10 ms·

The whole notion of using fingerprints for authentication is weird. Essentially something that's akin to a username is being used as a password. I've wrote abo

by K0nserv 11y ago

The whole notion of using fingerprints for authentication is weird. Essentially something that's akin to a username is being used as a password. I've wrote about this practice the other day[0]. It's interesting to observe that when Apple announced Touch ID for example it was presented as something with improved security. 0: https://hugotunius.se/2016/04/11/why-i-disabled-touch-id-and-you-should-do-so-too.html https://hugotunius.se/2016/04/11/why-i-disabled-touch-id-and...

tim333 11y ago
Though nothings perfect. Has anyone in practice managed to steal anything at all by hacking Touch ID?
- K0nserv 11y ago
  It's not really about hacking Touch ID. Apple has published a really thorough whitepaper[0] on the security of Touch ID and the secure enclave. I don't really think that hacking the Secure Enclave to extract fingerprints is even possible. The problem I see is using fingerprints which are unique to your person, unchangeable, and spread around us in a very liberal fashion as passwords. Imagine for a second that the San Bernardino iPhone had used Touch ID, don't you find it highly plausible that the US government would be able to find a good fingerprint that could be used to unlock the phone? I guess they even had his body at hand so it would have been dead simple. 0: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
  - mikeash 11y ago
    Do you think they would have figured all of that out before the phone disabled Touch ID at the 48-hour mark? I'm rather doubtful myself.
    - K0nserv 11y ago
      You are right, that's an oversight of mine. Didn't keep the 48 hour thing in mind when writing that comment. My bad
  - tim333 11y ago
    Touch ID has been hacked in various ways - I think you can use a photo derived from someones hands and it's probably possible from fingerprints on the phone. Then again passwords can be grabbed, locks can be picked and so on. It would seem to me that what is effective in practice is what counts. I mean yeah for San Bernadino they probably would have got a fingerprint but they got the data anyway so does it matter?
    - macintux 11y ago
      Pretty sure the only time TouchID was hacked involved a lot of equipment and painstaking work to create a fake finger. A photo of someone's hands is almost certainly insufficient. In other words, citation needed.
      - MertsA 11y ago
        TouchID isn't that great at identifying a real finger vs a fake. Someone was able to bypass it using only items that you could buy at a local radioshack and a laser printer within 48 hours after it was released. http://www.heise.de/video/artikel/iPhone-5s-Touch-ID-hack-in-detail-1966044.html http://www.heise.de/video/artikel/iPhone-5s-Touch-ID-hack-in... I can't find it now but not long after that another group found an even simpler method of printing out a fake print, I did find a much more recent attack based on just using a special conductive ink cartridge in a regular inkjet to directly print something on paper that would work. Bottom line is that it doesn't take a lot of fancy equipment, supplies, or skills to print a fake fingerprint that will fool TouchID. https://www.youtube.com/watch?v=fZJI_BrMZXU https://www.youtube.com/watch?v=fZJI_BrMZXU As for "a photo derived from someones hands", I'm not sure what they meant but if you had a photo that could make out the ridges of someone's fingerprint then yeah absolutely.
  - rpgmaker 11y ago
    > Imagine for a second that the San Bernardino iPhone had used Touch ID, don't you find it highly plausible that the US government would be able to find a good fingerprint that could be used to unlock the phone? I guess they even had his body at hand so it would have been dead simple. That is a very good observation and puts Touch ID in perspective. If you died today would you be ok with your family and/or friends being able to unlock your phone and go through all your personal data? Sure, there may be genuine reasons for them to do so but still, all your data will be at their fingertips and even if you "trust" that they'll limit themselves to only look for the relevant information to get your things in order they still have to sift through a lot data you may not want them to.
jakobegger 11y ago
Touch ID is like a bike lock. It won't stop a sophisticated attacker, but it's enough to stop your coworkers from reading your messages, and it makes the phone worthless for thieves. The biggest advantage of Touch ID is that people who never had a passcode on their phone now use it.
- K0nserv 11y ago
  That's a good point. For people who never had a passcode it's big step up in security. It definitely depends on what the threat model is. If you are protecting yourself from coworkers it might be enough(depending on who your coworkers are). If you are protecting yourself against state level actors such as the FBI it's probably pretty worthless.
- jpalomaki 11y ago
  Problem with passcodes on mobile phone is that you need enter them so often that shoulder surfing becomes a problem.
