Hacker News Reader

Comment by manmal | Hacker News Reader

Safari seems to have its own implementation of a virtual security key also. Before I plugged in my Yubico recently, Safari asked me for my fingerprint as a fallback.

View on HN

That’s part of WebAuthN[0]. Some services like AWS will not allow virtual U2F keys to be registered, but most places do.

[0] https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent...

Not exactly – WebAuthN is the browser/JavaScript API, which can be provided by both platform authenticators (such as Safari on iOS and macOS, Chrome on Android and macOS etc.) and hardware/"roaming" CTAP2-compliant authenticators.

WebAuthN specifices the browser API, CTAP2 specifies the interface between an authenticator device/software implementation and a browser or other client, and FIDO specifies the behavior of the authenticator itself (including certification of attestation-capable authenticators).

It works for Safari.

For AWS, I use Firefox and a FIDO key, and have a backup MFA as Safari using U2F.

If Secure Enclave is as secure as Apple claims it to be, Safari‘s option might actually be the safest one. Of course you can’t use that on anything other than a Mac or iPhone, so in some situations you need another key.

It's a bit more specific than that, no?

You can't use Safari's option on anything other than that particular Mac or iPhone. It's my understanding that you can't extract the secret key from the secure enclave.

I don't know how this certain feature is implemented. But Pass Keys are synced via iCloud and the private key never leaves any Secure Enclave in unencrypted form. Maybe these virtual security keys are different in that they are never synced via iCloud, but principally they could be.

Reply on news.ycombinator.com