“Passkey” is the name for a simplified login process to websites that arrived in its full glory later this year with macOS 13 Ventura, iOS 16, and iPadOS 16. A passkey relies on broadly supported industry standards to let you carry out an encrypted login with almost no effort on your part after the initial setup.

You can try a passkey without installing the public betas of these upcoming operating systems, as Apple built passkey support in a preview form into Safari across all its operating systems in iOS 15, iPadOS 15, and Safari 15 with macOS 12 Monterey. With the full release of passkeys in a few weeks or months, and Google and Microsoft’s announced support for compatible technology, you’re likely to see options to add a passkey login at many websites this fall.

Here’s how the process works.

Apple IDs

Beginning with iOS 17 and macOS 14 Sonoma, your Apple ID will support passkey authentication. Anywhere you need to sign in with your Apple ID, including websites and icloud.com, you’ll have two options to log in: with a standard password or by pressing the “Continue with Apple” button that will display a QR code that can be scanned with your iPhone’s camera to create the unique code.

Enroll at a website

A passkey comprises a paired set of encryption keys, known generally as public-key cryptography. When you visit a server that supports WebAuthn (the technology required to accept, store, and interact with a passkey), your browser will present the public key of the encryption pair. The public key can’t be used for login but rather to prove your identity: you possess the private key, which is created on your device and never leaves it for a login.

To enroll, you visit a website that offers passkey support. A site might state it supports passkeys generically, say that it has WebAuthn support, or declare that it’s FIDO2, CTAP, or “multi-device FIDO credential” compatible. All of those terms should mean you can use an Apple (or Google or Microsoft) passkey as your login credential. (FIDO2 is the name given by the FIDO Alliance trade group, a key part of making passkeys and WebAuthn happen, and which Apple, Microsoft, and Google are members of.)

The process will work very similarly to when you enroll at a site for two-factor authentication (2FA) or if you have previously used a hardware key for WebAuthn, like those made by Yubico:

1. Log in using your existing username and password.
2. The site may prompt you for additional verification. This might be a link sent via email, a texted code, or a prompt for a 2FA acknowledgment with a code or via an app you already have installed on your iPhone or iPad.
3. The site’s security section lets you choose to use a passkey or one of the alternate names above.
4. The web server pushes a request to your browser to provide encryption information.
5. You’re prompted to approve this request with Touch ID, Face ID, or your device password, depending on what’s available and enabled.
6. If you successfully validate your identity, your device generates the public/private key pair. The private key is stored on your device and never sent to the remote site.
7. Your browser sends the public key along with a cryptographically signed message that the server can validate using the provided public key: only someone whose device holds the private key can produce a verifiable message.
8. The web server stores your public key for your future logins.

Setting up a passkey login may disable 2FA on your account or allow you to opt for a passkey login instead of a 2FA pathway. A passkey provides proof of possession of both a secret and the device on which it’s stored, effectively two factors. (Some higher-security sites and services may still require 2FA instead of or in addition to a passkey.)

You can see the passkey process at work with some of the underlying technical pieces exposed at Webauthn.me, a site made by Auth0, a provider of authentication services. Some production sites currently offer passkey-compatible logins, but they’re fairly few at the moment. You could set a Google or Dropbox account to use a “security key” and use a passkey instead. See below for my experience with that.

Log in with a passkey

At an enrolled site, you can use a stored passkey the next time you need to log in. You might have noticed that many websites have begun to split the user name or account email submission from a password submission–that appears to be prep for passkeys.

With a site fully ready for passkeys, you’ll tap or click in a username or account email field and be prompted by Safari to validate a passkey login. In some cases, Safari may first ask you if you want to allow Touch ID or “security key” logins on the site; click Allow to continue. Then you can authenticate via Touch ID, Face ID, or your device password just as during enrollment. That’s it! Using the Webauthn.me site noted above, you can test this in Step 4 of its process.

With some sites that have WebAuthn support but aren’t yet fully aligned with the simplified passkey process, you may be prompted to perform a normal user name and password login before the site initiates the sequence that asks your browser for a passkey.

I was able to enroll with a passkey at Dropbox by choosing the Security Key option and following the prompts within Safari for macOS. (While logged into Dropbox via Safari, click your avatar in the upper-right corner, click the Security link, and click Add next to “Security keys.” When it asks if you’ve inserted the key, confirm you have.)