  - knodi123 11y ago
    Thank you! Yes, absolutely. People need to learn the difference from "secure, in theory, in a perfect world" and "secure enough, in practice, in the real world". Just about every disagreement in this thread is from two people who are talking about two entirely different concepts of security.
- spdustin 11y ago
  It doesn't on its own, but the secure enclave (that was created, in part, to keep biometrics data secured) sure does.
skywhopper 11y ago
As other responders pointed out, Touch ID is definitely an improvement over the status quo, and strikes a reasonable balance between security and convenience. But more relevant to the GP's point in re Touch ID is that Apple doesn't have a database anywhere of fingerprints, and the Secure Enclave is very difficult if not impossible to retrieve data from. In other words, this is biometric ID done as rightly as possible with today's technology.
- K0nserv 11y ago
  I'm inclined to agree that it's an improvement over the status quo for people that didn't use passcodes from before. I do trust Apple more than many other entities and as you say they don't have a database with fingerprints. Further the secure enclave is definitely a secure piece of engineering. As evident by the linked article though the problem isn't Apple the problem is all the other databases that will have your fingerprints. As Troy says in the article > The values within there can be quite detailed and I’ve no reason to think that this isn’t indeed legitimate print data uniquely and biologically identifying the owner. You don’t get to reset that stuff once it’s been released into the wild! Once your fingerprints leak somehow there's no way to reset or change them. To me at least is seems like a really poor idea to use something with those properties as passwords.
  - Vraxx 11y ago
    Yeah, wow. That's an aspect I've never considered before. I suppose because I figured they would need my actual fingerprint to crack the system, but if you have the values for all the "basis vectors" of the fingerprint that are stored, one could theoretically bypass the sensor and feed the proper sensor output to the authenticating machine. The issue grows larger as this method of authentication grows in popularity.
mikeash 11y ago
I think Touch ID does improve security in practice for most people, because it makes it practical to use a proper password for your phone, rather than a four-digit passcode or no passcode at all, as most people did before. You have to consider the limitations it has as well. An attacker could potentially lift your fingerprints and use it to unlock your phone. But they only get five chances to fool the sensor before Touch ID disables itself, and they have to do their work within 48 hours of when you last entered your password. As with all things security, the important question is what sort of threats your defending against. For the scenario where I lose my phone or I get mugged, Touch ID is fine. If I'm defending against police seizing it as evidence, it's probably fine. I'd be surprised if the police could move quickly enough to make the deadline. For police encounters I know about ahead of time (like passing through customs), it's easy to shut the phone off to temporarily disable Touch ID. The only scenario where it likely fails is a targeted attack by someone with sophistication, like if the FBI thinks I'm a terrorist, and I'm not particularly worried about defending against that. Note that your six-digit PIN doesn't necessarily save you here either, although it would buy time. Whatever the FBI did to the infamous San Bernardino iPhone would probably work on yours in a longer but practical amount of time. People often say that fingerprints are usernames, not passwords. I don't think that's very useful. A fingerprint doesn't fit inside the old username/password ideas, it's something different from both, with its own unique properties.
- LoSboccacc 11y ago
  https://xkcd.com/538/ https://xkcd.com/538/
  - maxerickson 11y ago
    That comic is irritating. Most people are far more concerned with lost devices and opportunistic theft than they are worried about targeted theft or malicious actors with wrenches. Encryption reduces the pain of the lost or casually stolen device, it doesn't have to resist a wrench to be useful.
    - LoSboccacc 11y ago
newman314 11y ago
Given today's legal climate, this is what I have come up with as a compromise. * PIN to unlock the phone, no Touch ID. Phone set to self-erase after x attempts. * TouchID to only unlock 1Password. 30 char master password * TouchID used for nothing else. I would welcome any feedback if there is something that I have missed.
makip 11y ago
Definitions can blur since biometric data can play more than one role. A username can identify (but not authenticate) an individual, biometric data can do both, whereas a password is nothing by itself. It’s only meaningful in conjunction with an identifier as a shared secret in order to authenticate.

by K0nserv 11y ago

tim333 11y ago

Though nothings perfect. Has anyone in practice managed to steal anything at all by hacking Touch ID?

