1

When I use Face ID to sign into a third party application what is being sent to the application server to confirm my login.

Apple state, , ** Apps are only notified regarding whether the authentication is successful**

I assumed that, on successful confirmation that my face is matched, my username and application password/token is forwarded, but the quote from apple would suggest this is not the case.

If nothing unique is being sent other than I would assume my user name and a generic confirmation that my face matches, what is stopping a third party from accessing my online banking account for example?

Improve this question
1
  • Let me know if you have more questions once you review my edit and the short video. Great question.
    – bmike ♦
    Commented Mar 14 at 17:10

1 Answer 1

Reset to default
1

Apple Platform Security guide says just below the text you quote that ECC keys are stored in the Secure Enclave and that unique item is used by the SDK / API call to sign the unique request that is sent rather than your username / passcode to validate a successful biometric event using Face ID.

the Secure Enclave verifies that a biometric authorization occurred and then releases ECC keys used to sign the store request.

There are older API that do similar, but here is the current API and if your bank builds using the latest API and otherwise did a good job securing their servers to properly validate the signed request from their app, you should be secure.

Apple handles all the key generation and handling and the app developer just needs to store a binary value correctly. So the developer needs to set “is signed in” to false and then call the API for biometric request (same API triggers Touch ID and FaceID) and respect if that comes back true or false.

Here is the best introduction to this I have seen. It’s a 10 minute video from a recent WWDC. It’s about how to use FaceID with a web site, but everything is general and applies to apps build using a similar SDK/API.

Improve this answer
2
  • Hey Mike thanks for taking the time to answer. I’m new to the topic and I'm trying to learn as I go. In layman’s terms what is meant by the ecc keys signing the request? ECC keys are the public private keys right? How do these verify sign in to the application one Face ID has been matched.
    – Richard
    Commented Mar 14 at 16:22
  • I love people that are new to tech or some corner of tech, they often ask the best questions and help us all be sure we’re clear in answering. Let me edit the post to have the most friendly 10 minute explanation of how cryptography works and remove. ECC is the formula to generate a signing cert. it’s slightly different than a public / private pair of keys, but the math is similar.
    – bmike ♦
    Commented Mar 14 at 16:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .