News for hackers. Stuff that matters.

A comment on Face ID and Touch ID for the Web. Parent comment

Re:Face ID and Touch ID for the Web by blintz on Wednesday June 24, 2020 @03:21PM (#23632621)
Attestation. If a website requests it, the device will provide cryptographic proof that you used a specific vendor’s device to store the resident credential. The proof is a certificate signed with a vendor’s secret attestation key.
[ Parent | on HN ]
Re:Face ID and Touch ID for the Web by Siira on Wednesday June 24, 2020 @03:27PM (#23632707)
Can't the key get stolen if it's on the client?
[ Parent | on HN ]
Re:Face ID and Touch ID for the Web by amluto on Wednesday June 24, 2020 @03:30PM (#23632749)
Yes, but it’s probably stored in the Secure Enclave, so it’ll be hard work.
[ Parent | on HN ]
Re:Face ID and Touch ID for the Web by bfulgham on Wednesday June 24, 2020 @06:51PM (#23634758)
Correct. The key material is stored in the Secure Enclave.
[ Parent | on HN ]