K0nserv 11y ago
It's not really about hacking Touch ID. Apple has published a really thorough whitepaper[0] on the security of Touch ID and the secure enclave. I don't really think that hacking the Secure Enclave to extract fingerprints is even possible. The problem I see is using fingerprints which are unique to your person, unchangeable, and spread around us in a very liberal fashion as passwords. Imagine for a second that the San Bernardino iPhone had used Touch ID, don't you find it highly plausible that the US government would be able to find a good fingerprint that could be used to unlock the phone? I guess they even had his body at hand so it would have been dead simple. 0: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
- mikeash 11y ago
  Do you think they would have figured all of that out before the phone disabled Touch ID at the 48-hour mark? I'm rather doubtful myself.
  - K0nserv 11y ago
    You are right, that's an oversight of mine. Didn't keep the 48 hour thing in mind when writing that comment. My bad
- tim333 11y ago
  Touch ID has been hacked in various ways - I think you can use a photo derived from someones hands and it's probably possible from fingerprints on the phone. Then again passwords can be grabbed, locks can be picked and so on. It would seem to me that what is effective in practice is what counts. I mean yeah for San Bernadino they probably would have got a fingerprint but they got the data anyway so does it matter?
  - macintux 11y ago
    Pretty sure the only time TouchID was hacked involved a lot of equipment and painstaking work to create a fake finger. A photo of someone's hands is almost certainly insufficient. In other words, citation needed.
    - MertsA 11y ago
      TouchID isn't that great at identifying a real finger vs a fake. Someone was able to bypass it using only items that you could buy at a local radioshack and a laser printer within 48 hours after it was released. http://www.heise.de/video/artikel/iPhone-5s-Touch-ID-hack-in-detail-1966044.html http://www.heise.de/video/artikel/iPhone-5s-Touch-ID-hack-in... I can't find it now but not long after that another group found an even simpler method of printing out a fake print, I did find a much more recent attack based on just using a special conductive ink cartridge in a regular inkjet to directly print something on paper that would work. Bottom line is that it doesn't take a lot of fancy equipment, supplies, or skills to print a fake fingerprint that will fool TouchID. https://www.youtube.com/watch?v=fZJI_BrMZXU https://www.youtube.com/watch?v=fZJI_BrMZXU As for "a photo derived from someones hands", I'm not sure what they meant but if you had a photo that could make out the ridges of someone's fingerprint then yeah absolutely.
- rpgmaker 11y ago
  > Imagine for a second that the San Bernardino iPhone had used Touch ID, don't you find it highly plausible that the US government would be able to find a good fingerprint that could be used to unlock the phone? I guess they even had his body at hand so it would have been dead simple. That is a very good observation and puts Touch ID in perspective. If you died today would you be ok with your family and/or friends being able to unlock your phone and go through all your personal data? Sure, there may be genuine reasons for them to do so but still, all your data will be at their fingertips and even if you "trust" that they'll limit themselves to only look for the relevant information to get your things in order they still have to sift through a lot data you may not want them to.

jakobegger 11y ago

Touch ID is like a bike lock. It won't stop a sophisticated attacker, but it's enough to stop your coworkers from reading your messages, and it makes the phone worthless for thieves. The biggest advantage of Touch ID is that people who never had a passcode on their phone now use it.

