4 ms·

lol "Passwords are secret and dynamic" Passwords are often static, shared, and relatively easy to crack.

JabavuAdams 13y ago
That's not the point. The point is that the fingerprint uniquely identifies you, and it's difficult to change. It's like using your SIN as a secret.
- mikeash 13y ago
  Well, it's currently pretty easy to change. I use my fingerprint in exactly one place right now: as the unlock code for my new iPhone. (Yep, I stood in line and everything.) If somehow my fingerprint got stolen, I could trivially change the unlock code by switching back to a regular passcode and disabling the fingerprint unlock. I don't understand the big concern over this fingerprint sensor. I get the idea of some concern on a theoretical level, but compared to the rest of any smartphone's ready-made spying functions, like the ability to see where you are at any point in the day, the ability to record or even transmit live every conversation you have, the ability to steal every password you enter into the device, etc. etc., fingerprint theft seems completely unimportant. So far, I've yet to get a satisfactory answer to just what bad things would happen if the NSA was, in fact stealing everyone's iPhone fingerprint data. I'd rather they not, but it's minor compared to everything else that's going on.
  - r00fus 13y ago
    Furthermore, if Apple did it right, they'd store a hashed reading of the fingerprint, and probably salt that with the device's ID or some private key unique to the device (quite straightforward). So that would mean that even if someone stole your print (say the stored hash), it wouldn't work without the iPhone. At that point, in order to attack someone's AppStore account with a fingerprint, it becomes 2-factor security... and that "something to have" token can be revoked by remote wipe.
    - hrasyid 13y ago
      how do you verify fingerprint if you only store a hashed reference?

That's not the point. The point is that the fingerprint uniquely identifies you, and it's difficult to change. It's like using your SIN as a secret.

mikeash 13y ago
Well, it's currently pretty easy to change. I use my fingerprint in exactly one place right now: as the unlock code for my new iPhone. (Yep, I stood in line and everything.) If somehow my fingerprint got stolen, I could trivially change the unlock code by switching back to a regular passcode and disabling the fingerprint unlock. I don't understand the big concern over this fingerprint sensor. I get the idea of some concern on a theoretical level, but compared to the rest of any smartphone's ready-made spying functions, like the ability to see where you are at any point in the day, the ability to record or even transmit live every conversation you have, the ability to steal every password you enter into the device, etc. etc., fingerprint theft seems completely unimportant. So far, I've yet to get a satisfactory answer to just what bad things would happen if the NSA was, in fact stealing everyone's iPhone fingerprint data. I'd rather they not, but it's minor compared to everything else that's going on.
- r00fus 13y ago
  Furthermore, if Apple did it right, they'd store a hashed reading of the fingerprint, and probably salt that with the device's ID or some private key unique to the device (quite straightforward). So that would mean that even if someone stole your print (say the stored hash), it wouldn't work without the iPhone. At that point, in order to attack someone's AppStore account with a fingerprint, it becomes 2-factor security... and that "something to have" token can be revoked by remote wipe.
  - hrasyid 13y ago
    how do you verify fingerprint if you only store a hashed reference?