6 ms·

If we've learned anything over the past few months, it is that security is an illusion when it comes to Google, Apple and Facebook. The fingerprint scanner is

If we've learned anything over the past few months, it is that security is an illusion when it comes to Google, Apple and Facebook. The fingerprint scanner is not intended to protect your personal data from being accessed by nefarious cyber-spooks or crackers. The $5 dollar wrench technique is fairly effective in bypassing such security anyway. The fingerprint scanner is there so that when your phone is nicked by a mugger, they can't reset to factory defaults and sell it on eBay. If some knife wielding thug that robs me of my phone has the intellectual capability of lifting my fingerprints off the case and then using them to bypass the security, he still has to know my AppleID password before he can remove the 'Find my Phone' feature. Give Apple a break. This is just another layer of security. It's _not_ the panacea to all our security woes, and they have never claimed it was.

chmars 13y ago
Giving Apple a break? Just another layer of security? That's not how Apple describes it: http://support.apple.com/kb/HT5949?viewlocale=en_US http://support.apple.com/kb/HT5949?viewlocale=en_US And selling a stolen iPhone on eBay does not need a password or a fingerprint, a jailbreak is enough …
- nobodyshere 13y ago
  Jailbreak is enough... When it exists. And for now it doesn't.
  - arbitrage 13y ago
    taking past trends into consideration, it looks like you're betting on the wrong horse, here. it will exist.
    - Bud 13y ago
      Past trends do indicate that. However, the very recent past indicates that Apple is getting progressively better at foiling jailbreaks. It's taking greenpois0n and those folks longer and longer to crack each successive version of iOS. Took a long time for there to be an untethered jailbreak of iOS 6 and the latest rev of iOS 6 wasn't cracked til about two weeks ago. There was no jailbreak of any kind on the iPhone 5 for several months after its release, which is a long time considering that the time between device generations is one year.
    - tptacek 13y ago
      What are the actual trends on jailbreaks for iOS on current hardware?
    - nobodyshere 13y ago
      Judging by latest Apple TV jailbreak status, it still might never appear.
- cremnob 13y ago
  You linked to a support document explaining how the technology works. You may have had a point if this was listed on their product page describing the feature, but instead you have them touting the convenience of using your finger to unlock your phone and make purchases: You check your iPhone dozens and dozens of times a day, probably more. Entering a passcode each time just slows you down. But you do it because making sure no one else has access to your iPhone is important. With iPhone 5s, getting into your phone is faster, easier, and even a little futuristic. Introducing Touch ID — a new fingerprint identity sensor. Put your finger on the Home button, and just like that your iPhone unlocks. It’s a convenient and highly secure way to access your phone. Your fingerprint can also approve purchases from iTunes Store, the App Store, and the iBooks Store, so you don’t have to enter your password. And Touch ID is capable of 360-degree readability. Which means no matter what its orientation — portrait, landscape, or anything in between — your iPhone reads your fingerprint and knows who you are. And because Touch ID lets you enroll multiple fingerprints, it knows the people you trust, too.
- Bud 13y ago
  Only an idiot would buy a jailbroken phone without a clean ESN on it. Those who do, know what they are getting. And you're forgetting Activation Lock, which a jailbreak will not defeat.
  - lawnchair_larry 13y ago
    That's not true. Most non-idiots that I know have no idea what an ESN even is.
dingaling 13y ago
> The $5 dollar wrench technique I prefer Schneier's original rubber hose technique. Leaves fewer broken bones and bruises, but just as effective.
- WildUtah 13y ago
  Plus, you can't get a decent sized adjustable wrench for less than $15 nowadays. Even the cheap Chinese ones that loosen the parallel alignment on the jaws after a few weeks cost more.
- unsigner 13y ago
  "Thermorectal cryptanalysis" it is called in Russian, and involves a soldering iron.
alecsmart1 13y ago
Agreed. But they always blow it out of proportion. As if the existing fingerprint systems are extremely insecure and theirs is not. The truth is they are all the same- insecure.
- melange 13y ago
  Theirs is better than the standard old fingerprint scanners and far better than using 'nothing' which is what they are replacing. They have blown nothing out of proportion.
  - arbitrage 13y ago
    if it causes people to behave recklessly because they have the false impression of security, when they would otherwise have taken better custodianship of their device and their data, then yes ... it can be worse than nothing.
    - cremnob 13y ago
      That shouldn't be an issue considering most people don't have a passcode set.
      - jonknee 13y ago
        Another option would be to just require a PIN (or both a PIN and fingerprint).
        MBCook 13y ago
        Yeah, that's going to move consumer devices. "Now harder to use!"
    - melange 13y ago