K0nserv 11y ago
That's a good point. For people who never had a passcode it's big step up in security. It definitely depends on what the threat model is. If you are protecting yourself from coworkers it might be enough(depending on who your coworkers are). If you are protecting yourself against state level actors such as the FBI it's probably pretty worthless.
jpalomaki 11y ago
Problem with passcodes on mobile phone is that you need enter them so often that shoulder surfing becomes a problem.
- knodi123 11y ago
  Thank you! Yes, absolutely. People need to learn the difference from "secure, in theory, in a perfect world" and "secure enough, in practice, in the real world". Just about every disagreement in this thread is from two people who are talking about two entirely different concepts of security.
spdustin 11y ago
It doesn't on its own, but the secure enclave (that was created, in part, to keep biometrics data secured) sure does.

skywhopper 11y ago

As other responders pointed out, Touch ID is definitely an improvement over the status quo, and strikes a reasonable balance between security and convenience. But more relevant to the GP's point in re Touch ID is that Apple doesn't have a database anywhere of fingerprints, and the Secure Enclave is very difficult if not impossible to retrieve data from. In other words, this is biometric ID done as rightly as possible with today's technology.

K0nserv 11y ago
I'm inclined to agree that it's an improvement over the status quo for people that didn't use passcodes from before. I do trust Apple more than many other entities and as you say they don't have a database with fingerprints. Further the secure enclave is definitely a secure piece of engineering. As evident by the linked article though the problem isn't Apple the problem is all the other databases that will have your fingerprints. As Troy says in the article > The values within there can be quite detailed and I’ve no reason to think that this isn’t indeed legitimate print data uniquely and biologically identifying the owner. You don’t get to reset that stuff once it’s been released into the wild! Once your fingerprints leak somehow there's no way to reset or change them. To me at least is seems like a really poor idea to use something with those properties as passwords.
- Vraxx 11y ago
  Yeah, wow. That's an aspect I've never considered before. I suppose because I figured they would need my actual fingerprint to crack the system, but if you have the values for all the "basis vectors" of the fingerprint that are stored, one could theoretically bypass the sensor and feed the proper sensor output to the authenticating machine. The issue grows larger as this method of authentication grows in popularity.

mikeash 11y ago

I think Touch ID does improve security in practice for most people, because it makes it practical to use a proper password for your phone, rather than a four-digit passcode or no passcode at all, as most people did before. You have to consider the limitations it has as well. An attacker could potentially lift your fingerprints and use it to unlock your phone. But they only get five chances to fool the sensor before Touch ID disables itself, and they have to do their work within 48 hours of when you last entered your password. As with all things security, the important question is what sort of threats your defending against. For the scenario where I lose my phone or I get mugged, Touch ID is fine. If I'm defending against police seizing it as evidence, it's probably fine. I'd be surprised if the police could move quickly enough to make the deadline. For police encounters I know about ahead of time (like passing through customs), it's easy to shut the phone off to temporarily disable Touch ID. The only scenario where it likely fails is a targeted attack by someone with sophistication, like if the FBI thinks I'm a terrorist, and I'm not particularly worried about defending against that. Note that your six-digit PIN doesn't necessarily save you here either, although it would buy time. Whatever the FBI did to the infamous San Bernardino iPhone would probably work on yours in a longer but practical amount of time. People often say that fingerprints are usernames, not passwords. I don't think that's very useful. A fingerprint doesn't fit inside the old username/password ideas, it's something different from both, with its own unique properties.

LoSboccacc 11y ago
https://xkcd.com/538/ https://xkcd.com/538/
- maxerickson 11y ago
  That comic is irritating. Most people are far more concerned with lost devices and opportunistic theft than they are worried about targeted theft or malicious actors with wrenches. Encryption reduces the pain of the lost or casually stolen device, it doesn't have to resist a wrench to be useful.
  - LoSboccacc 11y ago

newman314 11y ago

Given today's legal climate, this is what I have come up with as a compromise. * PIN to unlock the phone, no Touch ID. Phone set to self-erase after x attempts. * TouchID to only unlock 1Password. 30 char master password * TouchID used for nothing else. I would welcome any feedback if there is something that I have missed.

makip 11y ago

Definitions can blur since biometric data can play more than one role. A username can identify (but not authenticate) an individual, biometric data can do both, whereas a password is nothing by itself. It’s only meaningful in conjunction with an identifier as a shared secret in order to authenticate.