You can change a password but you can't change your fingerprint / palm / etc. Am I missing something? How is Face / Touch ID more secure that user + pass? What happens when biometric data is leaked?
the concern isn't what if the biometric data is leaked, because the biometrics are only used to allow local access to your phone. the concern is what if the private keys stored in your phone are leaked. and the secure enclave makes that as close to impossible as any other existing solution.
So, does my iPhone create a private key (which my Face ID data) on the phone itself, then the browser ask the phone to do something to authenticate the user? I am lost here.
See more at https://webauthn.guide/
To log into a website, your iPhone checks to see if your face is your face, and if it is then unlocks your private key to send it to the website. If it can't identify your face, then it won't enter your password.
Sending your actual facial data to a website would be bad because you can't change your face, so if you give your face to one site, then that site could use it to log in as you to other sites. But by just using it to unlock a private key, you (or apple on your behalf) can still change or de-authorize your private key, and use a unique one for each sites. Basically all the good practices you're supposed to follow when you use a password, and they aren't giving any site any special data that they could use anywhere other than their own site.
Your Apple device remembers the association between this particular web site, any user ID the site said is relevant (e.g. maybe the username mrwnmonm and friendly name "Shiny Steve") the cookie, and the private key.
On subsequent visits either of two things can happen:
1. You tap some sort of easy-one-touch login button. The Apple device says "Hey, sign in here as mrwnmonm / Shiny Steve?" and you use your touch ID to prove you are still you, this unlocks the private key, Safari uses the private key to create a proof that you still know that key, attaches the proof, and the cookie. The site recognises you must be Shiny Steve and you're in.
2. You sign in "normally" (e.g. with a username and password) but then as a Second Factor the site shows the Apple Device the cookie it remembers, your device recognises this cookie and prompts you for a touch to prove you are still Shiny Steve, whereupon it uses the private key to sign a proof and send it back to the site.
Because the keys are different on every site even if two web sites deliberately work together to try to figure out if a user on one site is the same person as a user on another site, WebAuthn doesn't help them do that at all.
Also unlike passwords or most other schemes, there's no risk from mass data loss because the web site is storing public information. If a "dump" of every Facebook WebAuthn public key was made, that's essentially useless to everybody except Facebook anyway, whereas obviously a password dump or a dump of all the TOTP secrets would be a huge security problem.
This comment summarizes it all. Thanks very much.
And if you’re targeted by individuals who are sufficiently motivated to steal your biometrics and the physical device, then neither the password nor the biometrics will be enough to protect you.
Because the password that the average user is using is shared among 100 sites and has been leaked 10 times over, and meanwhile there is nobody dusting their leftover coke can for prints.
See: https://www.macrumors.com/2018/12/16/3d-printed-head-android...
If you are worried that someone will kidnap you, take you to a 3-D imaging system, hit you with an amnesiac so you forget that happened, build a mask realistic enough to unlock your iPhone – which that article noted could NOT be done for £300 — and then use that to unlock your devices you have to start by asking why they wouldn’t simply unlock the device when they had enough control over you to run an invasive scan. That’s a movie-plot threat, not something anyone reading this needs to worry about and if they did they should be investing in bodyguards.
Similarly, in the real world you have to make trade-offs. In this case, the alternative is using a password. Those are not only much, much easier to observe with a camera but also open rich new areas for an attacker to try: passwords are generated by normal people so they’re often weak, notoriously reused across multiple sites, and people are convinced by phishers to enter their passwords on the wrong site. Trying to protect against the Hollywood threats makes you more vulnerable to the kinds of things which befall many people on a daily basis.
Article: "I was ushered into a dome-like studio containing 50 cameras [...] The final model took a few days to generate at the cost of just over £300."
I don't how that can be characterized as "easily." Possible, yes, but not easy. And it still didn't fool FaceID.
[0] https://www.technologyreview.com/2020/02/29/905599/how-coron...
[1] https://www.forbes.com/sites/daveywinder/2019/08/10/apples-i...
> 3D Printed Head Fools Android Face Recognition, iPhone X 'Impenetrable'
Like when someone takes your picture? Nothing.