Subsequent logins worked in Safari for macOS but not in Safari for iOS, probably because of a lack of iCloud Keychain sync support prior to the release of the new operating systems. In iOS 16, iPadOS 15, and Ventura, with iCloud Keychain enabled, passkeys will sync and be listed in Settings > Passwords in iOS/iPadOS and System Settings > Passwords in Ventura.

Apple will let you share passkeys with other Apple users by securely sending them over AirDrop. This will share both the public and private key and give people the same degree of account access as if you had given them the username, password, and two-factor token for your account.

Login from other devices

Some sites will let you specify a passkey login as your sole method to gain access. So what if you’re trying to log in from a device that doesn’t have your passkey stored, like a communal or family computer, a device at work, or one you have access to while traveling? Or you need to use a Windows system or Android phone to access a site due to features specific to those platforms? Apple demonstrated a clever approach in its introduction to passkeys at the 2022 Worldwide Developer Conference that requires a QR code and Bluetooth.

The process works like this:

1. On a device with an operating system or browser new enough to support WebAuthn logins, when you enter your account name at a website with which you use a passkey.
2. The site will query the browser for a passkey, and the browser will discover it has none. You can then click to provide a passkey via a proxy, such as by clicking “Add a new phone.”
3. The site sends a query that causes the browser to display a QR Code.
4. On your iPhone or iPad, you scan the QR Code and tap the prompt “Sign in with a passkey.”
5. On your device, click Continue and then approve the login with Touch ID, Face ID, or your device password.
6. The browser shows you’re logged in.

During this process, the device on which the QR Code is displayed and your iPhone or iPad quietly establish a connection via Bluetooth and exchange key information. This lets your device get assurance that the login is happening using a piece of gear that’s nearby to prevent remote attacks, and the Bluetooth backchannel an encrypted channel separate from the browser connection, avoiding phishing attacks that present fake logins.

After you’ve authenticated your login on that other device, your session proceeds as normal. Make sure and log out when you’re done to clear the state.

The future is passkeys

The simplicity of passkeys hides the sophistication. For once, we get both ease, no overhead for managing the process, and the highest possible level of security. Each login is unique, stored for you, and verified in both directions—by your device and by the site—to ensure only the person with access to your device can log into the site.

Internet

While apps and services generally have an online component, there’s nothing stopping you from avoiding it. With apps like Apple’s Notes synchronizing with iCloud, that may be a problem for data a user may deem as extremely private, to a level that they don’t want a duplicate stored online, despite iCloud’s high level of security and privacy.Handily, Apple has included ways to disable the synchronization feature for Notes, so they can be kept local to your hardware an nowhere else.

Read more…

]]> https://www.latest-apple-news.com/2023/05/11/how-to-stop-iphone-notes-from-syncing-to-icloud-in-ios-16-2/ Thu, 11 May 2023 10:52:16 +0000 https://appleinsider.com/articles/22/11/06/how-to-stop-iphone-notes-from-syncing-to-icloud-in-ios-16?utm_medium=rss Apple’s iCloud can be handy for syncing your data across devices, but sometimes you want to turn iCloud syncing off for particular apps. Here’s how to do it for Notes on iOS or iPadOS.

While apps and services generally have an online component, there’s nothing stopping you from avoiding it. With apps like Apple’s Notes synchronizing with iCloud, that may be a problem for data a user may deem as extremely private, to a level that they don’t want a duplicate stored online, despite iCloud’s high level of security and privacy.Handily, Apple has included ways to disable the synchronization feature for Notes, so they can be kept local to your hardware an nowhere else.

Read more…

]]> https://www.latest-apple-news.com/2023/05/04/will-apple-follow-googles-move-and-remove-the-lock-icon-from-safari/ Thu, 04 May 2023 07:17:17 +0000 http://www.latest-apple-news.com/?guid=9cd0a24146d8b40cc9599f221af5c122 Macworld

If you’re reading this story on a browser, you’ll see a small lock icon in the address bar just like you would if you were reading something on 9to5Mac, the Verge, or Apple’s site. For years, it’s been a universal symbol of safety and security… and now Google has announced that it’s going away.

Why? Because the lock never actually meant what people thought it meant. As a universal symbol of security, the lock conveys a sense of trustworthiness and encryption, but it really means something much more mundane: the network connection between the browser and the site is encrypted and cannot be tampered with or eavesdropped on by third parties. That doesn’t necessarily mean the site itself is trustworthy. In fact, the lock symbol is more of a remnant of a pre-HTTPS era and now is as common as a favicon. Yet most people still see it as a symbol of trust.

