Apple allows Touch ID and Face ID to be used in lieu of a password to access sensitive apps like those for banking or password management, and in the future, Face ID and Touch ID will also be able to be used for authentication purposes when logging into a website.
/article-new/2020/06/faceidwebsites.jpg?lossy)
Apple outlines the feature in a WWDC20 engineering session called "Meet Face ID and Touch ID for the web," which covers how web developers can use Face ID and Touch ID on their websites with the Web Authentication API.
An initial login on a website that supports the feature will require a username, passcode, and two-factor authentication code to be entered, but after that, Face ID or Touch ID can handle the login process. Signing in this way will require users to click on the sign in button, after which Safari will ask for confirmation. With the confirmation, a Face ID (or Touch ID) scan is done, and the user is able to log in.
Apple says Face ID and Touch ID authentication is beneficial because it's frictionless, simple, and secure. The online session described it as "phishing resistant."
But more importantly, it is Phishing-resistant. Safari will only allow public credentials created by this API to be used within the Web site they were created, and the credential can never be exported out from the authenticater they were created in as well. This means that once a public credential has been provisioned, there is no way for a user to accidentally divulge it to another party. Cool right?! This is the overview of the Web Authentication standard.
Additional detail about the feature, including instructions on how web developers can enable it, can be found in the full video along with the accompanying resources.
Top Rated Comments
This is already a standard, called FIDO2. If you have non-Apple devices, sites allow multiple keys, or simply forget this and use an external USB/NFC/Bluetooth key.What if you have a non Apple device in your family of Apple devices?
You can’t very easily login there. I hope Apple will work with IEEE to set a standard for this so everyone can participate.
One: it is phising-resistant, two: if the data was intercepted or the other side has a database leak, the information is worthless since it cannot be used for future logins.I don’t really see how this is much more convienient that just using FaceID to grant access to the keychain?
TouchArcade ???so I believe Sign In with Apple creates/connects an account with your Apple ID
This is basically a faster FaceID/TouchArcade reauthentication for your existing accounts.
The video demos it.
arn
I assume autocorrect strikes again.
Did you read the article? It's saying that Apple platforms will act as a built-in FIDO2 authenticator; something that Windows and Android already do today.I know FIDO2, that’s different. It’s basically a hardware token system. It’s not compatible with Sign In with Apple, which is SSO via Apple.
Exactly like Microsoft did, they implemented FIDO2 locked to their own site first, and are now expanding it to other sites.