SteemPro Now Unlocks With Your Fingerprint or Face ID
Signing with a private key just got a lot less effort. SteemPro can now
unlock your key with your fingerprint, Face ID, or your device screen lock, instead of typing your PIN every single time.
How to turn it on
Log in with your posting or active key and set a PIN as usual. A new option
appears underneath: Use Face ID / fingerprint. Tick it, tap Login, and
your device asks you to verify once. That's the whole setup.
What actually happens
WebAuthn can prove you are you — but it never hands back a secret, so a
fingerprint can't be your encryption passphrase the way a PIN is. Instead
SteemPro mints a random device secret, re-encrypts a second copy of your key
with it, and only lets the browser unlock that secret after your device
verifies you.
Your PIN isn't going anywhere. It's still required to enrol, and it stays the
fallback every time — decline the prompt, or open SteemPro somewhere without
support, and the PIN modal appears exactly as before. That modal also carries
a Use Face ID / fingerprint button, so you can retry without waiting for
the next transaction.
One deliberate choice: ticking Remember for this session skips verification
for the rest of that tab's life.
Where it works
Any browser with a platform authenticator — Android Chrome, iOS Safari,
Windows Hello, macOS Touch ID. It needs HTTPS, and your device needs a screen
lock configured.
It will not work inside in-app browsers. Links opened from Facebook,
Instagram, Telegram or LINE run in webviews that don't implement WebAuthn at
all. Open SteemPro in Safari or Chrome instead.
Straight talk on security
This stops someone else picking up your unlocked device, and keeps your PIN off
screen. It does not protect against XSS. Your keys never leave your device,
and you keep full custody either way.
Let’s empower the Steem ecosystem 💪🏻
Visit here.
https://www.steempro.comSteemPro Official Discord Server
https://discord.gg/Bsf98vMg6U
Cc:
@steemchiller
@pennsif
@steemcurator01
@rme
@hungry-griffin
https://www.steempro.com/witnesses
Experience the future of blogging with SteemPro Blogs today!
El detalle técnico que más me interesa es que WebAuthn no devuelve el secreto, sino que SteemPro genera un device secret aparte para re-encriptar la key — eso es lo correcto, no hay atajo mágico. Pregunta concreta: si el device secret queda en el storage del navegador y alguien hace XSS, ese segundo cifrado no protege nada, ¿lo aclarás en alguna doc o queda como letra chica? El fallback al PIN sigue siendo lo que realmente sostiene el modelo de seguridad acá.
El dato concreto que me faltaba: si el dispositivo no tiene screen lock configurado, no hay Face ID que valga. Buena la aclaración de que no protege contra XSS, porque más de uno va a creer que esto lo hace invulnerable.