Webauthn with iOS touchID

[Lysuo]

Hi

In the past versions, I am pretty sure that I had Apple TouchID configured as a webauthn device and working correctly.
I wasn't using it much since I configured the auto signout setting to "Never", so I'm not sure when it stopped being proposed as a webauthn eligible option.

Now when I try to register a new webauthn device on my iPhone the only options I have are

• external security device
• key located in the iCloud keyring
• auth key using the camera (I haven't tested it but it displays a QR code and asks that it be scanned by another device)

Do you know if touch ID is still supposed to be supported ?

Thanks for your work anyway, this app is awesome :) keep it up!

[Bubka]

Hi,
ToucheID (as FaceID) is the physical device that allows to identify the user who handle the iPhone, but behind the scene it serves as a key in the various auth processes. So if you choose "key located in the iCloud keyring" normally you should be prompt to use TouchID to enroll the iPhone.

[Lysuo]

Indeed you are right, I should have tested this further before asking, my bad.
The way Apple puts it when selecting this option is that one needs to enable the iCloud sync/backup of the keyring to be able to use it, and that's something I want to avoid. So I enabled it, configured touchID for 2fauth and then disabled the iCloud sync and logging with the touchID still seems to work.. don't really know what to think.. anyway thanks for taking the time to answer !

[Bubka]

You are welcome.

Regarding the iCloud sync, one possibility is that Apple uses derived keys when TouchID is used. The derived key is the one used to enroll 2FAuth, so be syncing this key to iCloud you allow your other iOS devices to sign in while their own touchID/FaceId has different key. But with or without iCloud sync, your registered iPhone's TouchID know the key because it generated it.