3 ms·
It will be interesting to see how difficult or how easy it is to fool Apple's fingerprint scanner. I suspect the security will not be high given the constraints
by beloch 13y ago
It will be interesting to see how difficult or how easy it is to fool Apple's fingerprint scanner. I suspect the security will not be high given the constraints of putting it in a button on a mobile phone and the preference for letting marginal scans authenticate the user so as not to frustrate or inconvenience them.
Personally, I'd trust a 4-digit pin with a lockout timer to stand up better than fingerprint authentication. It looks cool in the movies, but it's never been a very bright idea.
Of course, most won't care if it's insecure, and being able to set different functions to automatically execute based on scanning different fingers (an ability laptop scanners have had for years) is certainly a selling point.
- nodata 13y agoSince the phone is covered in the password anyway, it would be interesting to see if it stands up to a gummi bear attack: http://www.theregister.co.uk/2002/05/16/gummi_bears_defeat_fingerprint_sensors/ http://www.theregister.co.uk/2002/05/16/gummi_bears_defeat_f...
- marvin 13y agoHave we seen this fingerprint reader yet? IBM/Lenovo ThinkPads use a reader that's just a tiny strip, so you actually have to swipe your finger instead of just planting it on the reader. This at the very least defends against simple attacks. But I mean, a fingerprint is a physical thing which can be cloned, just like a key. And you also leave prints everywhere you go. It's not a silver bullet in authentication. All else being equal, passwords are safer against a determined attack, if we can assume correct usage.
- sjwright 13y agoAnyone who wants to go to that amount of trouble will find brute-forcing 10,000 possible pin codes to be just as easy.
- jonknee 13y agoNot when the data erases after a low number of misses.
- kevinwallace 13y agoThe data doesn't erase itself. The phone, in its original state, erases its copy of the data, but that doesn't help if you're operating with (a) a copy of the data, or (b) a modified phone, which is likely given an adversary that doesn't find cracking 10,000 PIN combinations to be a significant hurdle. In particular, tools automating (b) already exist: http://gizmodo.com/5896992/the-xry-cracking-tool-is-unimpressed-with-your-iphones-defenses http://gizmodo.com/5896992/the-xry-cracking-tool-is-unimpres...
- hexley 13y agoActually, the data is encrypted firstly with a per-device key that is unique to the phone and unable to be accessed directly (unless you want to go decapping chips), then additionally with a hash of your pin or password. A copy of the data is useless unless you can get to it in an already unlocked state. An erase firstly deletes the encryption key entirely then begins a secure erase in the background.