Hacker News Reader

Comment by snarf21 | Hacker News Reader

I wish FIDO was built into the phones (enclave) requiring a biometric and passcode. For 99% of users this would be superior to email/password and get rid of a lot of hacks/phishing. It doesn't require extra hardware to buy and simply requires a minor protocol update to have the challenge on a laptop/desktop show as a QR-code (or could be sent via BT). The mobile sends the response out of band to a destination set at creation.

For users with a greater threat model (worry about enclave being hacked), they can use physical FIDO keys.

View on HN

That is exactly what Safari supports. Safari supports TouchID, FaceID (on iOS), and also supports storing data in a remote device with a QR code.

> I wish FIDO was built into the phones (enclave) requiring a biometric and passcode

Pixel 6 supports this (Titan Security Key built-in) , but only works with Google accounts I think. I hope more phones support this.

Not just Google accounts, most Pixel phones (I think I have a Pixel 2 here) do WebAuthn. I use it for GitHub (occasionally) and my private pastebin setup which is WebAuthn protected for ease of use - and I could use it for Facebook (but I never book faces on my phone) and other services.

One bonus feature does need the Google account. If you're signing into say banana.example with WebAuthn, using Chrome on a PC, and Chrome can't see any FIDO authenticators plugged in, it will try your phone! It asks Google, hey, does this user have a phone (Chrome is signed in to your Google account) ? Google says yeah, they have "amf12's Pixel 6". The Chrome browser uses Bluetooth on the PC to say "Hey, amf12's Pixel 6 are you out there? Can you do WebAuthn?" if your phone hears the Bluetooth message it's like "Hi, amf12's Pixel 6 here. Standing ready to do WebAuthn" and then via the Google servers it's arranged that your login attempt on Chrome, on the PC, is proxied to the phone, where it appears on screen ("Do you want to log in to banana.example as amf12?") and you can OK that from the phone. Nice work flow actually, although the technology is remarkably complicated.

The proposal here is using iCloud Keychain, leveraging the secure enclave. The only catch (for some security-minded, a bit one) is that iCloud Keychain acts similar to a resizable HSM cluster.

This should already be supported on most phones: https://webauthn.me/browser-support

Let me be more specific, this should work in apps not just the browser and should work with my logging into my laptop in the browser and leveraging my phone as a FIDO "key".

> This should work in apps not just the browser

Apple, Google and Microsoft all have native API variants of the Web Authentication API. These typically use entitlements requiring authorization back to a website. This means e.g. a Twitter application could leverage the same authenticator registrations as twitter.com, leveraging both platform and roaming security keys.

>... and should work with my logging into my laptop in the browser and leveraging my phone as a FIDO "key".

The press release details this commitment; for instance, I can use an Android phone to log into a website on my Mac. An example of such an option should be visible on all shipping desktop Chrome browsers if you do a Web Authentication registration or authentication request (I believe unfortunately currently titled something like 'Add an Android phone'). On the Apple side, being able to leverage this is currently sitting behind a developer feature toggle.

One can hope that this will be extended to say the Windows platform itself - at that time, I would expect be able to use my iPhone or Android phone to log into any Windows machine on an AAD-backed domain.

Most iOS and Android devices have support for WebAuthn right now out of the box. Go give it a try.

Reply on news.ycombinator.com