      What would you call more reckless than having no passcode at all?
anjc 13y ago
Regardless of whether or not fingerprint scanners are good security wise, it's a bit silly to think that phone robbing thugs are completely dim. The way it works in my first world modern country is that there are shops everywhere that unlock or reset phones as part of their services, and it isn't thugs running them. It's people with an affinity for 'tech' who just happen to deal with a shadier area. If cracking fingerprint authentication is as easy as this article suggests then there's no doubt that these types of shops will do this readily. Steal a phone -> bring it to a place that does it. The AppleID password is another thing though.
- agsamek 13y ago
  No, this is not the same as sim unlock. Circumventing touch id technology by making fake fingerprints is exactly the same case as being called to unlock a locked doors. The specialist knows when he is liable to crime and cannot make a legal bussines out of illegal access.
  - anjc 13y ago
    Honestly I think you're underestimating the gall of certain businesses. These aren't big multinational chains, they're like booths that pop up and down every year, in the less salubrious parts of town. They might not do it as openly, but there will be places thieves can go to circumvent touch ID if it's hackable...the knife wielding thug wont have to sit in his bedroom fiddling with acetate paper.
furyofantares 13y ago
> he still has to know my AppleID password before he can remove the 'Find my Phone' feature. I don't know if others are experiencing this, but as of iOS 7, that feature turns itself off every time my phone is rebooted.
revelation 13y ago
Stop moving the goalpost.
mcphilip 13y ago
Apple claims that "The technology within Touch ID is some of the most advanced hardware and software we've put in any device." [1]. This attack showed that increasing sensor resolution only requires increasing the resolution on the fake print to match. This attack is an interesting data point in the debate over using biometrics in access control systems. Apple was hyped to have introduced something new and exciting in this space, but it's quickly been shown to not be a significant advance in fingerprint sensor technology. Touch ID, however, is still an adequately secure access control check to be useful to consumers. [1]http://support.apple.com/kb/HT5949?viewlocale=en_US http://support.apple.com/kb/HT5949?viewlocale=en_US
- fastball 13y ago
  Well, since they've never put a fingerprint authentication system in their hardware, I think that their claim still holds...
- chucknelson 13y ago
  > This attack showed that increasing sensor resolution only requires increasing the resolution on the fake print to match. Just to clarify, it wasn't just the increased resolution that was required here, but "latex milk", I assume to simulate a living finger, as well. It's not as simple as print-of-print = unlock.
  - exodust 13y ago
    It's "latex milk" today, tomorrow it might be just "regular milk" that's needed! The point is that the fingerprint security was bypassed so soon after release, and posted on the internet. Sure, it takes a lot of effort with the first generation of this hack. No matter how cool the fingerprint tech is on iPhones, you wouldn't go as far as using it for your master access to your password manager app or bank account app. For the purpose of replacing the lock screen pin, or as others have said, no pin at all, I think it's fine.
  - wiml 13y ago
    Latex milk, white glue, grocery-store gelatin— they all work. You just need something thin and flexible that'll take an impression.
dobbsbob 13y ago
Except where I live there is organized phone snatching. A crew of phone hackers hire drug addicts to yoink phones off transit riders and then pay them 10% of the value. They then go to work on the phone changing the IMEI and I would imagine easily bypassing this fingerprint auth. They make use of the data for fraud purposes and then wipe and sell the phone on the street, a block away from where I live outside a run down sketchy bar. Police caught the "muggers" slipping the phones into faraday bags so they couldn't be remotely wiped which led them to the ringleaders. They were busted but I'm sure there's a new crew doing it
- ricardobeat 13y ago
  I don't think it's possible to change the IMEI on an iPhone at all, and "easily bypassing" touchID involves collecting the user's fingerprint, which I guess is not included in the drug addicts' service offerings.
  - dobbsbob 13y ago
    You can swap the logic board. They sell these for $80 or just trade with somebody who has a backlisted IMEI in UK/Australia for your US blacklisted phone. There's a bunch of crime forums that offer this service
gurkendoktor 13y ago
> It's _not_ the panacea to all our security woes, and they have never claimed it was. But they've never said it wasn't, either. It's important that everyone is in the clear about how secure TouchID is. I'm going to use it anyway, but the other decision is how much personal data I want to store on my phone.
- zimpenfish 13y ago
  TouchID* * Note: TouchID is not the panacea to all our security woes. will not cure cancer, create world peace, does not kill kittens, [continues on listing everything it's not for 9 trillion pages]

