Face ID and Touch ID for the Web
Apple is considering this to be multi-factor authentication all in one click, the something you have (the phone) and the something you are (FaceID or TouchID). For the site perspective, if you ask for attestation then you will have cryptographic evidence of this. No more SMS 2FA!<p>Apple is promising to do something extra with their attestation process which they call &quot;Apple Anonymous Attestation&quot; to mitigate the issue where attestation allows tracking the same device across different websites even if they are using different usernames. Not included in the current release, but &quot;coming soon&quot;.<p>The process of enrolling an authenticator is presented as a &quot;one and done&quot; event, but of course the devil is in the details. Shared accounts would need multiple authenticators, and what happens when you upgrade your phone or lose your phone? I guess this gets handled like a password reset. You probably will want users to be able to add&#x2F;remove authenticators, which means also having to name them.<p>The enrollment process in this video highlights the upgrade path from a password login to a FaceID&#x2F;TouchID login, but doesn&#x27;t give us the UI flow of a new login. It seems like sites would need to implement a standard registration page and then perhaps swap out the password field with a Next button which would prompt for the FaceID&#x2F;TouchID enrollment. Makes me wonder how does this compete with or tie into the &#x27;Signin with Apple&#x27; if a site wants to offer one-click registration?<p>Will my Mac and iOS devices automatically and securely sync the private keys between their respective Secure Enclaves so that I can signin from any of my devices after enrolling on just one?<p>Lastly, how about the case when returning to a site where the user is on their enrolled device, but there isn&#x27;t a cookie present. It looks like the site can detect that the device supports Webauthn, but I&#x27;m not sure if it can automatically detect that the device already has an account enrolled with the site?<p>The call to &#x27;credentials.get&#x27; includes the &#x27;credentialIdBuffer&#x27; which is a value provided by the platform authenticator and saved during registration. But in the video they make it sound like &#x27;credentialIdBuffer&#x27; is actually optional? It&#x27;s not even clear to me in the official WebAuthn spec [1] if this value is required, or if the authenticator will just use the RP domain to present the user a list of available credentials? Ultimately I&#x27;m wondering if a user without a cookie will still have to type in their username before the site can prompt them for FaceID&#x2F;TouchID authentication.<p>[1] - <a href="https:&#x2F;&#x2F;w3c.github.io&#x2F;webauthn&#x2F;#dom-publickeycredentialrequestoptions-allowcredentials" rel="nofollow">https:&#x2F;&#x2F;w3c.github.io&#x2F;webauthn&#x2F;#dom-publickeycredentialreque...</a>