3 ms·
You put your fingerprint into a black box and that black box phones home to Apple servers. From a security standpoint, we must assume that they have your finger
by young_unixer 6y ago
You put your fingerprint into a black box and that black box phones home to Apple servers. From a security standpoint, we must assume that they have your fingerprint unless there's a way to prove that they don't. iOS is closed source so we can't prove that.
From an epistemological point of view: I don't know if they have it.
From a security point of view: they have your fingerprint.
- mcpherrinm 6y agoJust because something's closed source doesn't mean we can't learn about it. The field of reverse engineering has been around for a long time, and the iPhone and Mac are two of the most studied devices around. Ultimately you do have to trust your platform if you're going to use a platform authenticator to some degree. But the alternative in the FIDO2/webauthn space is something like a Yubikey which has no biometrics; it just takes a simple tap. And can be easily removed from your computer. So in that comparison, the fingerprint is purely additive security. Even if it's adding nothing to a serious adversary, it's still dramatically reducing risk to a less-skilled local attacker.
- rimliu 6y agoMy bank has my money. Shoul I feel robbed, from security point of view?