1

I would like to authenticate from an iPad to a website securely without using a strong password. I have though of these possibilities:

  • Credentials stored in the iPad (like Gmail credentials).
  • Using digital certificates.
  • Using a static IP and giving access just to that IP.
  • Identifying the device at network level (MAC) and giving access to that specific user associated with the MAC.
  • Two factor authentication.
  • Smartcard or biometry?

What is the right secure way of doing it?

8
  • 1
    What is the question here? Do you want opinions on which of those would be the best? Do you want suggestion for other possibilities?
    – Anders
    May 27, 2016 at 18:03
  • depending on the security level, a big secret on the ipad should be enough.
    – dandavis
    May 27, 2016 at 19:48
  • @Anders I have edited the question hopefully clarifying what I'm asking. May 29, 2016 at 5:54
  • @AndréBorie Any hint or documentation about how to use SSH keys in iPads in order to authenticate to a web site? May 30, 2016 at 6:37
  • 2
    Not SSH keys. Client certificate. You could also use a U2F token.
    – cornelinux
    May 30, 2016 at 21:33

1 Answer 1

1

Client certificates are your best bet - they allow the iPad to prove its identity without transmitting the confidential part (the private key). Even if the network is tapped, HTTPS is somehow broken or the destination server is compromised, the attacker won't be able to steal the key. It is also seamless and you don't even see the authentication - it all happens in the background during the TLS negotiation.

Smart cards would be a good idea to further protect the private key (if the iPad is compromised the key could still leak) but iOS has no support for them currently.

You can add two-factor authentication on top of that using TOTP for added security if your threat model requires it.

Biometrics add little security as they can't be changed if compromised (and given that we leave our fingerprints everywhere, it's good to assume they are indeed compromised), not to mention quite hard to pull off on iOS as there is no built-in support for it (Touch ID can only be used by apps, not websites, and only authenticates the user to the iPad - there would be no way of sending the fingerprint data to the server for verification).

1
  • I think this is a good recommendation. Using a hardware base TOTP token like a smartdisplayer card would also protect from the iPad being compromised.
    – cornelinux
    Oct 3, 2016 at 18:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .