little while, I think. But at todays WWDC presentation they announced it as an official complete feature for the next releases of their OSes. (That’s why there is so much Apple stuff, presentation just eneed about 15m ago)

albertgoeswoof 4y ago

Does anyone know if this is different to Webauthn? You can already login with touchid/faceid, with the private key stored in apples keychain. Lots of sites support it, I just added it as 2FA to Mailpace (https://blog.mailpace.com/blog/why-we-use-webauthn-for-2fa/ https://blog.mailpace.com/blog/why-we-use-webauthn-for-2fa/), making it passwordless login instead of 2FA is trivial and fully supported by webauthn. What’s different about this?

jrockway 4y ago
Reading the linked page, it certainly looks very similar. I've also implemented WebAuthn from scratch and the term "relying party" is burned into my brain, and this document also uses that term. It's a reasonable term to use in any authentication context, though, so not a smoking gun I guess. WebAuthn continues to work great on iOS and Mac OS, so I'm not sure there's a good reason to add some other new standard. (Though I do have the controversial opinion of wanting Apple to share my credentials between all devices. I have my iPad, iPhone, Macbook, and portable security key all enrolled in SSO. I don't mind this but I feel like it probably hinders adoption over an easily-hackable pasword that you just remember.)
- tialaramex 4y ago
  Relying Party is the jargon for the entity that gets to rely on the fancy cryptographic technology to determine something that would otherwise be difficult / expensive / unreliable. They're relying on the maths working, and on certain other parties doing their jobs correctly. Everybody here is a Relying Party when they use HTTPS. The Web PKI promises that this is really news.ycombinator.com to you, the HN reader, so long as the math works (RSA, Elliptic Curve Cryptography and likely AES) and so long as your browser vendor did their job, and the Issuing CA (DigiCert) did their job. Relying Parties should ideally know why their trust is well-founded. For example, in the Web PKI examining this cryptography is the job of the Internet Research Task Force (related to the IETF), the browser vendors are responsible to you directly, and the Root CAs are overseen by m.d.s.policy, run by Mozilla on behalf of their users and everybody else's users.
anony999 4y ago

colemcallister 4y ago

I wonder what this means for services like Plaid and other aggregators. Will apps / websites continue on with standard username/password option?

vorpalhex 4y ago
I'm ok if Plaid loses their model.
samcat116 4y ago
I feel like a bank implementing this before they did Oauth (the proper way for those sorts of services like Plaud) would be kinda strange.

LunarCamper 4y ago

Does this explain at least some of the Okta drop in share price?

protomyth 4y ago

Unless I can back it up and import it into a new device from a competitor, then there is no way I am going to use this unless forced. I do not trust one company anymore.

heckyeahs 4y ago
donarb 4y ago
There's nothing to backup/import. If you have an iPhone, you use your fingerprint or Face ID. If you sell your iPhone and buy an Android, you use your fingerprint or face recognition on that device.
- xavdid 4y ago
  I haven't dug into the docs yet, but I don't quite follow this. How does it know that the ex-iPhone owner and current Android owner are the same person (and should have access to the same account)?
  - judge2020 4y ago
    If you did switch ecosystems, you'd probably need to do the whole re-enroll dance on every website that had your previous key. I don't see any sort of passkey backup/import functionality coming anytime soon simply because people don't change ecosystems that often, and those that do can simply keep both their iCloud and Android-based passkeys on services.
    - Mindwipe 4y ago
      I would wager the majority of iPhone users use Windows on their main machines.
      - judge2020 4y ago
        Passkey works on non-Apple devices by showing a QR code on that device, having the iPhone scan it, then a BLE connection being established to allow the phone to remotely sign webauthn requests. I only mention ‘switching ecosystems’ in the sense of moving between Apple and Android mobile devices.

zxcvgm 4y ago

This is based on the open standards WebAuthn and FIDO2, where the credentials (“passkeys”) are synced via iCloud Keychain. Currently you need remember to register at least 2 security keys, in case one is lost/misplaced. The syncing of passkeys in iCloud solves this backup problem. https://fidoalliance.org/apple-google-and-microsoft-commit-to-expanded-support-for-fido-standard-to-accelerate-availability-of-passwordless-sign-ins/ https://fidoalliance.org/apple-google-and-microsoft-commit-t...

