Apple wants to replace all passwords with biometrics

[Hydrogen]

Apple’s iOS 16 and macOS Ventura will introduce passwordless login for apps and websites. It’s only the beginning.

YOUR PASSWORDS ARE terrible. Year after year, the most popular passwords leaked in data breaches are 123456, 123456789, and 12345—‘qwerty’ and ‘password’ come close behind—and using these weak passwords leaves you vulnerable to all sorts of hacking. Weak and repeated passwords are one of the most significant risks to your online life.

For years, we’ve been promised a more secure, password-free future, but it seems like 2022 will actually be the year that millions of people start to move away from passwords. At Apple’s Worldwide Developer Conference yesterday, the company announced it will launch passwordless logins across Macs, iPhones, iPads, and Apple TVs around September of this year. Instead of using passwords, you will be able to log in to websites and apps using “Passkeys” with iOS 16 and macOS Ventura. It’s the first major real-world shift to password elimination.

So how does it work? Passkeys replace your tired old passwords by creating new digital keys using Touch ID or Face ID, Apple’s vice president of internet technologies, Darin Adler, explained at WWDC. When you are creating an online account with a website, you can use a Passkey instead of a password. “To create a Passkey, just use Touch ID or Face ID to authenticate, and you’re done,” Adler said.

When you go to log in to that website again, Passkeys allow you to prove who you are by using your biometrics rather than typing in a passphrase (or having your password manager enter it for you). When signing in to a website on a Mac, a prompt will appear on your iPhone or iPad to verify your identity. Apple says its Passkeys will sync across your devices using iCloud’s Keychain, and the Passkeys are stored on your devices rather than on servers. (The use of iCloud Keychain should also solve the problem of losing or breaking your linked devices.) Under the hood, Apple’s Passkeys are based on the Web Authentication API (WebAuthn) and are end-to-end encrypted so nobody can read them, including Apple. The system for creating Passkeys uses public-private key authentication to prove you are who you say you are.

A passwordless system would be a significant step forward for most people’s online security. As well as eliminating guessable passwords, removing passwords reduces the likelihood of successful phishing attacks. And passwords can’t be stolen in data breaches if they don't exist in the first place. (Some apps and websites already allow people to log in using their fingerprints or using face recognition, but these usually require you to first create an account with a password.)

Apple’s Passkeys aren’t entirely new—the company first detailed them at 2021’s WWDC and started testing them shortly after—and Apple isn’t the only one that wants to eliminate passwords. The FIDO Alliance, a tech industry group, has been working on the underlying standards needed to ditch passwords for almost a decade, and Apple’s Passkeys are the company’s implementation of these standards.

In recent months, FIDO has taken a series of important steps to bring the password’s demise closer to reality. In March, FIDO announced it has figured out a way to store the cryptographic keys that sync between people’s devices, calling them “multi-device FIDO credentials” or “passkeys.”

This was followed in May by Apple, Microsoft, and Google declaring their support for the FIDO standards. Jen Easterly, the director of the US Cybersecurity and Infrastructure Security Agency, said adoption of the standards would keep more people safe online. At the time, the three tech giants said they would start rolling out the technology “over the course of the coming year.” Microsoft account owners have been able to ditch their passwords since September of last year, and Google has been working on its passwordless technology since 2008.

When all the tech companies have rolled out their version of passkeys, it should be possible for the system to work across different devices—in theory, you could use your iPhone to log in to a Windows laptop, or an Android tablet to log in to a website in Microsoft’s Edge Browser. “All of FIDO’s specs have been developed collaboratively, with inputs from hundreds of companies,” says Andrew Shikiar, the executive director of the FIDO Alliance. Shikiar confirms that Apple is the first company to start rolling out passkey-style technology and says this shows “how tangible this approach will soon be for consumers worldwide.”

