Comment by vinay_ys | Hacker News Reader

Comment by vinay_ys | Hacker News Reader

Parent Full thread

Most general case consumer explanation is likely this:

No more passwords. Your biometric authentication along with your Apple/Google account on your iPhone/Android phone is all you need.

A more detailed blurb would be:

You sign-up and sign-in to websites/apps simply by responding to a biometric unlock prompt of your phone (same as unlocking your phone with DoubleClick side button + FaceID etc). Your sign-in details are saved to your iCloud / Google account. You can sign-in to the same website/app on another device (iPhone/Mac; or Android/Chrome device) by signing into your cloud account.

For Pro users, there may be more advanced flow:

Instead of using built-in phone authenticators, you may use a reputed third party secure authentication app paired with an external FIDO key (like yubikey) to do the same thing. In it's most secure configuration, it may combine device binding secret unlocked with biometric auth, an physical FIDO key you possess, and a cloud hosted MPC key that is used based on fuzzy signals like your device location and other fingerprint data etc. All this gives you secure multi-factor authentication that is safe against phishing, theft, loss etc.

Stupid question:

How to mitigate loss of phone, lets say on holidays?

Let's take the case of regular consumer with just one smart phone (let's say iPhone) as their only digital device and they don't have another phone/laptop etc. In this case, if the user lost their phone, then recovering access to their digital identity is going to be several steps:

0. First, immediately after they lost their phone, they should call the customer care number and report loss of their phone and get their sim blocked. This is critical to avoid SMS OTP based account hijacking.

1. They will buy a new iPhone and sim and recover their phone number first. (security of this step is a function of how well telcos operate this process. In my country you have to physically go to a telco authorised dealer shop, verify your identity with a government id proof – this is the weakest step and then initiate a lost sim replacement flow. You have to get a new physical sim and then you can change that to an esim if you wish. To avoid rampant hijacking, there is a mandatory waiting/cooloff period with multiple notifications being sent to old sim if it is still active).

2. They will have to recover their iCloud account on to this new phone. This involves the iCloud password, a verification code sent via SMS to your phone and your old device passcode. This will restore your iCloud account and escrowed keychain on the new phone. For this to work, you should have opted into iCloud Keychain backup.

Obviously, the biggest problem here is if you forgot either of the two passwords (iCloud account password and iPhone screen lock passcode). This is quite likely if you have been using FaceID to unlock all the time.

Reply on news.ycombinator.com