gsibble 4y ago
How will this work on Linux?
- psanford 4y ago
  FIDO usb devices just use the HID protocol so they work fine on linux. Chrome and Firefox both support them. I wrote a FIDO implementation that protects the signing key using the system's TPM specifically for linux: https://github.com/psanford/tpm-fido https://github.com/psanford/tpm-fido There is no reason why you couldn't implement a similar syncing strategy in a tool like this if you wanted to.
  - balena 4y ago
    Isn't this approach significantly less secure than Apple's though? As far as I understand the secure enclave coprocessor in Apple devices stores key material and implements user verification (TouchID etc.), right? Instead software like tpm-fido bridges (in software) a user verification mechanism (maybe even a fingerprint reader) and the system's TPM. But such a system can be interposed with mere root access, and the TPM tricked in giving out its secrets, no? Please correct me if I'm getting it wrong, but Apple's approach is instead resistant even to full kernel compromise, precisely because the communication between TouchID/FaceID and the secure enclave cannot be interposed. I'm a tpm-fido user myself by the way, thank you psanford!
    - psanford 4y ago

0x0 4y ago

Is this the return of the html tag <keygen> ?

epaulson 4y ago

I can be onboard with this if Apple opens up an iCloud API for syncing, so I can sync a non-Apple device through iCloud, and if I leave Apple and iCloud behind, my non-Apple devices keep working, even if I never sync through iCloud again.

mceachen 4y ago
C'mon. Non-Apple devices aren't _even remotely_ a priority for them. Just look how bad Apple Music is on Android and web.
- eddieroger 4y ago
  I'm going to sound like an Apple apologize, but what's wrong with Apple Music on the web? I just launched it (for the second time in a while), and after signing in, was presented with a familiar looking UI and all my playlists, and was playing searched-for music in under a minute. I know Apple prioritizes their platforms first, but this doesn't seem like an example of Apple failing a competing platform.
- shralpmeister 4y ago
  The AppleTV app on my LG TV is the best third party app on it, IMO. Looks and works great.
  - corrral 4y ago
    Their Roku and AndroidTV apps are also good. I'm not sure I've ever even used the service on a piece of Apple hardware, and it's never been a problem.
- nobodywasishere 4y ago
  Apple Music on Android is actually really good, I use it daily. On some level it was a priority for them for market share, to compete with Spotify. I don't see the "competitor" in this space (cloud) though that would drive that necessity.
stetrain 4y ago

largehotcoffee 4y ago

Thank god the touchbar continues to disappear

deleted 4y ago
[deleted]

mhoad 4y ago

How do I leave the Apple ecosystem if I go all in on this? Sounds like major vendor lock in under a deceptive title of “open standards” but I’m hoping I’m wrong here. Does anybody happen to know yet?

Ajedi32 4y ago
Yeah, that's going to be the next big ecosystem challenge for WebAuthn in my opinion. Ideally platforms would support 3rd party password managers, so you could manage your keys without having to tie your credential database to any one specific platform. I'm sure as the popularity of WebAuthn grows there'll be more and more demand for cross-platform compatibility until eventually the big players are forced to implement it, but it's going to be kind of rough in the short term until then.
- ChadNauseam 4y ago
  That would be nice. I used Hanko for one service I built that uses WebAuthn+email, so new devices get a one-time code in their email and existing just use WebAuthn. It would be kind of nice not to have to rely on email, but it's better than making people remember passwords.
- mhoad 4y ago
  Except Apple are kind of notorious about avoiding cross platform compatibility which is why I ask. Find them hard to trust at this point. I can already hear them making the “we can’t because it will impact users security” argument in my head.
  - stetrain 4y ago
    For normal passwords they currently seem to support third party password managers just fine, including direct integration in Safari and the iOS keyboard. You can also export everything from iCloud Keychain to use with another password manager. They could always use Passkeys as an opportunity to lock things down but it would be in direct contrast to what they have been doing with password management recently.