chmars 13y ago

Giving Apple a break? Just another layer of security? That's not how Apple describes it: http://support.apple.com/kb/HT5949?viewlocale=en_US http://support.apple.com/kb/HT5949?viewlocale=en_US And selling a stolen iPhone on eBay does not need a password or a fingerprint, a jailbreak is enough …

nobodyshere 13y ago
Jailbreak is enough... When it exists. And for now it doesn't.
- arbitrage 13y ago
  taking past trends into consideration, it looks like you're betting on the wrong horse, here. it will exist.
  - Bud 13y ago
    Past trends do indicate that. However, the very recent past indicates that Apple is getting progressively better at foiling jailbreaks. It's taking greenpois0n and those folks longer and longer to crack each successive version of iOS. Took a long time for there to be an untethered jailbreak of iOS 6 and the latest rev of iOS 6 wasn't cracked til about two weeks ago. There was no jailbreak of any kind on the iPhone 5 for several months after its release, which is a long time considering that the time between device generations is one year.
  - tptacek 13y ago
    What are the actual trends on jailbreaks for iOS on current hardware?
  - nobodyshere 13y ago
    Judging by latest Apple TV jailbreak status, it still might never appear.
cremnob 13y ago
You linked to a support document explaining how the technology works. You may have had a point if this was listed on their product page describing the feature, but instead you have them touting the convenience of using your finger to unlock your phone and make purchases: You check your iPhone dozens and dozens of times a day, probably more. Entering a passcode each time just slows you down. But you do it because making sure no one else has access to your iPhone is important. With iPhone 5s, getting into your phone is faster, easier, and even a little futuristic. Introducing Touch ID — a new fingerprint identity sensor. Put your finger on the Home button, and just like that your iPhone unlocks. It’s a convenient and highly secure way to access your phone. Your fingerprint can also approve purchases from iTunes Store, the App Store, and the iBooks Store, so you don’t have to enter your password. And Touch ID is capable of 360-degree readability. Which means no matter what its orientation — portrait, landscape, or anything in between — your iPhone reads your fingerprint and knows who you are. And because Touch ID lets you enroll multiple fingerprints, it knows the people you trust, too.
Bud 13y ago
Only an idiot would buy a jailbroken phone without a clean ESN on it. Those who do, know what they are getting. And you're forgetting Activation Lock, which a jailbreak will not defeat.
- lawnchair_larry 13y ago
  That's not true. Most non-idiots that I know have no idea what an ESN even is.

dingaling 13y ago

> The $5 dollar wrench technique I prefer Schneier's original rubber hose technique. Leaves fewer broken bones and bruises, but just as effective.

WildUtah 13y ago
Plus, you can't get a decent sized adjustable wrench for less than $15 nowadays. Even the cheap Chinese ones that loosen the parallel alignment on the jaws after a few weeks cost more.
unsigner 13y ago
"Thermorectal cryptanalysis" it is called in Russian, and involves a soldering iron.

alecsmart1 13y ago

Agreed. But they always blow it out of proportion. As if the existing fingerprint systems are extremely insecure and theirs is not. The truth is they are all the same- insecure.

melange 13y ago
Theirs is better than the standard old fingerprint scanners and far better than using 'nothing' which is what they are replacing. They have blown nothing out of proportion.
- arbitrage 13y ago
  if it causes people to behave recklessly because they have the false impression of security, when they would otherwise have taken better custodianship of their device and their data, then yes ... it can be worse than nothing.
  - cremnob 13y ago
    That shouldn't be an issue considering most people don't have a passcode set.
    - jonknee 13y ago
      Another option would be to just require a PIN (or both a PIN and fingerprint).
      - MBCook 13y ago
        Yeah, that's going to move consumer devices. "Now harder to use!"
  - melange 13y ago
    What would you call more reckless than having no passcode at all?