Any success for a passwordless future depends on how it works in reality. At the moment, there are unanswered questions about what happens to your Passkeys if you want to ditch Apple’s ecosystem for Android or another platform. (Apple hasn’t yet responded to our request for comment.) And developers still need to implement changes to their apps and websites to work with Passkey. Plus, to gain trust in any system, people need to be educated about how it works. “Any viable solution must be safer, easier, and faster than the passwords and legacy multi-factor authentication methods used today,” ​​Alex Simons, the head of Microsoft’s identity management efforts, said in May. In short: If cross-device systems are clunky or a pain to use, people may shun them in favor of weak but convenient passwords.

While Apple’s Passkey and Google and Microsoft’s equivalents are still some months away (at the very least), that doesn’t mean you should idly keep using your weak or repeated passwords. Every password you use—whether it’s for a one-time account used to buy DIY supplies or your Facebook account—should be strong and unique. Don’t use common phrases, names of friends or pets, or personal information linked to you in your passwords.

Instead, your passwords should be long and strong. The best way to achieve this is by using a password manager, which can help you create and store better passwords. You can find our pick of the best password managers here. And while you’re thinking about your security, turn on multi-factor authentication for as many accounts as possible.


https://www.wired.com/story/apple-passkeys-password-ios16-ventura/

....


Apple wants to replace passwords with facial recognition and fingerprint derived passcodes.

One of bitcoin's biggest selling points was it catering to a claimed 4 billion unbanked demographic around the world.

Apple's shift towards biometric based passcodes trends in the opposite direction. It limits their userbase by hardware support. Fewer end users have facial or fingerprint recognition to support the system.

Over the years there have been many successful attempts to fool fingerprint scanners. Biometrics certainly are not foolproof or hack proof.

Does anyone think this will succeed?

[1714870482]

1714870482

[1714870482]

1714870482

[BitMaxz]

This should succeed in the future since this is the only solution to secure accounts compared to using a password that is vulnerable to any attacks like phishing, brute-force attacks and etc...

Biometrics is already been tested for many years not just on Apple devices but also on Android devices. I have my phone not apple but Samsung the Iris scanner for my pattern or passwords looks the best Biometrics that I have ever experienced.
 
But I hope they don't totally remove the password login because if the owner or a user accidentally has a broken/missing finger or had scars on their face they can't easily access their account and it may become an unrecoverable account.

So owners/users should still have an alternative way to log in like passwords or recovery seed for emergency cases.

[jackg]

I wonder how they plan to make the system secure against malware and similar attacks. I'd assume maybe a separate chip would be the best way to go with this but that might eat into their profits so they'll probably find a way that's less secure but still robust against attackers (eg a space away from where a normal user or app would be able to access).

I'd be surprised if this hasn't already been attempted or already been done with this already, I think this technology could be made more secure if an nfc card was also used to offer an extra key to decrypt the password database (eg the main encryption key as you won't get much with that alone - they can also likely already be made more secure as bank cards have already had to be).

[Hispo]

Despite of biometrics solutions being better than passwords, they are still vulnerable to theft of data, the biometric information can be stolen.
I'd rather an approach where people started to use universal small cryptographic devices which would work in a similar way Trezor T does to login through U2F, maybe even combine both approaches to harden the security of the accounts.

It also worries me the fact that biometric data is far more sensible than passwords. If someone gets a password leaked they will have problems with one account or one of many services, on the other hand, getting one's biometric data leaked means one cant use the same data anymore to access a service (not mentioning that data also has legal implications: passports, ID's, documents, Ect.).

In the end, we can change our passwords but we cannot change our fingerprints, our iris or face so easily...

[Wexnident]

This technically combats methods to crack passwords such as Bruteforcing, Rainbowattacks, and methods similar to it, but I don't think it prevents phishing/malware. From what I read said passkeys would store the biometric data in the devices themselves and not a server, so hackers can technically get said data right? I guess the idea is worth it if it prevents part of the methods that are used to steal the passwords of others but I think new issues are created like others have said which is you can't exactly change your biometrics.

[Rikafip]

Does anyone think this will succeed?

Yeah it probably will as users will always go for more convenient option, not thinking about the consequences.

One suggestion: no need to copy/paste the whole article, few paragraphs that cover what it is about should be enough and then those who want to read the rest can do it at the source.

