6 ms·

I have accidentally seen basically all of my friends' passcodes as they type it in at bars etc. I could get into their phones easily. TouchID is more secure tha

I have accidentally seen basically all of my friends' passcodes as they type it in at bars etc. I could get into their phones easily. TouchID is more secure than that simply because someone needs to take a 2400dpi image of the person's finger to do it. Locks (when physical access to a device is available) are to keep honest people honest. Most security experts that I know agree that if an intruder has physical access to a device, it can be considered compromised because it is just a matter of time.

51Cards 13y ago
...2400dpi image of the person's finger... Note: Finger Print, not finger. Here, have a drink out of this freshly washed glass... no, don't worry, I'll wash the glass for you later. :) On the last second point regarding access to a device, I could take a week to make up the fake print during which it won't matter if I have it or not. Since your print isn't changing I just need 5 minutes with your device at any point in the future.
- MysticFear 13y ago
  Then create a detailed model using said high resolution fingerprint. If someone cares enough about your phone to do that, they can probably break into it by other means anyway (jail break, brute force passcode, etc)
  - Groxx 13y ago
    You leave finger prints on the phone. Just snap a photo with a decent camera - it's probably enough detail. Print it. Stick some latex or glue on it (literally available everywhere). That's it. This is not rocket science or time consuming like brute forcing. You don't even have to shoulder-surf to catch their password.
    - sentenza 13y ago
      Importantly, this has been demonstrated. The CCC has been doing it for years and published a howto with material costs in the low one-digit Euro range. http://translate.google.com/translate?sl=de&tl=en&js=n&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fchaosradio.ccc.de%2Fctv001.html http://translate.google.com/translate?sl=de&tl=en&js=n&prev=...
      - melange 13y ago
        Actually it hasn't been demonstrated at all. They dusted a carefully made high quality fingerprint to defeat TouchID, not an opportunistic one taken from something an unwitting victim left behind. Until they do that, this doesn't really indicate much about how weak TouchID is in the real world.
    - kwonstant 13y ago
      I strongly encourage you to try this and let me know how it turns out. I'll wait.
lawnchair_larry 13y ago
> Most security experts that I know agree that if an intruder has physical access to a device, it can be considered compromised because it is just a matter of time. Anyone who says this is not a security expert. That hasn't been true since full disk encryption became available. A properly encrypted device is a brick if stolen, which is the only reason to have full disk encryption in the first place.
- gjmulhol 13y ago
  Most people outside of this community are not using disk encryption. With that said and the caveat that I am not an encryption expert myself: given an infinite amount of computing power and an infinite amount of time, can full disk encryption not be broken? If so, then it is just a question of computing power and time, not of whether it is possible to get to the data.
  - unimpressive 13y ago
    >given an infinite amount of computing power and an infinite amount of time, can full disk encryption not be broken? Sure. But the difference between "infinite" and "a couple billion years" from a human perspective is minute.
  - lawnchair_larry 13y ago
    Yeah, just a matter of time. Bring a flashlight though, because the sun is projected to burn out far sooner than the largest supercomputer will be able to brute force a 256 bit key.
  - quchen 13y ago
    Combinatorical problems tend to grow in the amount of effort to try out all possible elements quite quickly, and quickly growing things in turns often hit physical limits. The following post on Security.Stackexchange explains it quite nicely; excerpt: the sun doesn't emit enough energy over its lifetime to power an extremely efficient computer able to try all combinations. http://security.stackexchange.com/a/25878/25947 http://security.stackexchange.com/a/25878/25947 So basically we need some new form of computer (one that's not flipping individual physical bits), and not "just faster" ones, to crack certain encryptions by brute force.
300bps 13y ago
I have accidentally seen basically all of my friends' passcodes as they type it in at bars etc. I could get into their phones easily. And your friends could change their password 365 times per year every year for the rest of their lives. With fingerprints, they get 10 password changes.
- nly 13y ago
  20 if they use their toes.
  - cflx 13y ago
    22 if they also use their nipples.
    - anonymouz 13y ago
      Then they'll draw even more attention unlocking it at a bar, though.
    - jlgreco 13y ago
      Does that actually work? I'm having... trouble... googling it.
    - newman314 13y ago
      More if they use their cat's paws. But then again it might not be too convenient to carry said cat around all the time.
- woof 13y ago
  How do you change password with one finger left? I'd say 9 password changes...
parley 13y ago
A comment on another article the other day (can't remember which or I'd link) noted that no-one will magically know your passcode when you sleep or nap, but it might not be too hard for them to gently put your thumb on your phone. One would do well to remember that involuntarily "surrendering" login information doesn't necessarily require hoses or wrenches...