anjc 13y ago

Regardless of whether or not fingerprint scanners are good security wise, it's a bit silly to think that phone robbing thugs are completely dim. The way it works in my first world modern country is that there are shops everywhere that unlock or reset phones as part of their services, and it isn't thugs running them. It's people with an affinity for 'tech' who just happen to deal with a shadier area. If cracking fingerprint authentication is as easy as this article suggests then there's no doubt that these types of shops will do this readily. Steal a phone -> bring it to a place that does it. The AppleID password is another thing though.

agsamek 13y ago
No, this is not the same as sim unlock. Circumventing touch id technology by making fake fingerprints is exactly the same case as being called to unlock a locked doors. The specialist knows when he is liable to crime and cannot make a legal bussines out of illegal access.
- anjc 13y ago
  Honestly I think you're underestimating the gall of certain businesses. These aren't big multinational chains, they're like booths that pop up and down every year, in the less salubrious parts of town. They might not do it as openly, but there will be places thieves can go to circumvent touch ID if it's hackable...the knife wielding thug wont have to sit in his bedroom fiddling with acetate paper.

furyofantares 13y ago

> he still has to know my AppleID password before he can remove the 'Find my Phone' feature. I don't know if others are experiencing this, but as of iOS 7, that feature turns itself off every time my phone is rebooted.

revelation 13y ago

Stop moving the goalpost.

mcphilip 13y ago

Apple claims that "The technology within Touch ID is some of the most advanced hardware and software we've put in any device." [1]. This attack showed that increasing sensor resolution only requires increasing the resolution on the fake print to match. This attack is an interesting data point in the debate over using biometrics in access control systems. Apple was hyped to have introduced something new and exciting in this space, but it's quickly been shown to not be a significant advance in fingerprint sensor technology. Touch ID, however, is still an adequately secure access control check to be useful to consumers. [1]http://support.apple.com/kb/HT5949?viewlocale=en_US http://support.apple.com/kb/HT5949?viewlocale=en_US

fastball 13y ago
Well, since they've never put a fingerprint authentication system in their hardware, I think that their claim still holds...
chucknelson 13y ago
> This attack showed that increasing sensor resolution only requires increasing the resolution on the fake print to match. Just to clarify, it wasn't just the increased resolution that was required here, but "latex milk", I assume to simulate a living finger, as well. It's not as simple as print-of-print = unlock.
- exodust 13y ago
  It's "latex milk" today, tomorrow it might be just "regular milk" that's needed! The point is that the fingerprint security was bypassed so soon after release, and posted on the internet. Sure, it takes a lot of effort with the first generation of this hack. No matter how cool the fingerprint tech is on iPhones, you wouldn't go as far as using it for your master access to your password manager app or bank account app. For the purpose of replacing the lock screen pin, or as others have said, no pin at all, I think it's fine.
- wiml 13y ago
  Latex milk, white glue, grocery-store gelatin— they all work. You just need something thin and flexible that'll take an impression.

dobbsbob 13y ago

Except where I live there is organized phone snatching. A crew of phone hackers hire drug addicts to yoink phones off transit riders and then pay them 10% of the value. They then go to work on the phone changing the IMEI and I would imagine easily bypassing this fingerprint auth. They make use of the data for fraud purposes and then wipe and sell the phone on the street, a block away from where I live outside a run down sketchy bar. Police caught the "muggers" slipping the phones into faraday bags so they couldn't be remotely wiped which led them to the ringleaders. They were busted but I'm sure there's a new crew doing it

ricardobeat 13y ago
I don't think it's possible to change the IMEI on an iPhone at all, and "easily bypassing" touchID involves collecting the user's fingerprint, which I guess is not included in the drug addicts' service offerings.
- dobbsbob 13y ago
  You can swap the logic board. They sell these for $80 or just trade with somebody who has a backlisted IMEI in UK/Australia for your US blacklisted phone. There's a bunch of crime forums that offer this service

gurkendoktor 13y ago

> It's _not_ the panacea to all our security woes, and they have never claimed it was. But they've never said it wasn't, either. It's important that everyone is in the clear about how secure TouchID is. I'm going to use it anyway, but the other decision is how much personal data I want to store on my phone.

zimpenfish 13y ago
TouchID* * Note: TouchID is not the panacea to all our security woes. will not cure cancer, create world peace, does not kill kittens, [continues on listing everything it's not for 9 trillion pages]