I would like to authenticate from an iPad to a website securely without using a strong password. I have though of these possibilities:

  • Credentials stored in the iPad (like Gmail credentials).
  • Using digital certificates.
  • Using a static IP and giving access just to that IP.
  • Identifying the device at network level (MAC) and giving access to that specific user associated with the MAC.
  • Two factor authentication.
  • Smartcard or biometry?

What is the right secure way of doing it?

  • 1
    What is the question here? Do you want opinions on which of those would be the best? Do you want suggestion for other possibilities? – Anders May 27 '16 at 18:03
  • depending on the security level, a big secret on the ipad should be enough. – dandavis May 27 '16 at 19:48
  • @Anders I have edited the question hopefully clarifying what I'm asking. – Eloy Roldán Paredes May 29 '16 at 5:54
  • @AndréBorie Any hint or documentation about how to use SSH keys in iPads in order to authenticate to a web site? – Eloy Roldán Paredes May 30 '16 at 6:37
  • 2
    Not SSH keys. Client certificate. You could also use a U2F token. – cornelinux May 30 '16 at 21:33

Client certificates are your best bet - they allow the iPad to prove its identity without transmitting the confidential part (the private key). Even if the network is tapped, HTTPS is somehow broken or the destination server is compromised, the attacker won't be able to steal the key. It is also seamless and you don't even see the authentication - it all happens in the background during the TLS negotiation.

Smart cards would be a good idea to further protect the private key (if the iPad is compromised the key could still leak) but iOS has no support for them currently.

You can add two-factor authentication on top of that using TOTP for added security if your threat model requires it.

Biometrics add little security as they can't be changed if compromised (and given that we leave our fingerprints everywhere, it's good to assume they are indeed compromised), not to mention quite hard to pull off on iOS as there is no built-in support for it (Touch ID can only be used by apps, not websites, and only authenticates the user to the iPad - there would be no way of sending the fingerprint data to the server for verification).

  • I think this is a good recommendation. Using a hardware base TOTP token like a smartdisplayer card would also protect from the iPad being compromised. – cornelinux Oct 3 '16 at 18:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.