News for hackers. Stuff that matters.

A comment on Face ID and Touch ID for the Web. Parent comment

Re:Face ID and Touch ID for the Web by Spivak on Wednesday June 24, 2020 @02:39PM (#23632079)
I don't see how this could ever be something not vendor-specific because without this being tied to "Log in with Apple" you're just saying "trust the client."

Maybe that's fine if all you want is to "lock" a sensitive page to people who aren't the device owner but that's pretty limited compared to FaceID to actually log in.

[ Parent | on HN ]
Re:Face ID and Touch ID for the Web by tialaramex on Wednesday June 24, 2020 @05:09PM (#23633912)
It has no relationship to "Log in with Apple". It's a WebAuthn authenticator.

Almost all web sites should just implement WebAuthn. On a suitable iPhone or Mac users will be able to sign in by touching the sensor or looking at the camera, while on my Pixel phone I touch the fingerprint sensor, on this Linux desktop I touch a Yubico Security Key.

If your site is paranoid that some crazy user will choose a bad WebAuthn authenticator, or deliberately sabotage their own security for some reason, then you can use WebAuthn Attestation to obtain a signed document from the authenticator (yes, over the Web) which proves that it is, for example, an Apple iPhone 25 Super Mega Plus. I don't think you should bother doing that, but you can.

[ Parent | on HN ]