Start using the Secure Enclave Crypto API
Summary: Trail of Bits has open-sourced Tidas, a service that stores a per-user encryption key in Apple's Secure Enclave, protected by Touch ID, and verifies sign-in through a digitally signed session token passed to its web service. The company says that since Tidas's February release it drew a WSJ article and talks with a dozen banks, but no clients signed, because developers would not touch authentication routines that risked locking out paying customers and banks would not buy a point solution for a single device.
Why it matters: A dozen interested banks and zero buyers is the outcome for a device-binding scheme that promised reduced fraud: the teams who would have to change their sign-in flow judged the risk of locking out paying customers higher than the gain.
Read the original at Trail of Bits Blog ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026