5 ms·

I don't like the touch id and touch pay that they're pushing. Fingerprint scanners everyone is probably not a good thing. I'm sure they're all going to end up i

I don't like the touch id and touch pay that they're pushing. Fingerprint scanners everyone is probably not a good thing. I'm sure they're all going to end up in a database somewhere.

cm2187 11y ago
But it term of convenience to unlock your iphone it is unbeatable.
morley 11y ago
Touch ID data is stored in Secure Enclave; it doesn't leave your device. And it doesn't store an image of your fingerprint.
wrigby 11y ago
My impression is that the Touch ID (on the iPhone at least) stores the fingerprints locally, and it's pretty hard to get at them, but I admittedly haven't done much research on it.
bendykstra 11y ago
The Touch ID module hashes fingerprints as part of its scanning process, so the representation of a fingerprint would be of limited use if stolen. In addition, the hashes are stored within hardware that is not accessible by the iPhone's processor, so liberating the hash from the phone would require physical access and sophisticated tools.
josefdlange 11y ago
Your failure to research the feelings behind this statement is obvious. Fingerprints on an iOS device are stored in the Secure Enclave, a hardware module on the device itself, used for checking fingerprints, answering yes or no to the question "is this the user's fingerprint?" As for Apple Pay, your card details are used once -- exactly once -- to generate an obfuscated alias card identifier, again, only useable by the device. There is no database. Fingerprint data doesn't leave the phone. No one stores your credit card details. https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf Research before writing.
- wolfhammer 11y ago
  It seems dangerous to have the scanner on the device and I don't trust it to be safe. It's the print I'm concerned with not the hashes and crypto that connect you to payment. This is something enticing to authorities and I'm sure they'll want to figure out how to get it.
  - r00fus 11y ago
    Well, getting the actual fingerprint is probably like getting the original message out of a hash function... So they can want all day, at the end, entropy wins (by design in this case).

I don't like the touch id and touch pay that they're pushing. Fingerprint scanners everyone is probably not a good thing. I'm sure they're all going to end up in a database somewhere.

cm2187 11y ago

But it term of convenience to unlock your iphone it is unbeatable.

morley 11y ago

Touch ID data is stored in Secure Enclave; it doesn't leave your device. And it doesn't store an image of your fingerprint.

wrigby 11y ago

My impression is that the Touch ID (on the iPhone at least) stores the fingerprints locally, and it's pretty hard to get at them, but I admittedly haven't done much research on it.

bendykstra 11y ago

The Touch ID module hashes fingerprints as part of its scanning process, so the representation of a fingerprint would be of limited use if stolen. In addition, the hashes are stored within hardware that is not accessible by the iPhone's processor, so liberating the hash from the phone would require physical access and sophisticated tools.

josefdlange 11y ago

Your failure to research the feelings behind this statement is obvious. Fingerprints on an iOS device are stored in the Secure Enclave, a hardware module on the device itself, used for checking fingerprints, answering yes or no to the question "is this the user's fingerprint?" As for Apple Pay, your card details are used once -- exactly once -- to generate an obfuscated alias card identifier, again, only useable by the device. There is no database. Fingerprint data doesn't leave the phone. No one stores your credit card details. https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf Research before writing.

wolfhammer 11y ago
It seems dangerous to have the scanner on the device and I don't trust it to be safe. It's the print I'm concerned with not the hashes and crypto that connect you to payment. This is something enticing to authorities and I'm sure they'll want to figure out how to get it.
- r00fus 11y ago
  Well, getting the actual fingerprint is probably like getting the original message out of a hash function... So they can want all day, at the end, entropy wins (by design in this case).