This should succeed in the future since this is the only solution to secure accounts compared to using a password that is vulnerable to any attacks like phishing, brute-force attacks and etc...

Biometrics verification also has its own set of the problems and its far from being perfect. For me personally password protection is still the way to go, and if set properly (saomething that many fail at but that's not password problem)it is still superior to biometrics in vast majority of cases.

If someone gets a password leaked they will have problems with one account or one of many services, on the other hand, getting one's biometric data leaked means one cant use the same data anymore to access a service (not mentioning that data also has legal implications: passports, ID's, documents, Ect.).

Yep, that's my main problem when it comes to biometrics as once you get your data leaked you are screwed. And we all know how secure our data is...

[The Sceptical Chymist]

If someone gets a password leaked they will have problems with one account or one of many services, on the other hand, getting one's biometric data leaked means one cant use the same data anymore to access a service (not mentioning that data also has legal implications: passports, ID's, documents, Ect.).

Yep, that's my main problem when it comes to biometrics as once you get your data leaked you are screwed. And we all know how secure out data is...

Not being as tech-savvy as the rest of y'all, that wasn't my main problem with this.  I don't like biometric data being in the hands of big tech companies, because I don't trust who they're going to share that data with.  In fact, I don't trust big tech companies as a general principle (though unfortunately I'm in an abusive relationship with them that I can't seem to get out of).

The article cites the fact that many people are using passwords like "123456" and so forth.  I'm not sure if that's an argument for the implementation of biometric "passwords" as much as it is for educating people on using stronger passwords and just being more mindful of their online security in general.  But I swear, if this becomes the industry standard, you'll be seeing me in 2040 using a smartphone from 2022--and hopefully living in my campaign farm castle in utopia somewhere where the weather is nice and the women abound.  Lol.

[NeuroticFish]

Does anyone think this will succeed?

I don't see any reason why this would not succeed. I completely agree that the security of smartphones is a joke anyway. Also most users are lazy and biometrics fit just fine to their needs.
The only question is if they can make biometrics reliable enough in all the versions they'll make. Since if at some point those won't work, they'll suddenly have a huge lot of angry customers.
What I mean is that it's not uncommon that on cheaper (and somewhat older?) Android phones fingerprint just fails to recognize you 7 of 10 times. Apple will not afford this kind of failures.

[Ahli38]

Apple’s iOS 16 and macOS Ventura will introduce passwordless login for apps and websites. It’s only the beginning.

YOUR PASSWORDS ARE terrible. Year after year, the most popular passwords leaked in data breaches are 123456, 123456789, and 12345—‘qwerty’ and ‘password’ come close behind—and using these weak passwords leaves you vulnerable to all sorts of hacking. Weak and repeated passwords are one of the most significant risks to your online life.

the underlined reason I think it contains a question mark. passwords store our personal data. submitting biometrics is the same as submitting our biometric data / personal data as well.
however i feel this is tantamount to giving kyc all the time.

This is tantamount to handing over our biometric data to the company. because as far as I know these biometrics include things like

1. fingerprint
2. face scanner.
3. retina scanner.
4. iris scanner.
5. Voice Recognition .

I feel like I'll actually have wild thoughts and full of fear when I have to hand over my body data like that. However, I am reminded of the James Bond and Mission Impossible films. where when we get biometric data of important people. then we can make a replica like a face mask that is similar to the original. (sorry I watch too many movies). what's worse is when a leaked fingerprint is used for a crime by someone.

ah... I hope this really doesn't apply.
this is a more severe version of kyc.

The article cites the fact that many people are using passwords like "123456" and so forth.  I'm not sure if that's an argument for the implementation of biometric "passwords" as much as it is for educating people on using stronger passwords and just being more mindful of their online security in general.  But I swear, if this becomes the industry standard, you'll be seeing me in 2040 using a smartphone from 2022--and hopefully living in my campaign farm castle in utopia somewhere where the weather is nice and the women abound.  Lol.