mwcampbell 4y ago

While we're talking about authentication: Once the user is logged in, how practical is it for native apps on Apple platforms to use something more secure than bearer tokens to authenticate with the service on each request? I'm reminded of https://mjg59.dreamwidth.org/59704.html https://mjg59.dreamwidth.org/59704.html

atonse 4y ago

My wife signed up for calm.com using Sign in with Apple. Thanks to this, I am not able to occasionally use her login to listen to the wonderful music. There's just no way in hell I'm paying the $60 a year or whatever they're asking to listen to a couple songs every now and then. In a normal setting, she'd add her login to her 1password and I'd be able to use Calm.com, and who knows, I would've grown to love it, and gotten myself a second subscription. But since this experience has been so confoundingly annoying, Calm.com won't get a penny from me. (Not even sure I want to blame them... but rather how it's impossible for my wife to just "share" that credential with me even if she wanted to) Not being able to share a certain type of login (for this kind of family sharing scenario) has really soured me on the more personal use cases for these technologies, even though they are really solid from the tech side. Like people often say, most products are competing with Word, Excel, and email, authentication is competing with me just being able to tell a human my username and password. Again, there are many instances where being able to share these credentials seamlessly between non-power users is totally legit. When I sit with my dad to help her log in to his patient portal to get some medical info. Or when my mom wants help to review her Verizon cell phone bill. Or when I get my wife's credentials to cancel a hotel reservation. How are they going to solve the totally legitimate sharing use cases? Using PKI actually gives you a wonderful set of tools to do this (underlying implementation could be that we generate a temp cert that expires in 24 hours, signed by her original credential certificate saying it's a shared credential, etc) I really hope these are the use cases that get more fleshed out before these technologies reach mainstream.

biztos 4y ago
Is that not a use-case for Family Sharing? Apple says you can "download content" bought by other family members[0], but I guess this doesn't work for subscriptions? That's a real missed opportunity. I would expect them to at least allow the app developer to opt in to sharing. Selling two licenses into a household has to be pretty rare, whereas having happy-family customers is great word of mouth. "My wife uses FooApp and now I use it too!" [0]: https://support.apple.com/en-us/HT201085 https://support.apple.com/en-us/HT201085
- zippergz 4y ago

throwaway92394 4y ago

Does anyone know how this/FIDO/Webauthn affect privacy? How well supported are alt accounts? Are they easy to tell they're from the same signer? I figure privacy is fine as long as the implementations allow you to select which account to login with. Is this currently a thing? From everything I read it seems like the current implementations are only meant to support one identity? EDIT: These are great responses, also curious if anyone is aware if Apple's current implementation supports multiple identities?

blamestross 4y ago
FIDO/WebauthN are generally "the good guys" when it comes to privacy bc "bring your own secure hardware key" is always an option. I'm kinda torn over the "use your cellphone as a key" approaches as not privacy friendly but we can't actually prevent them (you can always simulate a key).
- dane-pgp 4y ago
  > you can always simulate a key But you can't simulate an attestation that you're using a device from one of the "approved" manufacturers in the cartel. This is basically DRM for human identity. https://nitter.net/sleevi_/status/1392903827712512001 https://nitter.net/sleevi_/status/1392903827712512001
jtcasper 4y ago
FIDO2/WebAuthn don't have anything to do with user management from an application architecture perspective. They leave all the work of combining the attestation credentials and your application's concept of a "user" to the application. This means you can (and should as a designer) have multiple sets of credentials for one "user", multiple distinct credentials that you (the user) can register to multiple separate "user"s in the application, etc. I believe all FIDO2 authenticators (like hardware keys) should generate a new hardware / key ID for each request for pairing a new credential. I know that my key does that, when I was working on implementing WebAuthn for $DAYJOB. https://developers.yubico.com/WebAuthn/ https://developers.yubico.com/WebAuthn/ is a good jumping off point.
4y ago

yieldcrv 4y ago

I think we need a browser level or OS level notification about which passwordless service we used last time. Did we use Gmail, Twitter, Signin with Apple, Github, Linkedin, or do I actually have something stored in my password manager associated with an email and if so, did I store it in the browser's password manager, the OS's password manager, or my third party password manager?

