4 ms·

It's not really about hacking Touch ID. Apple has published a really thorough whitepaper[0] on the security of Touch ID and the secure enclave. I don't really t

by K0nserv 11y ago

It's not really about hacking Touch ID. Apple has published a really thorough whitepaper[0] on the security of Touch ID and the secure enclave. I don't really think that hacking the Secure Enclave to extract fingerprints is even possible. The problem I see is using fingerprints which are unique to your person, unchangeable, and spread around us in a very liberal fashion as passwords. Imagine for a second that the San Bernardino iPhone had used Touch ID, don't you find it highly plausible that the US government would be able to find a good fingerprint that could be used to unlock the phone? I guess they even had his body at hand so it would have been dead simple. 0: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf

mikeash 11y ago
Do you think they would have figured all of that out before the phone disabled Touch ID at the 48-hour mark? I'm rather doubtful myself.
- K0nserv 11y ago
  You are right, that's an oversight of mine. Didn't keep the 48 hour thing in mind when writing that comment. My bad
tim333 11y ago
Touch ID has been hacked in various ways - I think you can use a photo derived from someones hands and it's probably possible from fingerprints on the phone. Then again passwords can be grabbed, locks can be picked and so on. It would seem to me that what is effective in practice is what counts. I mean yeah for San Bernadino they probably would have got a fingerprint but they got the data anyway so does it matter?
- macintux 11y ago
  Pretty sure the only time TouchID was hacked involved a lot of equipment and painstaking work to create a fake finger. A photo of someone's hands is almost certainly insufficient. In other words, citation needed.
  - MertsA 11y ago
    TouchID isn't that great at identifying a real finger vs a fake. Someone was able to bypass it using only items that you could buy at a local radioshack and a laser printer within 48 hours after it was released. http://www.heise.de/video/artikel/iPhone-5s-Touch-ID-hack-in-detail-1966044.html http://www.heise.de/video/artikel/iPhone-5s-Touch-ID-hack-in... I can't find it now but not long after that another group found an even simpler method of printing out a fake print, I did find a much more recent attack based on just using a special conductive ink cartridge in a regular inkjet to directly print something on paper that would work. Bottom line is that it doesn't take a lot of fancy equipment, supplies, or skills to print a fake fingerprint that will fool TouchID. https://www.youtube.com/watch?v=fZJI_BrMZXU https://www.youtube.com/watch?v=fZJI_BrMZXU As for "a photo derived from someones hands", I'm not sure what they meant but if you had a photo that could make out the ridges of someone's fingerprint then yeah absolutely.
rpgmaker 11y ago
> Imagine for a second that the San Bernardino iPhone had used Touch ID, don't you find it highly plausible that the US government would be able to find a good fingerprint that could be used to unlock the phone? I guess they even had his body at hand so it would have been dead simple. That is a very good observation and puts Touch ID in perspective. If you died today would you be ok with your family and/or friends being able to unlock your phone and go through all your personal data? Sure, there may be genuine reasons for them to do so but still, all your data will be at their fingertips and even if you "trust" that they'll limit themselves to only look for the relevant information to get your things in order they still have to sift through a lot data you may not want them to.

by K0nserv 11y ago

mikeash 11y ago

Do you think they would have figured all of that out before the phone disabled Touch ID at the 48-hour mark? I'm rather doubtful myself.

K0nserv 11y ago
You are right, that's an oversight of mine. Didn't keep the 48 hour thing in mind when writing that comment. My bad

tim333 11y ago

Touch ID has been hacked in various ways - I think you can use a photo derived from someones hands and it's probably possible from fingerprints on the phone. Then again passwords can be grabbed, locks can be picked and so on. It would seem to me that what is effective in practice is what counts. I mean yeah for San Bernadino they probably would have got a fingerprint but they got the data anyway so does it matter?

macintux 11y ago
Pretty sure the only time TouchID was hacked involved a lot of equipment and painstaking work to create a fake finger. A photo of someone's hands is almost certainly insufficient. In other words, citation needed.
- MertsA 11y ago
  TouchID isn't that great at identifying a real finger vs a fake. Someone was able to bypass it using only items that you could buy at a local radioshack and a laser printer within 48 hours after it was released. http://www.heise.de/video/artikel/iPhone-5s-Touch-ID-hack-in-detail-1966044.html http://www.heise.de/video/artikel/iPhone-5s-Touch-ID-hack-in... I can't find it now but not long after that another group found an even simpler method of printing out a fake print, I did find a much more recent attack based on just using a special conductive ink cartridge in a regular inkjet to directly print something on paper that would work. Bottom line is that it doesn't take a lot of fancy equipment, supplies, or skills to print a fake fingerprint that will fool TouchID. https://www.youtube.com/watch?v=fZJI_BrMZXU https://www.youtube.com/watch?v=fZJI_BrMZXU As for "a photo derived from someones hands", I'm not sure what they meant but if you had a photo that could make out the ridges of someone's fingerprint then yeah absolutely.

rpgmaker 11y ago

> Imagine for a second that the San Bernardino iPhone had used Touch ID, don't you find it highly plausible that the US government would be able to find a good fingerprint that could be used to unlock the phone? I guess they even had his body at hand so it would have been dead simple. That is a very good observation and puts Touch ID in perspective. If you died today would you be ok with your family and/or friends being able to unlock your phone and go through all your personal data? Sure, there may be genuine reasons for them to do so but still, all your data will be at their fingertips and even if you "trust" that they'll limit themselves to only look for the relevant information to get your things in order they still have to sift through a lot data you may not want them to.