3 ms·

Isn’t it odd that Apple are not yet selling their own security keys?

by adav 4y ago

CaliforniaKarl 4y ago
It doesn't seem odd to me.
spike021 4y ago
Wouldn't be surprised if they do at some point.
threeseed 4y ago
For 99% of the population the existing approach i.e. verifying on another Apple device is sufficient.
- jeffbee 4y ago
  Or would be, if Apple devices did not routinely prompt you for your password. I find this incredibly annoying since my Apple ID uses one of those long, irregular passwords automatically generated by password managers and in the context where Apple wants your password there's no way to cut and paste it. I can use my phone with touch ID to authorize a $20k purchase but if I want to install a free app from the App Store I need my stupid password. I wonder why they do this.
  - zie 4y ago
    So people don't forget their password and as a liveness check.
    - jeffbee 4y ago
      If they insist on this, I think it would be nice if they rigged their backend to allow me to enter the password from any of my devices. They already allow this from the Apple TV+ app on smart TVs, so the technical precedent exists within Apple.
  - varenc 4y ago
    I haven't had to enter my Apple ID password to install an app since I setup my phone. Just Face ID verification. Maybe you have this setting toggled? https://support.apple.com/en-us/HT204030 https://support.apple.com/en-us/HT204030 Or maybe Apple is just deciding to require it from you for mysterious reasons. Your IP could have a bad reputation and they're not sure if it's you. Though I think they sometimes they require the password just to keep you from forgetting it.
Adraghast 4y ago
My assumption has been that they want your iPhone itself to be your key.
kube-system 4y ago
They’re just integrated into the device. That’s what the Secure Enclave is. https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/web https://support.apple.com/guide/security/secure-enclave-sec5...
madeofpalk 4y ago
Not really. Doesn't seem like much for Apple to add on top. I wouldn't be surprised if Apple starts selling the keys through it's own retail channels.
- brookst 4y ago
  Will be interesting to see. I’m not sure they want to encourage people not already familiar with Yubikeys to use them. Impulse “hey this is cool” purchases might be a huge PITA.
bonestamp2 4y ago
At this time, the market is too small, and Apple can't possibly make their desired margins on them and compete with the others on the market. It's just not worth it.
- fomine3 4y ago
  So it's weird that Google sell their own Titan security key, though their bar is lower than Apple
  - blibble 4y ago
    the Titan keys I have are white-label product made by a Chinese company called Feitian with Google branding slapped on them (of course)
    - ulfw 4y ago
      And most Apple products are made by a Taiwanese company manufacturing in mainland China based on Apple's instructions with Apple branding slapped on them (of course). The difference is just the 'Designed in California' part, which in the case of a security key should be negligible in terms of cost outlay.
      - Someone 4y ago
        The statement was > the Titan keys I have are white-label product made by a Chinese company called Feitian with Google branding slapped on them (of course) ”White label” implies that you can buy the same exact hardware with other branding slapped onto it from other places (https://en.wikipedia.org/wiki/White-label_product https://en.wikipedia.org/wiki/White-label_product) You can’t do that with most Apple products. Even if Apple didn’t design them themselves, you can only buy them from Apple
  - ecesena 4y ago
    It’s for google cloud / enterprise customers.
- 4y ago
Krisjohn 4y ago
They're going with Passkeys.
varenc 4y ago
As others have said, Apple devices can now br passkeys, which is just a new term for WebAuthn + FIDO support. The linked article is about logging into your Apple ID, so you of course want another key for logging into that. But for other sites that support FIDO2+WebAuthn, I believe an Apple device can already function as a security key. Further reading: - Apple's passkey security doc: https://support.apple.com/en-us/HT213305 https://support.apple.com/en-us/HT213305 - I liked this overview of Passkeys vs Yubikeys, but of course it's a bit biased: https://www.yubico.com/blog/a-yubico-faq-about-passkeys/ https://www.yubico.com/blog/a-yubico-faq-about-passkeys/

Isn’t it odd that Apple are not yet selling their own security keys?

by adav 4y ago

Isn’t it odd that Apple are not yet selling their own security keys?

