Hacker News Reader

Comment by lifeisstillgood | Hacker News Reader

So roughly speaking this is WebAuthn for a web site, with the iphone acting as the dongle.

It's a really good idea. I can see there being a big demand for just simplifying signin - I can easily see a time where it is worth not having the hassle of managing multiple signin processes and just choosing webauth or nothing.

Edit: to be clear this won't affect B2C sites whose monetisation is based on getting as many people as possible. But imagine a saas business charging upwards of 100 bucks a month - they have something valuable to protect, and the security story just got a lot easier

View on HN

Webauthn actually fully supports this model as "platform authenticators", ie hardware security modules built into the client system. You see this on the windows side too where "Windows Hello" integrates with the TPM and acts as a platform authenticator as well.

No need to speak roughly.

Yup. A site can even say "I want a platform authenticator" or "I specifically don't want a platform authenticator" during registration using the Javascript API.

Most sites should just not care, but it's an option if you've determined there's a specific reason it matters in your application.

> A site can even say "I want a platform authenticator" or "I specifically don't want a platform authenticator" during registration using the Javascript API.

Websites should not depend on JavaScript for something that should be able to be done declaratively.

(Amongst other things - we shouldn't need to use `fetch`/`XMLHttpRequest` when a <form> would work just-as-well - but if only <form> let us use more than just GET and POST, and supported more types of serialization, and supported asynchronous form submission - and bring back <keygen>!).

* you don't need the TPM for Windows Hello to act as your security key. I can't enable BitLocker because there's no TPM yet I have Hello enrolled as a key for GH.

I’m not sure if that makes me happy or sad to hear..

You can use BitLocker with just a password, not sure why you're implying you need a TPM.

https://www.howtogeek.com/237232/what-is-a-tpm-and-why-does-...

And yes, there is a way to use it without a TPM technically, but it's not accessible by the computer's management GUIs, and you need to create custom GPOs and apply them.

Is this how passwords.google.com prompts me with my Android phone lock when I want to access a password in plaintext? I've always wondered that.

I think that's a custom pathway but built on the same primitives. That being said, I'm not 100% on that.

ios/macos already let you copy/paste between them if you have bluetooth enabled on both sides and are signed in the same icloud account on both. I wonder if they're planning to let me authenticate/webauthn on macos using my phone as a platform authenticator?

The magical cross device copy and paste is one of my favorite unsung features.

Unfortunately it’s been a little finicky for me, but when it works, it’s a great tool.

It works 100% of the time when I have both WiFi and Bluetooth on, when do you face problems?

It doesn't work if both devices are connected to different WiFi networks. But Airdrop works without being connected to any AP…

Yes, either you are both connected to the same WiFi network or both of you are not, kind of weird

Possibly - there is functionality to expose an authenticator over bluetooth or NFC, both of which would work for an iPhone or watch to act for an authenticator even into a windows laptop.

There are UX issues there that have to be solved yet. Also, while I haven't gotten my hands deep in what Apple has done yet I suspect this is a browser-level feature and not a platform-level feature, where say your phone would pop up a "do you want to authenticate" screen when held near another computer with BLE the same way you get "do you want to use Apple Pay" today.

Platform level support would allow me to use this directly within other applications and browsers, rather than just from Safari and the SFSafariViewController/ASWebAuthenticationSession Safari-managed views.

Can someone explain how does it work behind the scenes?

As I see it, data is stored in a secure enclave separate from the processor and OS. It only provides a match value based on the generated digital private key. So phones will create a separate pair for every site and send the public key with credentials so the server can verify it with the device.

Wouldn't apple have to open source their hardware as well?

This uses WebAuthn (https://webauthn.guide - https://webauthn.io). The video has a great description starting at 1:40.

Here, the iPhone functions as a platform authenticator, like a U2F usb/nfc key would. Why would they need to open source their hardware for this?

I was talking about face ID and how apple handles the data using secure enclave.

Does this mean integration with SaaS IDPs?

FYI, fingerprint for WebAuthn already worked on Android, I tried it with my pixel phone.

It'd be really nice to see this working with iCloud Keychain at some point too - so you can have FIDO working as a secure platform thing but with syncing and dealing with the problem of effectively losing your keys over time etc

WebAuthn is generally about device authentication with credentials that can’t leave the device, though that could change depending on where and how the hardware gets/stores it’s tokens. Or if you rely on a third-party, like Apple, to store the tokens for you and use OAuth with an mfa indicator in the attestation?

General advice: If worried about losing a device, try to register more than one. Even iCloud Keychain requires other hardware for authentication... same problem applies.

Only way out is having a backup like taking ID to an Apple Store as a way to regain access... that varies right now by provider, but who knows. Maybe Login with Apple will go WebAuthn-compatible in future? (Haven’t watched this video yet.)

If you’re an enterprise and worried about key authenticity or varying WebAuthN standards, you can look for specific types of keys or even request specific serial numbers of FIDO2 dongles from the web browser, etc.

Not really a problem for me - I keep a set of six CTAP2 keys registered on everything with careful labelling etc.

But for normal people, we do need to get more of the balance into the usability side I think. The thing with iCloud Keychain is it can comfortably be recovered without breaking the end-to-end encryption with only a single remaining device, and many Apple users have as many as 3-4 devices in the circle of trust

It seems ideally some kind of "roaming platform" additional option would be good in the webauthn standard

I agree, but it sounds like we’re trying to get the web browser to simplify and implement OAuth2 and OpenID Connect via WebAuthn ... If we already have OpenID Connect, the only advantage to end users under that scenario is a login-with-Apple ease-of-use improvement. Seems more likely that we’ll continue using OAuth2 and OIDC server side for this, for now... but maybe we’ll end up standardizing the ways MFA is requested and presented by providers...

Having WebAuthn work synchronized across devices with iCloud would be technically feasible, but it would not be FIDO certifiable which requires the private keys to stay on device.

Typically deploying WebAuthn means that you have to put more thought into your account recovery flows - you don't want to deploy strong authentication to fall back to email or KBA-based recovery, for example. Then, this recovery may be used both to recover from a lost device as well as to just add a second device.

I can't find docs - but I assume one can authenticate with only their laptop. Most new ones have fingerprint already and likely they will bring FaceID to mac os soon

Is it webauthn or is it once again proprietary tech?

It's webauthn from what I can see.

The video explicitly mentioned it is WebAuthn Platform Authenticator (1:54)[1].

[1]: https://www.w3.org/TR/webauthn/#platform-authenticators

Reply on news.ycombinator.com