Login with Passkeys!! #1599

charliescheer · 2024-06-12T17:06:39Z

Fix

To improve the security of Simplenote accounts we are trying to move away from email/password authentication as it is insecure at best. One of the things we are implementing is Passkeys. This will allow users to create and store passkeys on their apple device and when they go to log into their account rather than using an email and password they only need to put in their email and then use the local biometrics to receive a passkey and then authenticate into Simplenote.

This has a bunch of security benefits and should also help users keep from losing their passwords.

Sign up for passkeys:

RPReplay_Final1718384460.mp4

Login with passkeys:

RPReplay_Final1718384268.mp4

Test

Clean install Simplenote on device (can't access biometrics on sim) Tap on login and choose to login with email and password
Once logged in go to the menu -> Settings and in the account section you will see a "Add Passkey Authentication" button. Press that. After a few seconds you will receive a notice from device asking if you want to create a passkey. Confirm and wait a few seconds. (NOTE: Currently there is no spinner or success/failure indication, that will be in a future PR)
Log out of Simplenote
Tap on the Login button and choose Login with Passkeys
Enter your email and tap on the Login with Passkeys Button
after a few seconds you will be prompted by device if you want to login with passkeys, confirm

Confirm you are able to log into your Simplenote account.

Review

(Required) Add instructions for reviewers. For example:

Only one developer is required to review these changes, but anyone can perform the review.

Release

(Required) Add a concise statement to RELEASE-NOTES.txt if the changes should be included in release notes. Include details about updating the notes in this section. For example:

RELEASE-NOTES.txt was updated in 0c4129 with:

Added Passkey authentication support

dangermattic · 2024-06-12T17:07:32Z

	2 Warnings
⚠️	This PR is larger than 500 lines of changes. Please consider splitting it into smaller PRs for easier and faster reviews.
⚠️	PR is not assigned to a milestone.

Generated by 🚫 Danger

wpmobilebot · 2024-06-12T17:12:17Z

You can test the changes in simplenote-ios from this Pull Request by:

Clicking here or scanning the QR code below to access App Center
Then installing the build number pr1599-7e524e0-019017ab-e275-4c9a-8184-574412bb1e22 on your iPhone

If you need access to App Center, please ask a maintainer to add you.

…ge by ensuring it is url safe.

roundhill · 2024-06-25T16:02:35Z

Simplenote/Classes/SimplenoteConstants.swift

+    static let passkeyCredentialCreationURL = currentPasskeyBaseURL.appendingPathComponent("/api2/login")
+    static let passkeyRegistrationURL = currentPasskeyBaseURL.appendingPathComponent("/auth/add-credential")
+    static let passkeyAuthChallengeURL = currentPasskeyBaseURL.appendingPathComponent("/auth/prepare-auth-challenge")
+    static let verifyPasskeyAuthChallengeURL = currentPasskeyBaseURL.appendingPathComponent("/auth/verify-login-credential")


Can you add a / onto the end of all of these endpoints? It will save app engine from doing a redirect.

jleandroperez · 2024-06-27T12:51:02Z

Simplenote/AccountRemote.swift

+
+        body += Data("--\(boundary)--\r\n".utf8)
+
+        return body


Rather than converting every line into Data, adding them all up and returning, we can build the string and convert just once, in the last statement

jleandroperez

Sending you a few notes, looking great Charlie!!

jleandroperez · 2024-06-27T12:57:24Z

Simplenote/Classes/SPAuthViewController.swift

+            //TODO: Handle errors
+            //TODO: Handle email not valid
+            let passkeyAuthenticator = SPAppDelegate.shared().passkeyAuthenticator
+            try? await passkeyAuthenticator.attemptPasskeyAuth(for: email, in: self)


SPAuthViewController has an instance of SPAuthHandler, which, in turn, has a reference to SPAuthenticator.

No need to use a singleton for this one! 😄

jleandroperez · 2024-06-27T13:00:19Z

Simplenote/Classes/SPAuthViewController.swift

@@ -627,6 +643,7 @@ struct AuthenticationMode {
    let secondaryActionText: String?
    let secondaryActionAttributedText: NSAttributedString?
    let isPasswordHidden: Bool
+    let isLogin: Bool


This property appears not to be in use anywhere, perhaps it's a leftover?

jleandroperez · 2024-06-27T13:00:54Z

Simplenote/Classes/SPAuthViewController.swift

+                     secondaryActionText: AuthenticationStrings.loginSecondaryAction,
+                     secondaryActionAttributedText: nil,
+                     isPasswordHidden: true,
+                     isLogin: true)


jleandroperez · 2024-06-27T13:03:03Z

Simplenote/Data+Simplenote.swift

+                        userInfo: [NSLocalizedDescriptionKey: "Can't decode base64 string"])
+        }
+        return data
+    }


Caaaan we add a comment mentioning why this was required (rather than the standard initializer?)