dstroot 4y ago
Such a great point. I forget all the time. Next auth service I write will remember this for you and prompt you based on the service you used last time. Take my upvote!
dkonofalski 4y ago
Why do you use more than one password manager? I have disabled all password managers in every app that I use except for the one I store things in. I have multiple folders with their own passwords too but they're all stored via the same solution.
- yieldcrv 4y ago
  Because Google Chrome on iOS pops up asking to remember a password Safari on iOS suggests a password even if I'm trying to paste on in from my password manager OSX can be the same way They all sync and I never bothered to disable them because I never thought about it, but sometimes I'm in a rush with a service I think I'll never use again and use the suggested solution in one of the browsers
  - jerf 4y ago
    Unfortunately, and I hate to "victim blame" (though you say you are not yet a victim), I think you have to take some responsibility and use a password manager with deliberation. IMHO the browsers all make this worse by giving you something that seems to work and your first notice that it doesn't anymore is when it stops, which is a terrible way for a security feature to work, but obviously they have incentives to lock you in, and boy oh boy is this one of the biggest ways that a browser can lock you in. I think you should resist sooner rather than later and switch to something cross-browser and third-party. But it's up to you, of course.

gigatexal 4y ago

Any word if something like this can be shared with Bitwarden?

Rafert 4y ago
Why not, it seems to be coming to 1Password: https://www.youtube.com/watch?v=lYFxfchhR1g https://www.youtube.com/watch?v=lYFxfchhR1g

pronlover723 4y ago

How does this bode for anonymity and multiple identities? I'm imagining a world where all PCs/Macs/Smartphones have FIDO/WebAuthn and there's no other way to log in. Can I setup up multiple IDs on my iPhone and decide which services get to be associated with which id? I get that supposedly iPhone (etc) will (may?) give out a different number to each service but they'll still be associated with a single account at Apple's level. Further, it's likely these services will ask for more info and Apple will give it to them. As it is I have a different id for almost every service. I'd like to keep it that way.

psanford 4y ago
FIDO logins are not shared across relying parties (sites), each site gets its own (that's what makes FIDO phishing proof). If you want a single identity that multiple sites know about you'd, login using a third party identity provider where you'd use your passkey. FIDO2 resident keys do support multiple identities for a single relying party (site).
dane-pgp 4y ago
> I'm imagining a world where all PCs/Macs/Smartphones have FIDO/WebAuthn and there's no other way to log in. You won't have to imagine that for long, because that's the world we are sprinting towards. Once practically everyone has accepted and adopted this system, governments (having already banned E2EE messaging apps by this point) will complain that Big Tech are allowing cyber-terrorists to maintain anonymous identities online and not doing enough to protect the children. The offices of Apple, Google, and Microsoft would then receive calls from the national tax/anti-trust authorities saying the government was thinking of launching an audit/investigation into those companies and wouldn't it be a shame if something happened to their profit margin that year. Within a few months we'd see these companies all "voluntarily" release software updates which add a "Citizen ID" field to every FIDO interaction, with those IDs being issued by a government API and verified using a bank card and facial recognition.
- deleted 4y ago
  [deleted]

gumby 4y ago

Can I use a password manager like 1password it’s FIDO2 the way I currently can in iOS/macOS? iCloud Keychain is the most barebones of password manager

stetrain 4y ago
Seems like this will be possible: https://blog.1password.com/1password-is-joining-the-fido-alliance/ https://blog.1password.com/1password-is-joining-the-fido-all...
- gumby 4y ago
  Excellent. I actually like Apple's practice in this regard: they have a barebones/baseline functionality but allow third parties to provide a value added replacement that can be a first class replacement.* Apple is almost there with mail, addressbook, and calendar but perhaps surprisingly they aren't as seamless as it is with passwords. * For example this allowed me to plug 1password into my parents' phones and computers and use the shared vaults to make sure I could help them get unstuck from various web sites. Plus when they pass on I'll still be able to help the surviving parent to get access to things they need from the other parent's device. The apple one is disabled so they can't even accidentally get something confusingly stored in it.

camkego 4y ago

For those in the know, will I be able to export my private keys and data from Passkey somehow, so that if I wanted to, I could switch to another FIDO device or system? I would speculate Apple is not going to support this, and Apple will retain control of the private keys, and do the request signing like an old-school USB FIDO device, but I don't know for sure.

stetrain 4y ago
They allow export of everything else in iCloud keychain so I don’t expect this will be different.

hex9893628af 4y ago

What I would like to know is if this takes off, will I finally be able to use my Yubikey on all the same sites that suppprt Apple Passkey?

EscargotCult 4y ago
Probably. Google and GitHub already support WebAuthn for 2FA so it's relatively trivial for them to ditch passwords altogether and use WebAuthn as the single credential.

here4funzies 4y ago

If this is about "[hardware devices] for generating and authenticating accounts" like WebAuthn FIDO et al what happens when I upgrade my Macbook. Do I revert back to password in order to associate the new private key (or hardware generate password) with my existing account?

stetrain 4y ago
The keys are synced through iCloud Keychain, presumably also to your new Mac.

tgsovlerkhgsel 4y ago

Hopefully this will be compatible with WebAuthN in practice and encourage web sites to implement it (in a compatible manner). It often does take Apple's heft to force a change across the web. Most importantly, hopefully web sites will implement support for multiple authenticators, so you can actually use this safely without relying on a cloud-synced solution. I hope this pushes out other, less secure and more tedious 2FA methods. However, once it becomes popular, sign in with WebAuthN only will likely not be enough, as attackers learn to attack it (e.g. stealing software-based tokens, adding a cloud-synced device, hijacking already-authenticated sessions from compromised machines)

saos 4y ago

How does this impact 1Password going forward?

stetrain 4y ago
1Password is also part of FIDO. I assume if you want to use 1Password on Apple devices to store passkeys that should work fine, just like it does for passwords today. https://blog.1password.com/1password-is-joining-the-fido-alliance/ https://blog.1password.com/1password-is-joining-the-fido-all...
- Rafert 4y ago
  They've already put this WebAuthn teaser up: https://www.youtube.com/watch?v=lYFxfchhR1g https://www.youtube.com/watch?v=lYFxfchhR1g

dyml 4y ago

This is wonderful news! If anyone is interested in experimenting we built an API that makes it very simple to add WebAuthn (passkeys) to your existing web app. It’s available at https://passwordless.dev https://passwordless.dev Note: We also maintain the open source fido2-net-lib, the API just lowers the friction for devs.

smorks 4y ago
i use fido2-net-lib for a personal auth site, it works great! thanks for all your work!
- dyml 4y ago
  Hey! Happy to hear Making this tech available has been our goal since inception
dorianmariefr 4y ago
I've used this gem for rails apps https://github.com/cedarcode/webauthn-ruby https://github.com/cedarcode/webauthn-ruby
ashtonbaker 4y ago
This is really cool! And well-timed - I have a project coming up this would be perfect for. The only thing I wonder is, if a user didn’t have biometrics on their device, how would they authenticate? Would I have to maintain a backup system for these users?
- judge2020 4y ago
  In general they just need _something_. If Windows Hello has even a pin number, Chrome and FF webauthn prompts will use Windows Hello as a TPM provider (assuming the website is using actual Webauthn and not the older U2F-compatible standard, which some sites still use for compatibility, eg google). If they don't have anything, then they will definitely need at least a usb hardware key.
- dyml 4y ago

acka 4y ago

Sorry for the somewhat but not quite off topic post, but can we please prevent HN from becoming yet another Apple billboard? There are more than enough of those already. Thank you. Yes I've heard that there may be some Apple manifestation going on or something but to have every little Apple tidbit hoisted directly to the front page (at least 7 articles and counting) is a bit much imho. Downvote me if you must, but I think it is important to have my opinion heard, and I don't think I am the only one.

majewsky 4y ago
That's just how Apple does their announcements: in big piles at few dates. The alternative would be to dribble them out slowly. As someone who is not particularly interested in Apple news either, I actually prefer this. Better get it out of the way in one fell swoop than have one announcement every other week that dominates the discussion all the time. Things being as they are, there are 3-4 Apple events per year, and so there are 48-49 weeks without big Apple news.
simplify 4y ago
This post is related to a large number of developers and startups (read: HN users), many of which have at least an iOS app or support safari. I don't see what the problem is.
- acka 4y ago
  My reply was not directed at this post in particular, but at the worryingly large number of Apple related posts making it to the front page lately. It makes me worry that HN is becoming biased towards favouring news about Apple's activities above other interesting subjects. Companies release new products all the time, I'm not sure that HN is the proper place to discuss them unless they are truly innovative or newsworthy.

