4 ms·

About the ID fingerprints? Am I the only one so in constant fear and doubt that thinks this would be a great way of bulk collecting the fingerprints of ANYONE?

ihuman 13y ago
They say that applications don't have access to it and it is never uploaded online, but until the device is out there is no way to verify it.
- charlescearl 13y ago
  Open source the M7 and then we'll trust them. Where's the backdoor at?
- hershel 13y ago
  Even after the device is out it would be very hard(if not impossible) to verify it doesn't send fingerprint or hash of fingerprint online. There's plenty of places they can hide this.
  - danabramov 13y ago
    Don't you think this would be a huge scandal, if it was revealed? Considering they specifically say it is not uploaded? Just saying. Why would they take such a risk?
    - sdoowpilihp 13y ago
      At the very least, It would open them up to a massive class action lawsuit. The repercussions would likely run much deeper that though.
      - GVIrish 13y ago
        The government has given legal immunity to telecoms that collaborated with NSA spying in the past, I'm sure they'd extend that immunity to Apple if need be.
        gareim 13y ago
        The class action lawsuit would be brought based on the fact that Apple sold the device on a lie. The government can't grant immunity for that.
        hershel 13y ago
        This can always be the job by someone in the company cooperating with NSA , without apple knowing. And i think government can grant immunity to lies. Hasn't many people lied to congress/citizens in the recent weeks ?
        PeterisP 13y ago
        "The government can't grant immunity for that." ... come on. I don't recall the exact wording of that law, IMHO it already covers such argument, but if not, it just needs a single sentence amendment. Government certainly can grant immunity against pretty much any civil claims. They also can pass a law stating "Any and all contracts between Apple and 'gareim' shall be considered null and void.", though they probably won't do that - but adding an exception to the laws regulating advertising truthfulness is trivial. In fact, they could simply revoke those laws and then noone could bring any class actions for 'being sold a product on a lie'; class actions as such were only made possible by specific regulations and congress could eliminate the whole concept of class action suits if they wished to.
    - lewispollard 13y ago
      The entire NSA thing to date is a huge scandal, and yet no one (outside of the tech community) seems to really care... Not many people are closing their accounts associated with NSA complicit companies.
      - danabramov 13y ago
        Do you really fail to see the difference between disclosing user info already on the servers to the NSA under legal orders and announcing a new product after the leaks, claiming it does not send any data, and doing the exact opposite without any additional benefit? Why would Apple do this? I don't recall reading NSA can now force companies to include finger sensors, and then force them to collect data they wouldn't be collecting otherwise.
        eric_cc 13y ago
        You are sound really really naive. You sound like the kind of person who is "shocked" by new scandals.
        danabramov 13y ago
        What is it that I said that sounds naïve to you? That NSA can't force a company to include fingerprint sensors in their new phone?
        lewispollard 13y ago
        I didn't say anything of the sort - just that major tech companies don't seem to really care about their reputation in relation to the NSA snooping. I'm not saying they've built in backdoors or anything either way, I'm just saying if they have, I don't think the average consumer seems to really care about it. Heck, I'd bet most of Hacker News is still using Google, Facebook, Microsoft products etc. and their reputations have hardly been tarnished by the revelations.
      - LaGrange 13y ago
        Because we can't, not really. I mean, sure, at a significant price, you kinda can, but the cost will be great. Delete your fb, g+ and twitter accounts. There will be a social price to pay, but it's still not too great for a significant amount of people. For many, though, even that is costly. Get rid of your Nokia, Apple or Android phones. Suddenly, harsh. Still possible, because there's some alternatives, but if you want to avoid US and Chinese companies (srsly, Chinese), your options are limited and not well-known. And, you've done both. Um, most SSL implementations. Your bank account. You'd have to go cash only. Seriously, there isn't much we can do in any immediate way. Just vote the right way, and talk to people. Less glorious than pointlessly sacrificing yourself, sure, but actually works.