Thank youuu!!

jleandroperez · 2024-06-27T13:04:37Z

Simplenote/PasskeyAuthenticator.swift

+    }
+
+    private func performPasskeyAuthentication(with response: PasskeyAuthResponse) {
+        let json = try! JSONEncoder().encode(response)


It should never crash, but perhaps we should avoid the force unwrap on this one

jleandroperez · 2024-06-27T13:05:21Z

Simplenote/PasskeyAuthenticator.swift

+        case let credential as ASAuthorizationPlatformPublicKeyCredentialAssertion:
+                let response = PasskeyAuthResponse(from: credential)
+
+                performPasskeyAuthentication(with: response)


Nipticky: Indentation is a bit off in these few lines

jleandroperez · 2024-06-27T13:06:30Z

Simplenote/PasskeyRegistrationResponse.swift

+    private let response: PasskeyRegistrationResponse.Response
+
+    init?(from credentialRegistration: ASAuthorizationPlatformPublicKeyCredentialRegistration) {
+        guard let email = SPAppDelegate.shared().simperium.user?.email,


We should get the email via parameter (rather than coupling the initializer with the AppDelegate)

charliescheer added 3 commits June 5, 2024 12:03

Added basic setup to use ASAuthentication on the login form

58212cc

Added request for passkey challenge to account remote

a07083e

Added ability to register passkeys on server

b059b0a

fixed a few linting errors

6b6e228

charliescheer and others added 16 commits June 12, 2024 12:19

Added button for login with passkeys

5363f4d

Added auth verification with passkeys

112fcc1

put auth challenge parsing back to using string

273a145

Add WebauthnResponse struct, fix encoding of base64 from auth challen…

3dd793e

…ge by ensuring it is url safe.

Added parsing for user object when logging in with passkeys

ffaa2a9

Refactored passkey registration into a single class

dbf0884

Moved passkey authenticator to app delegate

3271ea0

Migrated passkey auth to the authenticator

162dad6

Moved passkey auth data objects to their own files

b0dd3c1

Moved passkey registration data objects to their own files

9f20166

Reorder PasskeyAuthenticator for readability

ebe4cc7

Refactored parsing a verification json on passkey auth

a50a0cc

Moved decodeURLsafebase64 to a data extension file

c670805

Cleaned up some messy code with passkeys

ec0ad95

Fixed parsing authentication verified value on passkey auth

860971d

Refactored getting to the passkey authentication to fix the ui tests

00401db

charliescheer changed the title ~~WIP: passkey implementation~~ Login with Passkeysasskey implementation Jun 14, 2024

charliescheer changed the title ~~Login with Passkeysasskey implementation~~ Login with Passkeys!! Jun 14, 2024

Updated release notes PR1599 added passkey authentication

7e524e0

charliescheer requested a review from jleandroperez June 14, 2024 16:53

charliescheer self-assigned this Jun 14, 2024

charliescheer requested a review from roundhill June 14, 2024 16:53

charliescheer added the [feature] login Anything relating to login. label Jun 14, 2024

charliescheer marked this pull request as ready for review June 14, 2024 16:54

roundhill reviewed Jun 25, 2024

View reviewed changes

jleandroperez reviewed Jun 27, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Login with Passkeys!! #1599

Login with Passkeys!! #1599

charliescheer commented Jun 12, 2024 •

edited

Loading

dangermattic commented Jun 12, 2024 •

edited

Loading

wpmobilebot commented Jun 12, 2024 •

edited

Loading

roundhill Jun 25, 2024

jleandroperez Jun 27, 2024

jleandroperez left a comment

jleandroperez Jun 27, 2024

jleandroperez Jun 27, 2024

jleandroperez Jun 27, 2024

jleandroperez Jun 27, 2024

jleandroperez Jun 27, 2024

jleandroperez Jun 27, 2024

jleandroperez Jun 27, 2024

Login with Passkeys!! #1599

Are you sure you want to change the base?

Login with Passkeys!! #1599

Conversation

charliescheer commented Jun 12, 2024 • edited Loading

Fix

Test

Review

Release

dangermattic commented Jun 12, 2024 • edited Loading

wpmobilebot commented Jun 12, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jleandroperez left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

charliescheer commented Jun 12, 2024 •

edited

Loading

dangermattic commented Jun 12, 2024 •

edited

Loading

wpmobilebot commented Jun 12, 2024 •

edited

Loading