appleaday1 4y ago

So they emphasized that this is going to kill "phishing" I doubt it.

motohagiography 4y ago
Phishing is an artifact of stealing and reusing passwords. Even if you need to enter a PIN, there is nothing reusable that you provide to the site you are logging into.

kingcharles 4y ago

Can you use this without biometrics? I don't use biometrics because they are not protected by the Fifth Amendment in the USA.

sholladay 4y ago

What I want is to use the device password instead of biometrics. So the device itself and its TPM are the FIDO authenticator, the thing I have in 2FA terms, and the device password is the thing I know. Personally, I feel I can better protect a password than my fingerprint. But I still want the benefits of 2FA and public key crypto where the app/website doesn’t receive any sensitive information. I’d be okay with pressing a button to prove user presence. I’d avoid syncing the keypairs between devices, instead enrolling a new keypair for each device. I guess that last part could be annoying but it’s pretty much how I use SSH today and it’s not that bad.

samcat116 4y ago
That first part is literally how it works. If you have your Mac closed (so you can't access TouchID), it asks for your Mac password.
- sholladay 4y ago
  I’ll have to try that. Wish there was a way without an external display. I’d like this on my phone, too.
  - samcat116 4y ago
    You can also just not setup touchid or faceid and it’ll use device password/passcode

alerighi 4y ago

I don't get what it's all about this passwordless. I make my browser (Firefox) generate strong password and store them in its password manager, this is synchronized with end to end encryption to all my devices, I have only to remember a master password. It's kind of the same but it works with every website. It is not complicated, doesn't require certificates that you may loose, and that sort of things.

judge2020 4y ago
In general "passkey breach" events aren't possible.
ghughes 4y ago
The point is to make it harder to export your credentials to another platform. An iOS refugee with a keychain full of passkeys will have to do a password reset for every account, instead of a relatively simple export/import into a third-party password manager.
sideshownz 4y ago
Try explaining a password manager to your nana, and having her use it. Then explain to her how she can install it on her phone and have it synchronised across all her devices. Password managers are awesome, but way too technical to become mainstream. You shouldn't have to install 3rd party software for something so fundamental. The password system really needs an overhaul and hopefully this will go along way towards fixing it.
- makeitdouble 4y ago
  > Try explaining a password manager to your nana It's an interesting issue, and wildly varies depending on who manages her devices. For instance if she has an iPhone with a windows computer, a third party manager brings uniformity to how she deals with login on any device she happens to use. Same if she happens to use a Chromebook. Or even if she uses an older Apple device, I'm assuming passkeys won't come to previous OSes, and upgrading a 2018 MBP just to get passkeys would come with a lot of trade-offs. Perhaps I'm seeing it as, it's already a complex mess already, and Apple didn't come with a silver buller to solve all that complexity in one swoop. PS: password managers are fairly straightforward to explain: it's a digital equivalent of the password notebook they keep in the side drawer

soheil 4y ago

I hope 1password gets annihilated by this move. I really liked what they built but over the past few years they have been very user hostile to ensure their extensions fail the Chrome binary signature. When you build a product that people start relying on it's very much of a dick move to go out of your way and make them not work anymore in hopes that they start dishing out a monthly subscription fee. Imagine if Gmail started charging money to read your email.

r00fus 4y ago
I have used 1p for several years now and it works great for e.g. me and my wife, but fails repeatedly for my parents who are just not savvy enough to deal with all the little sharp edges that a password manager can't handle (e.g. over stringent or under stringent password rules, the ability to save in all situations like password reset/update interstitials, etc). I am hoping that if Passkey becomes mainstream they can finally stop pestering me when they hit an edge case. I doubted Apple's touchID and FaceID but honestly, without it my parents would be a lot more vulnerable. My hope is that this gets them to strong auth everywhere instead of really weak passwords.