CaliforniaKarl 4y ago

It doesn't seem odd to me.

spike021 4y ago

Wouldn't be surprised if they do at some point.

threeseed 4y ago

For 99% of the population the existing approach i.e. verifying on another Apple device is sufficient.

jeffbee 4y ago
Or would be, if Apple devices did not routinely prompt you for your password. I find this incredibly annoying since my Apple ID uses one of those long, irregular passwords automatically generated by password managers and in the context where Apple wants your password there's no way to cut and paste it. I can use my phone with touch ID to authorize a $20k purchase but if I want to install a free app from the App Store I need my stupid password. I wonder why they do this.
- zie 4y ago
  So people don't forget their password and as a liveness check.
  - jeffbee 4y ago
    If they insist on this, I think it would be nice if they rigged their backend to allow me to enter the password from any of my devices. They already allow this from the Apple TV+ app on smart TVs, so the technical precedent exists within Apple.
- varenc 4y ago
  I haven't had to enter my Apple ID password to install an app since I setup my phone. Just Face ID verification. Maybe you have this setting toggled? https://support.apple.com/en-us/HT204030 https://support.apple.com/en-us/HT204030 Or maybe Apple is just deciding to require it from you for mysterious reasons. Your IP could have a bad reputation and they're not sure if it's you. Though I think they sometimes they require the password just to keep you from forgetting it.

Adraghast 4y ago

My assumption has been that they want your iPhone itself to be your key.

kube-system 4y ago

They’re just integrated into the device. That’s what the Secure Enclave is. https://support.apple.com/guide/security/secure-enclave-sec59b0b31ff/web https://support.apple.com/guide/security/secure-enclave-sec5...

madeofpalk 4y ago

Not really. Doesn't seem like much for Apple to add on top. I wouldn't be surprised if Apple starts selling the keys through it's own retail channels.

brookst 4y ago
Will be interesting to see. I’m not sure they want to encourage people not already familiar with Yubikeys to use them. Impulse “hey this is cool” purchases might be a huge PITA.

bonestamp2 4y ago

At this time, the market is too small, and Apple can't possibly make their desired margins on them and compete with the others on the market. It's just not worth it.

fomine3 4y ago
So it's weird that Google sell their own Titan security key, though their bar is lower than Apple
- blibble 4y ago
  the Titan keys I have are white-label product made by a Chinese company called Feitian with Google branding slapped on them (of course)
  - ulfw 4y ago
    And most Apple products are made by a Taiwanese company manufacturing in mainland China based on Apple's instructions with Apple branding slapped on them (of course). The difference is just the 'Designed in California' part, which in the case of a security key should be negligible in terms of cost outlay.
    - Someone 4y ago
      The statement was > the Titan keys I have are white-label product made by a Chinese company called Feitian with Google branding slapped on them (of course) ”White label” implies that you can buy the same exact hardware with other branding slapped onto it from other places (https://en.wikipedia.org/wiki/White-label_product https://en.wikipedia.org/wiki/White-label_product) You can’t do that with most Apple products. Even if Apple didn’t design them themselves, you can only buy them from Apple
- ecesena 4y ago
  It’s for google cloud / enterprise customers.
4y ago

Krisjohn 4y ago

They're going with Passkeys.

varenc 4y ago

As others have said, Apple devices can now br passkeys, which is just a new term for WebAuthn + FIDO support. The linked article is about logging into your Apple ID, so you of course want another key for logging into that. But for other sites that support FIDO2+WebAuthn, I believe an Apple device can already function as a security key. Further reading: - Apple's passkey security doc: https://support.apple.com/en-us/HT213305 https://support.apple.com/en-us/HT213305 - I liked this overview of Passkeys vs Yubikeys, but of course it's a bit biased: https://www.yubico.com/blog/a-yubico-faq-about-passkeys/ https://www.yubico.com/blog/a-yubico-faq-about-passkeys/