I think I will do the same with you. However, our body data is far more dangerous if it is leaked. while the leaking of the password wasn't too much of a problem. although that's actually a problem. but passwords are just a collection of letters and numbers or symbols. while biometric data is the rough data of our body. So it's important to take care of it.

[mk4]

Despite of biometrics solutions being better than passwords, they are still vulnerable to theft of data, the biometric information can be stolen.

Privacy concerns aside, people would most likely use this feature simply because it's far easier to use and the fact that the typical person doesn't need to remember passwords. This is the main reason why these companies win a lot of users while privacy freaks are very low in population — simply because these companies know how to nail UI/UX.

[bakasabo]

I wonder how they plan to make the system secure against malware and similar attacks.

Isnt their system already secure enough? I havent read any news about Apple biometrics being hacked. I remember there were few cases when Apple added face id in 2017. But that these cases were exceptions and in most cases, people did not figure out till the end how system works and raised panic. Right now, Apple biometrics systems looks like most secure. If a user sets face ID security or a password, even Apple cant crack it.

[Lucius]

People should be given the option to use the classic ways to protect their accounts or choose the biometric option - because if Apple thinks everyone is so naive as to use simple passwords that you can guess, I say there are people who know how to protect themselves well without biometrics.

I had the option to unlock my laptop with face recognition 10+ years ago and it worked quite solidly, although I preferred a strong password. I've never used this option on smartphones, even though I have it, but I use fingerprint unlocking, although in some situations I still prefer PIN lock/unlock.

What I've noticed about fingerprint locking is that the sensor usually doesn't recognize the fingerprint when you wash your hands, or if your hands are dirty - and that you may have facial recognition problems if for some reason you don't look the way the camera recorded you at the time of facial sampling.

In terms of security, there are various tricks to bypass the fingerprint sensor, as well as to fake the fingerprint - but what about twins who are identical and facial recognition - not to mention masks that can be made with today's technology so you can look like anyone in the world.

[Zilon]

Do we think biometrics is safer? Here is the thing for facial recognition and Biometrics it is easier to develop softwares that captures and save this two on devices using Ai. Typed Passwords might not be safe either but to some extent it is more secure and less expensive but for biometrics it is expensive and still open to counter technologies.

There are apple users who can comfortable secure their device for years with typed password and no one can hack into their device. Instead of a complicated technology it is better apple school their users on best security using password manager and authenticators approach and what a typical secured password should look like other than compound the technology and give hackers the opportunity to work on a counter technology for this facial recognition and biometrics

Android Biometrics for example is easy to break through with just a white cellotape  and white transparent masking papers then what guarantee is Apple giving that their will be more secure

[davis196]

Adding biometric verification would mean a total end for online privacy.
I'm no expert in spying technologies, but your smartphone can basically track your location, your browsing history, even your phone calls.
What if your smartphone is spying even more sensitive data like fingerprints, iris, etc? Who is going to guarantee that this data won't be leaked? I don't trust Apple.
Using weak passwords as a excuse to implement biometric verification seems like a weak excuse. Apple could just impose rules for stronger passwords, like minimum amount of characters, numbers, capital letters, special characters. This isn't rocket science.
It seems like the "big tech" wants to spy on us even more.

[lovesmayfamilis]

In addition to the fact that Apple often has errors when unlocking with a fingerprint, now they are coming up with a new feature? In my country, at any temperature drop, the phone simply refuses to recognize my fingerprint at all, and I have to additionally unlock it with a password. But besides this, the phone can simply freeze. And now we will be deprived of the password. But what if someone decides to grow a beard, or, on the contrary, shave off his mustache, or, well, something will change in appearance?

I'm not sure that all innovations are made for the benefit of people. This is another one hundred thousandth attempt to take the whole world under its full control.

Confidentiality becomes a fairy tale, but not a reality.

[BitcoinPanther]

I think that Apple just wanted to ride the trend since verification on some companies are implementing Biometrics.  This is more of a show off than considering the safety of the privacy of their users.  If they care for their customers, they should have educated them about the importance of stronger passwords.  It doesn't harm if they add another piece of documents on their packaging informing their users about the importance of strong password.