1f60c 4y ago

I don’t understand how passkeys aren’t stored on external servers and can’t be phished, and yet they sync via iCloud Keychain (which is a nice thing to have). How does that work? Or do you have to trust Apple not to get hacked?

theluketaylor 4y ago
It is webauthn under the hood if you want to do further googling. When setting up a credential the secure enclave in your apple device generates a public/private keypair. The public key is sent to the web service for storage and the private key is stored securely and synced between apple devices using end to end encryption. When you want to login the website sends a message to be signed, the apple device prompts for finger or face id to unlock the private key and the message is signed and returned to the website. The website uses the public key to verify only you could have signed the message. If an attacker dumps the website database all they get is a public key which is useless without the private key. It's unphishable since the browser checks the origin hostname before the faceid prompt. Spell-alikes like g00gle.com will prompt for their own unique key that you don't have since it was never created. Apple's security doesn't matter since they never had the private key; it is sent between Apple devices using end to end encryption.

cpressland 4y ago

Could Passkeys ever be used for SSH? I purchased a Yubikey to use as an ed25519-sk key but found the implementation to be too drastic of a change to my workflow to be comfortable with. TouchID / FaceID for SSH would be a totally palatable solution however.

comex 4y ago
Interesting question. Though, if you don't specifically need syncing, there are already apps for storing SSH keys in the Secure Enclave, such as Secretive: https://github.com/maxgoedjen/secretive https://github.com/maxgoedjen/secretive
flxfxp 4y ago
1Password supports this: https://blog.1password.com/1password-ssh-agent/ https://blog.1password.com/1password-ssh-agent/

jaimex2 4y ago

Whatever happened to the idea of NFC auth rings you wear?

ulfw 4y ago

How do I deal with this when I move from an Apple to a non-Apple device (Android, Chromebook, Linux, Windows, whatever)? With passwords it's straightforward. I just log in.

password4321 4y ago

Several WebAuthn Software authenticators: https://github.com/herrjemand/awesome-webauthn#software-authenticators https://github.com/herrjemand/awesome-webauthn#software-auth... https://news.ycombinator.com/item?id=31272867#31274677 https://news.ycombinator.com/item?id=31272867#31274677 > FIDO security keys that explicitly support backing up and restoring their master secrets?

gingericha 4y ago

Maybe only tangentially related, but does anyone user Apple Keychain as their primary password manager? Is that even a viable option if you're completely within the Apple ecosystem?

mrsuprawsm 4y ago
It's definitely a viable option, and probably the simplest/easiest password manager to use if you're only using Apple devices (of course, that is by design).
ulimn 4y ago
I mainly use Bitwarden for my passwords, but for things I usually open in Safari (for example food ordering sites which accept Apple Pay) I also save the password in Keychain so it's easier / faster to log in (in case Bitwarden is locked and I would have to unlock it (Face ID) with the app instead of the extension).
pram 4y ago
Yes I started using Keychain exclusively after the LastPass app got progressively shittier. No issues so far, and really no differences. Even tells you when something gets compromised.
- basisword 4y ago
  Any tips on transferring data from e.g. LastPass to Keychain? Also, are you now tied in to Safari on all devices or is it interoperable with other browsers at all?
  - simongr3dal 4y ago
    There’s a csv import and export, it’s supposed to be compatible with things like 1password, chrome and a few others.
    - basisword 4y ago
      I didn't know that was available (I don't think it was last time I checked). Thanks, worked quite well with the exception of a bunch of conflicts it wouldn't import.

weberer 4y ago

>As the authenticator, your Apple device generates a unique public-private key pair for every account it creates on a service. The authenticator retains the private key and shares its public key with the server, known as the relying party. Its about time something like this really took off. Hopefully it will get rid of dumb hacks like text message verification that a lot of companies use. Plus database leaks will no longer be a big deal since they can't really do anything with just a public key.

native_samples 4y ago
This was around for a long time in the form of SSL client certs, but that never took off for all sorts of reasons. Presumably Apple nailed the UX problems but the general issue of how to back up your keys, get back access if you lose them, the confusion created by not having passwords etc were real isses.

deleted 4y ago

[deleted]

bergenty 4y ago

throwawaymanbot 4y ago

smcleod 4y ago

I hope they add support for Yubikey integration for iCloud with this.

xtat 4y ago

trust apple? I'll pass