With version 117, Chrome is rolling out a new symbol based on the “tune” icon, which will look something like two toggles. When you click or tap it, it will show permission controls and make additional security information more accessible, while avoiding the misunderstandings of the lock icon.

It will certainly take some getting used to. The lock symbol has been sitting in our address bars for decades and the new icon is definitely different. But if it gets people to understand the purpose of the symbol and be a little more cautious when browsing the web, it’s definitely a good change. In fact, in a research study, Google found that the new icon prompted users to open the site controls more often.

So will Safari be next? Apple uses the same universal lock symbol to denote sites that use an encrypted connection, so a similar change could accomplish the same thing. It would also give users more control over the sites they visit, with greater visibility over cookies and site data.

With the first look at Safari 17 coming at WWDC in just a couple of weeks, it’s likely that Apple will make a similar change so users aren’t confused when Chrome–which should hit version 117 by late summer or early fall–makes the change. If you don’t want to wait, you can test the new icon now in Chrome Canary by enabling Chrome Refresh 2023 at chrome://flags#chrome-refresh-2023.

iOS, Mac

]]> https://www.latest-apple-news.com/2023/04/28/apples-magnificent-growth-in-this-massive-market-could-be-a-game-changer/ Fri, 28 Apr 2023 15:54:21 +0000 https://macdailynews.com/?p=262232 Apple's revenue from India grew by 50% in the recently concluded fiscal year, according to reports. The company's steps to increase…

The post Apple’s magnificent growth in this massive market could be a game changer appeared first on MacDailyNews. Apple’s revenue from India grew by 50% in the recently concluded fiscal year, according to reports. The company’s steps to increase production and improve its retail footprint in the country could help to sustain this impressive momentum. Apple’s focus on increasing sales in India could reap rich rewards in the long run, thanks to the country’s massive addressable market.

Here are some of the key factors that contributed to Apple’s growth in India:

• Increased production: Apple has been increasing its production of iPhones in India in recent years. Due to avoiding high import tariffs, shipping, and other factors, this has made its products more affordable and accessible to Indian consumers.

• Improved retail footprint: Apple has also been expanding its retail footprint in India. The company now has over 25 retail stores in the country, which makes it easier for consumers to buy its products.

• Strong demand for premium smartphones: India is a growing market for premium smartphones. Apple’s iPhones are among the most popular premium smartphones in the country.

• Positive economic outlook: The Indian economy is expected to grow at a healthy pace in the coming years. This will create more disposable income for Indian consumers, which could lead to increased demand for Apple’s products.

Apple’s focus on India is a long-term strategy. The company believes that the country has the potential to become one of its largest markets in the world. By investing in India now, Apple is positioning itself to capture a significant share of this growing market in the years to come.

Harsh Chauhan for The Motley Fool:

Bloomberg reports that Apple’s revenue in India hit $6 billion in the 12-month period from April 2022 to March 2023.

Apple has generated $387 billion in revenue in the trailing 12 months, which means that India is still a very small portion of its business and doesn’t account for even 2% of the company’s top line. But that doesn’t mean investors should discount Apple’s massive potential in the India, especially considering the pace that market has been growing at a time when the broader smartphone market is under stress.

Smartphone shipments in India were down 10% in 2022 to 144 million units. But Apple weathered that downturn thanks to its 60% share of India’s premium smartphone segment, which includes phones priced at $500 and above. The company reportedly controlled 5.5% of the Indian smartphone market at the end of 2022, according to CyberMedia Research (CMR). It is worth noting that this is Apple’s highest-ever share in a price-sensitive market such as India and increased from 4.4% at the end of 2021.

This also tells us that Apple has massive room for growth in India. Only 4% of the country’s 700 million smartphone owners have an iPhone… [T]his market could play a key role in helping this tech stock soar in the long run.

MacDailyNews Take: India will be a main engine for driving Apple for the foreseeable future.

Please help support MacDailyNews. Click or tap here to support our independent tech blog. Thank you!

Support MacDailyNews at no extra cost to you by using this link to shop at Amazon.

The post Apple’s magnificent growth in this massive market could be a game changer appeared first on MacDailyNews.

]]>