Well, they are in a business, implementing this kind of verification can give them a boost in promotion and at the same time they can increase the price of their item.  I don't think they are concern about the security but rather the profit it will add on their stash if this kind of technology is implemented.

I'm not sure that all innovations are made for the benefit of people. This is another one hundred thousandth attempt to take the whole world under its full control.

Innovations are made for the company profit not for users.  It so happen that some of this innovations benefit the users as well.

[Mometaskers]

So basically they want to add a biometric password manager, like sone services already offered today? Having a phone feature manage all your different social media and site accounts, nothing could go wrong there. 

Biometrics can be cheated, if they're going to roll this out I'd rather also have a pin/pattern/password in combination with the biometric login. You're just gonna memorize one password anyway, that shouldn't be hard.

[PrivacyG]

This should succeed in the future since this is the only solution to secure accounts compared to using a password that is vulnerable to any attacks like phishing, brute-force attacks and etc...

Biometrics is already been tested for many years not just on Apple devices but also on Android devices. I have my phone not apple but Samsung the Iris scanner for my pattern or passwords looks the best Biometrics that I have ever experienced.
 
But I hope they don't totally remove the password login because if the owner or a user accidentally has a broken/missing finger or had scars on their face they can't easily access their account and it may become an unrecoverable account.

So owners/users should still have an alternative way to log in like passwords or recovery seed for emergency cases.

I respect your opinion but I also can not help but argue.  At first glance, it does seem 'the solution'.  But is it really less vulnerable than a password?  Say you are a journalist owning some crucial information on a phone.  Now should someone retain you, here is how the events may go.

1.  Your phone is encrypted with a password.  They will beat you up, try to enter the password a thousand times, maybe even kill you.  But you will not say ANY part of the password and would rather die with the files forever encrypted instead.
2.  Your phone is encrypted with biometrics.  Now all they need is to cut your finger or just tie you up and use your finger, face or iris against your will to unlock the phone and sweep the crucial data off it.

I would say passwords are MUCH safer than biometrics are.  Sure, it may be so much easier to unlock your phone by just touching it or looking at it, but is it worth trading privacy and personal security for comfort?

Not to mention there are other kind of vulnerabilities when using biometrics such as theft of identity.  I would personally never trust a fingerprint reader on a phone because I have no idea where that information ends up and who could use it against me.  It is just too dangerous for me to even contemplate using it.

-
Regards,
PrivacyG

[Lucius]

Adding biometric verification would mean a total end for online privacy.
I'm no expert in spying technologies, but your smartphone can basically track your location, your browsing history, even your phone calls.

The privacy you are talking about has long been just a story for young children (if they even believe it), because regardless of biometrics in this case, smartphones are spy boxes anyway, especially for those who do not even try to turn off some options which would give them more privacy. For those who haven't heard, big brothers from all over the world have long since found a way to get into any smartphone -> Pegasus

What if your smartphone is spying even more sensitive data like fingerprints, iris, etc? Who is going to guarantee that this data won't be leaked? I don't trust Apple.

Do you trust any other company more? In the end, it all comes down to who is spying on you, because we don't have to delude ourselves that the world is what they want to show us - it's (and much worse) than what the most famous whistleblower in recent history has shown.

[Rikafip]

In fact, I don't trust big tech companies as a general principle (though unfortunately I'm in an abusive relationship with them that I can't seem to get out of).

It's almost impossible to completely get away from them at this day and age, unless you have no issues going completely off the grid and living like Ted Kaczynski.

But I swear, if this becomes the industry standard, you'll be seeing me in 2040 using a smartphone from 2022--and hopefully living in my campaign farm castle in utopia somewhere where the weather is nice and the women abound.  Lol.

This will 100% become industry standard, just the matter of time. Thing is, people (and other companies) usually laugh at Apple's "innovations" and then in a year or two they start doing the same thing.

I think that Apple just wanted to ride the trend since verification on some companies are implementing Biometrics.

On the contrary, Apple starts the trends. It sucks, but that's how it works.