This article will end by summarizing the unique characteristics of Apple’s platform authenticator and the current status of security key support. This blog post extends the content of WWDC 2020 “Meet Face ID and Touch ID for the web” session by providing detailed examples to assist developers’ adoption of this new technology, including how to manage different user agent user interfaces, how to propagate user gestures from user-activated events to WebAuthn API calls, and how to interpret Apple Anonymous Attestation. And being built on top of the Web Authentication API makes Face ID and Touch ID phishing resistant as well. Using this technology, available on over a billion capable Apple devices, web developers can now broadly offer traditional multi-factor authentication with a smooth, convenient experience. It offers multi-factor authentication in a single step. Face ID and Touch ID for the web provides both the security guarantees of multi-factor authentication and ease of use. Therefore, multi-factor authentication has not become the de facto authentication mechanism on the web. The introduction of a second factor does fix most of the security issues with passwords, but it inevitably makes the whole authentication experience cumbersome with an additional step. Many believe the latter, and thus multi-factor authentication has become more and more popular.

Passwords indeed look notorious, but are passwords themselves the problem, or is it their use as a sole factor for authentication? As passwords are made stronger and unique, they can quickly become unusable for many users.

Frequent reuse of the same password across the web makes breaches even more profitable. Passwords can be easy to guess and vulnerable to breaches. People often see passwords are the original sin of authentication on the web.

Facetime forever to login