Please boost, create awareness!
@webhat wrote: « passwordless works using biometrics to unlock the trusted key store »
It *may* require biometrics, or it may not.
For example: on my iPhone, if I REMOVE my stored fingerprint data, then:
I'll *always* have to enter my *passcode* (screen unlock password) when I *CREATE* a new passkey, on any website that supports passkeys;
HOWEVER: I *NEVER* have to enter my passcode (or I can bypass any request) when *USING* a passkey to *LOG IN* on to at least the following websites:
• https://idmsa.apple.com
• https://webauthn.io
• https://passkeys-demo.appspot.com
• https://passkeys.io
• https://webauthn-conditional-ui-demo.glitch.me
Similarly, I *always* have to enter my passcode when I *add* a password-based-credentials-record to iCloud Keychain, but *never* when i ask iCloud Keychain to autofill such credentials to log in to *any* website.
How is this NOT a vulnerability?
Note that I've not found *any* configuration setting that (when *not* having configured and using biometrics at all) would force me to *always* authenticate locally to have iCloud Keychain autofill credentials in order to log in to a website.
This is 0FA if someone, who you do not fully trust (e.g. a thief), has or obtains access to your unlocked iPhone or iPad.
IMO this is a huge risk, particular after a miscreant observes you entering your passcode and then steals your iDevice, such as clearly visualized by Joanna Stern (of the Wall Street Journal) in https://youtu.be/QUYODQB_2wQ (follow-up: https://youtu.be/tCfb9Wizq9Q). It is a GAPING SECURITY HOLE because most users, in particular those who do NOT use biometrics (many elderly people), are not aware of the risks.
And IMO it's *unbelievable* that Apple denies that this is a vulnerability (note that more than one vulnerability may be involved).
@rmondello : see https://security.apple.com/reports/OE19476493072 for details.
What else can I do to bring this to people's attention? Please complain to Apple that they insufficiently protect unaware iDevice users!