    - lewispollard 13y ago
      The entire NSA thing to date is a huge scandal, and yet no one (outside of the tech community) seems to really care... Not many people are closing their accounts associated with NSA complicit companies.
    - lewispollard 13y ago
      The entire NSA thing to date is a huge scandal, and yet no one (outside of the tech community) seems to really care... Not many people are closing their accounts associated with NSA complicit companies.
  - sengstrom 13y ago
    This was my thought as well - how can you verify the fingerprint if you don't have a representation of it to compare to? Don't think there is much value just an internal comparison would have.
- jschmitz28 13y ago
  That may be true now, but we've seen very recently how powerful government orders can be. I could easily see it starting with "we do not upload fingerprints" to "we only send fingerprints at the request of government warrants" to something much more massive down the road.
- sdoowpilihp 13y ago
  I would hope that they simply save a hash of the fingerprint with a reasonable level of collision built in to make it difficult to tie a hash to a single person's fingerprint (maybe ~10 people would have that hash?). I would imagine they could then use some sort of secret tied to the device id and hash pair to positively identify to the server. edit for clarity
  - tiziano88 13y ago
    That's not how fingerprint scanners normally work I'm afraid...
  - swamp40 13y ago
    So there are two things going on here. 1)They said the detection gets better every time you use it. So my guess would be that multiple versions of the raw fingerprint data are stored inside the A7 chip. (That information never leaves the chip.) 2) You can use your fingerprint to authenticate apps like iTunes, as well as third party apps. For this, yes I am sure they will use some hash that cannot rebuild the fingerprint.
    - hershel 13y ago
      For 2, the apps have no reason to see a fingerprint hash, only an authenticated identity.
      - swamp40 13y ago
        How does it work now when you have to type in your iTunes password to authorize an in-app purchase? I thought the password got hashed and sent out to Apple's servers to authenticate? If so, wouldn't a new fingerprint based password have to do the same thing?
        hershel 13y ago
        I think they would implement a password manager, and instead of a master password ,they'll use fingerprints/fingerprints-hash
- nsxwolf 13y ago
  If the data is sequestered on the A7, I suspect not even iOS has access to it. It may just be able to request authentication, and receive a true or false.
- aes 13y ago
  They don't even say fingerprints are not uploaded: According to the press release, "fingerprint information [...] is never stored on Apple servers or backed up to iCloud." But nowhere do they claim it doesn't ever leave the phone. It looks like this leaves Apple the option to upload the data to "trusted partners". http://www.apple.com/pr/library/2013/09/10Apple-Announces-iPhone-5s-The-Most-Forward-Thinking-Smartphone-in-the-World.html http://www.apple.com/pr/library/2013/09/10Apple-Announces-iP...
kmfrk 13y ago
You shouldn't use any fingerprint scanner, if something like that worries you.
rimantas 13y ago
They said fingerprints never leave the devices, are not backed up and "don't hit Apple servers".
grey-area 13y ago
For anyone not a US citizen, the US is already doing that at the border. Welcome to our world.
- Wingman4l7 13y ago
  Doesn't the DMV also scan your thumbprint when you get your driver's license (at least in some states)?
Asterick6 13y ago
Calm down and stop posting inane comments. It'd be much more healthy for this community. If you have doubts about the scanner, then don't buy an iPhone 5S. There's nothing much more that can be done besides what's being done already. And for others who know and don't care, that's their decision.
davidedicillo 13y ago
I guess you never left the country, because that's one of the things they take every time you come back in the US.

