Face ID and Touch ID for the Web

Re:Face ID and Touch ID for the Web by searchableguy on Thursday June 25, 2020 @03:22AM (#23637782)

Can someone explain how does it work behind the scenes?

As I see it, data is stored in a secure enclave separate from the processor and OS. It only provides a match value based on the generated digital private key. So phones will create a separate pair for every site and send the public key with credentials so the server can verify it with the device.

Wouldn't apple have to open source their hardware as well?

[ Parent | on HN ]

Re:Face ID and Touch ID for the Web by lode on Thursday June 25, 2020 @06:11AM (#23638899)

This uses WebAuthn (https://webauthn.guide - https://webauthn.io). The video has a great description starting at 1:40.

Here, the iPhone functions as a platform authenticator, like a U2F usb/nfc key would. Why would they need to open source their hardware for this?

[ Parent | on HN ]

Re:Face ID and Touch ID for the Web by searchableguy on Thursday June 25, 2020 @06:40AM (#23639073)

I was talking about face ID and how apple handles the data using secure enclave.

[ Parent | on HN ]