8 ms·
Apple specifically stated that your fingerprint is stored and encrypted only on the A7 chip, and not iCloud or anywhere else. It's mentioned in the video as we
by cwilson 13y ago
Apple specifically stated that your fingerprint is stored and encrypted only on the A7 chip, and not iCloud or anywhere else.
It's mentioned in the video as well: http://www.apple.com/iphone-5s/videos/#video-touch http://www.apple.com/iphone-5s/videos/#video-touch
- lfuller 13y agoI believe that pilif's issue is with potential undisclosed storage of the fingerprint data on Apple's servers.
- jontas 13y agoI'm just playing Devil's Advocate here, but if in fact the NSA required copies of all fingerprints, I doubt Apple would be allowed to publicize it.
- danabramov 13y agoBut would they still go about implementing it? I mean, it sounds crazy from a business perspective.
- deleted 13y ago[deleted]
- afterburner 13y agoWhat if the NSA told them they had to have access to the data, or else jail and whatnot.
- mcintyre1994 13y agoAm I understanding this correctly? What if the NSA went to Apple and said you have to get us access to everyone's fingerprints or you'll go to jail and other stuff, so Apple put a fingerprint scanner on the iPhone? It seems like a stretch to me.
- deleted 13y ago[deleted]
- gknoy 13y agoMore of: - Apple releases the new finger print reader 5S - NSA: "Heyyy ... we'd like those." - Apple: ".... Crap." (or: "Sure!")
- jlgreco 13y agoMuch more likely: "Do it, or your datafeed of intel from industrial espionage will run dry."
- lttlrck 13y agoNor would they bother explicitly highlighting that it's kept local...
- typon 13y agoBut that's exactly what they want you to think.
- laureny 13y agoMakes me think of all these companies that your passwords are secure until one day, someone hacks their database and decrypts them. When confronted, the company says "But they were very secure, you should have mentioned that by 'secure' you meant "with one way encryption".
- swamp40 13y agoHonestly, to effectively market this technology in today's waters, they have to say that it's kept local. If they send out 8 bytes of your fingerprint data hidden in every picture you take (so your fingerprint can be regenerated by looking at your first 500 pictures) I doubt anyone will ever find it.
- jonmrodriguez 13y agoNot publicizing it would massively backfire as soon as the first teardown happens.
- yapcguy 13y agoWhat they didn't mention is that it's stored in the L2 cache ;-)
- jonhohle 13y agoIn this case, the L2 cache is part of the A7, so that would be fair. I would guess this means it's also only stored in NVRAM local to the SOC and not persisted to the general flash filesystem.
- derefr 13y agoI would guess they just tacked a bog-standard TPM chip into their SoC design. Biometric (fingerprint) sensors and TPM chips go together; see any enterprise-targeted laptop from the last five years.
- mpclark 13y agoQuite. It'll be a little hardware black box that nobody can see into, one that just gives a 'yes' or 'no' answer. Additionally -- if things are like they used to be when I was in the biometrics world in the mid-90s -- the fingerprint template will be small and work like a one way hash; if you have the template you cannot reconstruct the fingerprint from it. It wouldn't really be very useful to the NSA or anyone else.
- pilif 13y agoYes. And how exactly do we check this? Why is it that we can still trust Apple? For all we know, the data gets sent directly to the NSA or, if it doesn't, there might be some secret backdoor that will make the device send the data at a later point. The last round of leaks was specifically talking about backdoors with all bigger US companies in order to circumvent encryption. That's what I means by "we have to consider the iPhones backdoored". Once you can't trust the device any more, all bets are off and thus we can't be sure that what Apple says they do with that fingerprint is what they actually are doing. (edit: regarding jailbreaking, I seriously doubt that a sufficiently well-hidden backdoor would be found by a jailbreaker. Or have we found the backdoors in OSX or Windows yet? Since the latest leak, we know they are there)
- drinchev 13y agoI'm pretty sure, when they jailbreak it the truth will come out. And I doubt Apple would take the risk for lying about that.
- IgorPartola 13y agoWho has the decryption key?
- Someone 13y agoIn the ideal world, there is no decryption key. They should use a one-way hash of the encoded fingerprint. They might want to do approximate matching, though. That could make it hard or impossible to do without the decryption key.
- luscious 13y agoWhich is also when we can start hacking it for fun and profit.
- mrb 13y agoWell, as a computer/network security professional, historically there are plenty examples of companies who have lied about the security of their systems (eg. "without your password, our flash drives cannot be decrypted" when in fact the key is not related to the password and stored in plaintext in a sector on the drive).
- Cakez0r 13y agoWell as long as they specifically stated it! We can totally rely on their word.
- cwilson 13y agoAs others have mentioned, I'm sure we'll learn much more when the jailbreaking begins. Just reporting the facts we have.
- mason240 13y ago>Apple specifically stated that your fingerprint is stored and encrypted only on the A7 chip, and Apple couldn't legally tell us anything different.
- laureny 13y agoDon't trust the NSA, trust Apple instead because they have no interest in your private information. Makes perfect sense.
- muyuu 13y agoOh OK. If Apple says so then that settles it.
- wmoxam 13y agoSo what? How many webapps have encypted and stored their users password "only on their own servers", to later have them leaked via combination of exploit in 3rd party software that allowed the download of their DB and a little brute force? Only difference on an iPhone is that there are literally 100s of thousand of apps that can possibly be exploited