ihuman 13y ago

They say that applications don't have access to it and it is never uploaded online, but until the device is out there is no way to verify it.

charlescearl 13y ago
Open source the M7 and then we'll trust them. Where's the backdoor at?
hershel 13y ago
Even after the device is out it would be very hard(if not impossible) to verify it doesn't send fingerprint or hash of fingerprint online. There's plenty of places they can hide this.
- danabramov 13y ago
  Don't you think this would be a huge scandal, if it was revealed? Considering they specifically say it is not uploaded? Just saying. Why would they take such a risk?
  - sdoowpilihp 13y ago
    At the very least, It would open them up to a massive class action lawsuit. The repercussions would likely run much deeper that though.
    - GVIrish 13y ago
      The government has given legal immunity to telecoms that collaborated with NSA spying in the past, I'm sure they'd extend that immunity to Apple if need be.
      - gareim 13y ago
        The class action lawsuit would be brought based on the fact that Apple sold the device on a lie. The government can't grant immunity for that.
        hershel 13y ago
        This can always be the job by someone in the company cooperating with NSA , without apple knowing. And i think government can grant immunity to lies. Hasn't many people lied to congress/citizens in the recent weeks ?
        PeterisP 13y ago
        "The government can't grant immunity for that." ... come on. I don't recall the exact wording of that law, IMHO it already covers such argument, but if not, it just needs a single sentence amendment. Government certainly can grant immunity against pretty much any civil claims. They also can pass a law stating "Any and all contracts between Apple and 'gareim' shall be considered null and void.", though they probably won't do that - but adding an exception to the laws regulating advertising truthfulness is trivial. In fact, they could simply revoke those laws and then noone could bring any class actions for 'being sold a product on a lie'; class actions as such were only made possible by specific regulations and congress could eliminate the whole concept of class action suits if they wished to.
  - lewispollard 13y ago
    The entire NSA thing to date is a huge scandal, and yet no one (outside of the tech community) seems to really care... Not many people are closing their accounts associated with NSA complicit companies.
    - danabramov 13y ago
      Do you really fail to see the difference between disclosing user info already on the servers to the NSA under legal orders and announcing a new product after the leaks, claiming it does not send any data, and doing the exact opposite without any additional benefit? Why would Apple do this? I don't recall reading NSA can now force companies to include finger sensors, and then force them to collect data they wouldn't be collecting otherwise.
      - eric_cc 13y ago
        You are sound really really naive. You sound like the kind of person who is "shocked" by new scandals.
        danabramov 13y ago
        What is it that I said that sounds naïve to you? That NSA can't force a company to include fingerprint sensors in their new phone?
      - lewispollard 13y ago
        I didn't say anything of the sort - just that major tech companies don't seem to really care about their reputation in relation to the NSA snooping. I'm not saying they've built in backdoors or anything either way, I'm just saying if they have, I don't think the average consumer seems to really care about it. Heck, I'd bet most of Hacker News is still using Google, Facebook, Microsoft products etc. and their reputations have hardly been tarnished by the revelations.
    - LaGrange 13y ago
      Because we can't, not really. I mean, sure, at a significant price, you kinda can, but the cost will be great. Delete your fb, g+ and twitter accounts. There will be a social price to pay, but it's still not too great for a significant amount of people. For many, though, even that is costly. Get rid of your Nokia, Apple or Android phones. Suddenly, harsh. Still possible, because there's some alternatives, but if you want to avoid US and Chinese companies (srsly, Chinese), your options are limited and not well-known. And, you've done both. Um, most SSL implementations. Your bank account. You'd have to go cash only. Seriously, there isn't much we can do in any immediate way. Just vote the right way, and talk to people. Less glorious than pointlessly sacrificing yourself, sure, but actually works.
  - lewispollard 13y ago
    The entire NSA thing to date is a huge scandal, and yet no one (outside of the tech community) seems to really care... Not many people are closing their accounts associated with NSA complicit companies.
  - lewispollard 13y ago
    The entire NSA thing to date is a huge scandal, and yet no one (outside of the tech community) seems to really care... Not many people are closing their accounts associated with NSA complicit companies.
- sengstrom 13y ago
  This was my thought as well - how can you verify the fingerprint if you don't have a representation of it to compare to? Don't think there is much value just an internal comparison would have.
jschmitz28 13y ago
That may be true now, but we've seen very recently how powerful government orders can be. I could easily see it starting with "we do not upload fingerprints" to "we only send fingerprints at the request of government warrants" to something much more massive down the road.
sdoowpilihp 13y ago
I would hope that they simply save a hash of the fingerprint with a reasonable level of collision built in to make it difficult to tie a hash to a single person's fingerprint (maybe ~10 people would have that hash?). I would imagine they could then use some sort of secret tied to the device id and hash pair to positively identify to the server. edit for clarity
- tiziano88 13y ago
  That's not how fingerprint scanners normally work I'm afraid...
- swamp40 13y ago
  So there are two things going on here. 1)They said the detection gets better every time you use it. So my guess would be that multiple versions of the raw fingerprint data are stored inside the A7 chip. (That information never leaves the chip.) 2) You can use your fingerprint to authenticate apps like iTunes, as well as third party apps. For this, yes I am sure they will use some hash that cannot rebuild the fingerprint.
  - hershel 13y ago
    For 2, the apps have no reason to see a fingerprint hash, only an authenticated identity.
    - swamp40 13y ago
      How does it work now when you have to type in your iTunes password to authorize an in-app purchase? I thought the password got hashed and sent out to Apple's servers to authenticate? If so, wouldn't a new fingerprint based password have to do the same thing?
      - hershel 13y ago
        I think they would implement a password manager, and instead of a master password ,they'll use fingerprints/fingerprints-hash
nsxwolf 13y ago
If the data is sequestered on the A7, I suspect not even iOS has access to it. It may just be able to request authentication, and receive a true or false.
aes 13y ago
They don't even say fingerprints are not uploaded: According to the press release, "fingerprint information [...] is never stored on Apple servers or backed up to iCloud." But nowhere do they claim it doesn't ever leave the phone. It looks like this leaves Apple the option to upload the data to "trusted partners". http://www.apple.com/pr/library/2013/09/10Apple-Announces-iPhone-5s-The-Most-Forward-Thinking-Smartphone-in-the-World.html http://www.apple.com/pr/library/2013/09/10Apple-Announces-iP...

kmfrk 13y ago

You shouldn't use any fingerprint scanner, if something like that worries you.

rimantas 13y ago

They said fingerprints never leave the devices, are not backed up and "don't hit Apple servers".

grey-area 13y ago

For anyone not a US citizen, the US is already doing that at the border. Welcome to our world.

Wingman4l7 13y ago
Doesn't the DMV also scan your thumbprint when you get your driver's license (at least in some states)?

Asterick6 13y ago

Calm down and stop posting inane comments. It'd be much more healthy for this community. If you have doubts about the scanner, then don't buy an iPhone 5S. There's nothing much more that can be done besides what's being done already. And for others who know and don't care, that's their decision.

davidedicillo 13y ago

I guess you never left the country, because that's one of the things they take every time you come back in the US.