Why is Apple Watch authentication restricted to Secure Enclave Macs?
All Macs can use LocalAuthentication to authenticate with an Apple Watch regardless of whether they have a secure enclave, and keychain items can be created with a SecAccessControl that requires the watch. So why does 1Password require the secure enclave?
1Password Version: 7.7.BETA-1 (70700001)
Extension Version: Not Provided
OS Version: macOS 10.15.5 (19F101)
Sync Type: Not Provided
Comments
-
Yup, that's correct that LocalAuthentication is possible with Apple Watch on most 2013 or newer Macs. Unfortunately, SecAccessControl doesn't meet our security requirements for externally stored unlock secrets. If the keychain item is protected with SecAccessControl then you can still access that item with your Mac's login password.
0 -
You can? Argh, then what's the point of kSecAccessControlDevicePasscode >_<
0
