5 ms·

I'm surprised to see so many people saying they will miss TouchID. I still find the idea ridiculous compared to a much more secure PIN. But I'm still using a G

I'm surprised to see so many people saying they will miss TouchID. I still find the idea ridiculous compared to a much more secure PIN. But I'm still using a Galaxy S3 so I'm not in the target demographic for sexy new phones. https://www.forbes.com/sites/josephsteinberg/2015/03/05/why-you-should-not-use-the-new-smartphone-fingerprint-readers/#4d6298af3a95 https://www.forbes.com/sites/josephsteinberg/2015/03/05/why-...

masterj 9y ago
> much more secure PIN Is it? Before touch sensors became the norm people would put in their PIN every few minutes. It would get picked up by countless security cameras. You could talk to a stranger for 2 minutes and pick up their PIN if you didn't avert your eyes. And most people didn't use a PIN at all, because it was too much bother.
astrange 9y ago
A PIN isn't perfectly secure; someone can watch you enter it with a security camera or can tell which buttons you pressed from the finger impressions on the screen.
- namelost 9y ago
  Yes, the PIN is the least secure way of unlocking a phone, by a wide margin. If someone can shoulder surf while I unlock my phone with a PIN, then they can watch which buttons I press and now they can unlock my phone too. If I use the fingerprint reader to unlock, then they have no chance.
usaphp 9y ago
And a complex 40+ character password is much more secure than a 4-6 number pin. There is always a trade off, I personally don't want to press 7 times on my screen everytime I want to use it.
- majewsky 9y ago
  I have a PIN that's longer than 6 digits, and it's just ingrained in muscle memory after a short time. It's not a big difference to a shorter PIN for me.
snowwrestler 9y ago
What makes TouchID secure is not the fingerprint reader, it's the "Secure Enclave"--a dedicated computing environment for storing secrets that is separated from the main processing system. Even if you never use the fingerprint reader, an iPhone with TouchID is still more secure than your Galaxy because the PIN is stored in the Secure Enclave. TouchID is more conventient than a PIN, and it's no less secure because the fingerprint hash is also stored in the SE chip.
- oceanswave 9y ago
  To be fair, Some androids have a similar feature, the comments on this HN question are enlightening. https://news.ycombinator.com/item?id=13957797 https://news.ycombinator.com/item?id=13957797
  - DCKing 9y ago
    To be even more fair: all Android phones you can buy today have a 'secure enclave'. It's been a recommended feature for Google Play certification since Android 5.0, mandatory since 6.0, and part of all Qualcomm, Mediatek, Huawei and Samsung SoCs for years. In your Android phone's settings, go to Lock screen & security, and look at "Credential storage". Unless your phone is ancient, you will see that the storage type is hardware-backed. My Nexus 4 from 2012 has it. This is another one of those things where Apple marketing fares much better than their competitors :)
    - deleted 9y ago
      [deleted]
    - digi_owl 9y ago
      And why i regard Apple a marketing company dabbling on consumer electronics.
digi_owl 9y ago
Pin and an actual keypad beats all the rest. But then i am getting old...

masterj 9y ago

> much more secure PIN Is it? Before touch sensors became the norm people would put in their PIN every few minutes. It would get picked up by countless security cameras. You could talk to a stranger for 2 minutes and pick up their PIN if you didn't avert your eyes. And most people didn't use a PIN at all, because it was too much bother.

astrange 9y ago

A PIN isn't perfectly secure; someone can watch you enter it with a security camera or can tell which buttons you pressed from the finger impressions on the screen.

namelost 9y ago
Yes, the PIN is the least secure way of unlocking a phone, by a wide margin. If someone can shoulder surf while I unlock my phone with a PIN, then they can watch which buttons I press and now they can unlock my phone too. If I use the fingerprint reader to unlock, then they have no chance.

usaphp 9y ago

And a complex 40+ character password is much more secure than a 4-6 number pin. There is always a trade off, I personally don't want to press 7 times on my screen everytime I want to use it.

majewsky 9y ago
I have a PIN that's longer than 6 digits, and it's just ingrained in muscle memory after a short time. It's not a big difference to a shorter PIN for me.

snowwrestler 9y ago

What makes TouchID secure is not the fingerprint reader, it's the "Secure Enclave"--a dedicated computing environment for storing secrets that is separated from the main processing system. Even if you never use the fingerprint reader, an iPhone with TouchID is still more secure than your Galaxy because the PIN is stored in the Secure Enclave. TouchID is more conventient than a PIN, and it's no less secure because the fingerprint hash is also stored in the SE chip.

oceanswave 9y ago
To be fair, Some androids have a similar feature, the comments on this HN question are enlightening. https://news.ycombinator.com/item?id=13957797 https://news.ycombinator.com/item?id=13957797
- DCKing 9y ago
  To be even more fair: all Android phones you can buy today have a 'secure enclave'. It's been a recommended feature for Google Play certification since Android 5.0, mandatory since 6.0, and part of all Qualcomm, Mediatek, Huawei and Samsung SoCs for years. In your Android phone's settings, go to Lock screen & security, and look at "Credential storage". Unless your phone is ancient, you will see that the storage type is hardware-backed. My Nexus 4 from 2012 has it. This is another one of those things where Apple marketing fares much better than their competitors :)
  - deleted 9y ago
    [deleted]
  - digi_owl 9y ago
    And why i regard Apple a marketing company dabbling on consumer electronics.

digi_owl 9y ago

Pin and an actual keypad beats all the rest. But then i am getting old...