51Cards 13y ago

...2400dpi image of the person's finger... Note: Finger Print, not finger. Here, have a drink out of this freshly washed glass... no, don't worry, I'll wash the glass for you later. :) On the last second point regarding access to a device, I could take a week to make up the fake print during which it won't matter if I have it or not. Since your print isn't changing I just need 5 minutes with your device at any point in the future.

MysticFear 13y ago
Then create a detailed model using said high resolution fingerprint. If someone cares enough about your phone to do that, they can probably break into it by other means anyway (jail break, brute force passcode, etc)
- Groxx 13y ago
  You leave finger prints on the phone. Just snap a photo with a decent camera - it's probably enough detail. Print it. Stick some latex or glue on it (literally available everywhere). That's it. This is not rocket science or time consuming like brute forcing. You don't even have to shoulder-surf to catch their password.
  - sentenza 13y ago
    Importantly, this has been demonstrated. The CCC has been doing it for years and published a howto with material costs in the low one-digit Euro range. http://translate.google.com/translate?sl=de&tl=en&js=n&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fchaosradio.ccc.de%2Fctv001.html http://translate.google.com/translate?sl=de&tl=en&js=n&prev=...
    - melange 13y ago
      Actually it hasn't been demonstrated at all. They dusted a carefully made high quality fingerprint to defeat TouchID, not an opportunistic one taken from something an unwitting victim left behind. Until they do that, this doesn't really indicate much about how weak TouchID is in the real world.
  - kwonstant 13y ago
    I strongly encourage you to try this and let me know how it turns out. I'll wait.

lawnchair_larry 13y ago

> Most security experts that I know agree that if an intruder has physical access to a device, it can be considered compromised because it is just a matter of time. Anyone who says this is not a security expert. That hasn't been true since full disk encryption became available. A properly encrypted device is a brick if stolen, which is the only reason to have full disk encryption in the first place.

gjmulhol 13y ago
Most people outside of this community are not using disk encryption. With that said and the caveat that I am not an encryption expert myself: given an infinite amount of computing power and an infinite amount of time, can full disk encryption not be broken? If so, then it is just a question of computing power and time, not of whether it is possible to get to the data.
- unimpressive 13y ago
  >given an infinite amount of computing power and an infinite amount of time, can full disk encryption not be broken? Sure. But the difference between "infinite" and "a couple billion years" from a human perspective is minute.
- lawnchair_larry 13y ago
  Yeah, just a matter of time. Bring a flashlight though, because the sun is projected to burn out far sooner than the largest supercomputer will be able to brute force a 256 bit key.
- quchen 13y ago
  Combinatorical problems tend to grow in the amount of effort to try out all possible elements quite quickly, and quickly growing things in turns often hit physical limits. The following post on Security.Stackexchange explains it quite nicely; excerpt: the sun doesn't emit enough energy over its lifetime to power an extremely efficient computer able to try all combinations. http://security.stackexchange.com/a/25878/25947 http://security.stackexchange.com/a/25878/25947 So basically we need some new form of computer (one that's not flipping individual physical bits), and not "just faster" ones, to crack certain encryptions by brute force.

300bps 13y ago

I have accidentally seen basically all of my friends' passcodes as they type it in at bars etc. I could get into their phones easily. And your friends could change their password 365 times per year every year for the rest of their lives. With fingerprints, they get 10 password changes.

nly 13y ago
20 if they use their toes.
- cflx 13y ago
  22 if they also use their nipples.
  - anonymouz 13y ago
    Then they'll draw even more attention unlocking it at a bar, though.
  - jlgreco 13y ago
    Does that actually work? I'm having... trouble... googling it.
  - newman314 13y ago
    More if they use their cat's paws. But then again it might not be too convenient to carry said cat around all the time.
woof 13y ago
How do you change password with one finger left? I'd say 9 password changes...

parley 13y ago

A comment on another article the other day (can't remember which or I'd link) noted that no-one will magically know your passcode when you sleep or nap, but it might not be too hard for them to gently put your thumb on your phone. One would do well to remember that involuntarily "surrendering" login information doesn't necessarily require hoses or wrenches...