Hacker News Reader

Comment by sneak | Hacker News Reader

Where is the U2F/FIDO support? The Mac could be using the T2/Secure Enclave to differentiate massively here - same goes for the iPhone and iOS. (The Pixelbook just enabled built in U2F hardware behind a shell flag.)

TOTP is still vulnerable to phishing. Why Apple has been ignoring this when their biometric products are such a great fit for it is a mystery to me.

View on HN

They are working on it and it can be enabled in the preview release of safari right now.

https://developer.apple.com/safari/technology-preview/releas...

https://bugs.webkit.org/show_bug.cgi?id=181943

It can be enabled in the stable release too.

How? Do you have a link to any info?

1. Open Preferences -> Advanced tab.

2. Enable "Show Develop menu in Menu Bar"

3. Select menu item Develop -> Experimental Features -> Web Authentication

Ah awesome, looks like it's there on iOS too!

The recent Safari Technology Preview builds have support for the WebAuthn Specification, so it's clearly something they're actively working on.

This is still a big bummer for me and why I can't use Safari.

Priorities?

Despite a lot of insistent critics that say otherwise, I believe that one of the world’s richest companies can walk and chew gum at the same time - or just pay someone else to do it. It’s not really an issue of resource constraints; the work could easily happen in parallel.

I just wish someone at Apple cared enough about unfucking web authentication.

There are a ton of reasons why Apple prioritizes what it does, not least of which is available resources. We don't even know what dependencies they may have between their product teams. It's not like Apple is this all seeing entity that commands its team to do as it wishes, at least not at the micro level.

Throwing money at a problem doesn’t guarantee a positive outcome.

Reply on news.ycombinator.com