10 ms·

Just to keep things in perspective, the goal of Touch ID is not to be unhackable. The goal is to get more consumers to move from zero security to pretty good se

by abalone 13y ago

Just to keep things in perspective, the goal of Touch ID is not to be unhackable. The goal is to get more consumers to move from zero security to pretty good security. A very large number of people don't put any kind of passcode of any kind on their phone, simply because it's inconvenient. Touch ID is designed for them. It's not designed to secure nuclear footballs. Touch ID is going to massively reduce the number of totally unsecured iPhones that require zero effort to access. That's the goal. I think some people see "fingerprint scanner" and think "military-grade security" because that's where we've seen scanners before in movies and such. But this is really very much a solution for the consumer market, where convenience and usability are critical features of a security system. Sometimes infosec folks forget that. If you make it too hard to use (passcodes), people just bypass it. So you can blame the user, or you can try to design something easier to use. If in the end you've improved the overall security landscape, you've succeeded. I think that's what Apple is doing here.

ParkerK 13y ago
>Just to keep things in perspective, the goal of Touch ID is not to be unhackable. The goal is to get more consumers to move from zero security to pretty good security. Agreed. Complaining about this hack would be like people saying locks are "hackable" if you steal someones key and make a copy. There's always a way around any system, if a criminal is dedicated enough to get past it.
jonknee 13y ago
Here's Apple's main marketing text on the subject: > Put your finger on the Home button, and just like that your iPhone unlocks. It’s a convenient and highly secure way to access your phone. Your fingerprint can also approve purchases from iTunes Store, the App Store, and the iBooks Store, so you don’t have to enter your password. It is definitely intended to replace passwords. Pretty good security would be to require both the fingerprint and a PIN (for unlocking the phone, at that stage a fingerprint is fine for authenticating iTunes' digital purchases).
- DigitalJack 13y ago
  That's a matter of opinion, not fact.
  - jonknee 13y ago
    What's the opinion? Apple said you can use this to replace your password. No one had an iTunes Store account without a password before, so this would 100% be replacing a password.
    - k-mcgrady 13y ago
      >> "Pretty good security would be to require both the fingerprint and a PIN (for unlocking the phone, at that stage a fingerprint is fine for authenticating iTunes' digital purchases)." I believe that's the opinion being referred to.
      - DigitalJack 13y ago
        Yes, thanks.
    - fastball 13y ago
      Actually, I did. I have a tweak from Cydia which autocompletes my Apple ID password when making a purchase from the App/iTunes Store.
      - biot 13y ago
        If it autocompletes your name as well, would you say you don't have a name?
    - deleted 13y ago
      [deleted]
- YOSPOS 13y ago
  The full marketing text on the subject: >You check your iPhone dozens and dozens of times a day, probably more. Entering a passcode each time just slows you down. But you do it because making sure no one else has access to your iPhone is important. With iPhone 5s, getting into your phone is faster, easier, and even a little futuristic. Introducing Touch ID — a new fingerprint identity sensor. Put your finger on the Home button, and just like that your iPhone unlocks. It’s a convenient and highly secure way to access your phone. Your fingerprint can also approve purchases from iTunes Store, the App Store, and the iBooks Store, so you don’t have to enter your password. And Touch ID is capable of 360-degree readability. Which means no matter what its orientation — portrait, landscape, or anything in between — your iPhone reads your fingerprint and knows who you are. And because Touch ID lets you enroll multiple fingerprints, it knows the people you trust, too.
DasIch 13y ago
Touch ID is not "pretty good security" it's not even "good security" it's simply very bad security. Touch ID is better than nothing and that people use Touch ID instead of nothing is better than the current state but not by much and this definitely isn't a huge achievement. Which is really the biggest issue with Touch ID, it's advertised as such and people believe it.
- x0054 13y ago
  I was going to argue with your statements but than I turned the screen in my phone off and realized that the front part of the screen is covered with my thumb prints, and they are ripe for photographing.
- mike-cardwell 13y ago
  I'd be willing to bet that over the next couple of years millions of people will try to log into somebodys iPhone that they shouldn't have access to, but in the process are prevented from doing so by the fingerprint based security. I also bet, in 99.9999% or more of those cases, the attacker doesn't even attempt to bypass the security by faking the users fingerprint. I'd also be willing to bet that these figures are substantially better than the current situation where people don't bother to lock their phone at all. People will use it because it's a gimmick, not because of it's security properties, but it will still work.
  - vdaniuk 13y ago
    But you have to consider potential damage from the successful attack. It doesn't matter if 99% of low damage attacks are unsuccessful but 1% high damage attacks will go through. The solution is fine by itself but millions of people will use it and not understand the real level of protection.
    - solarmist 13y ago
      Well right now I'd guess that the percent of high damage attacks that go through are significantly higher than 1%, so lowering that to "1%" isn't an improvement?
squidi 13y ago
To corroborate your point, here is the transcript from the 5S launch: "The third feature is all about security. Now we have so much personal information on our devices that we want to protect. <snipped> So we have to protect them. The most common wave of course is to set up a passcode. Simple four digit passcode or more complex one if you want. This is something you do, dozens of times a day to unlock and get access to your phone. Unfortunately, some people find that's too cumbersome and they don't set it up. In fact in our research about half of smartphone customers do not set up a passcode on the device and they really, really should. That's the team has worked so hard in the brand new technology to make this easy and fun to do." http://www.earningsimpact.com/Transcript/83555/AAPL/Launch-of-iPhone5S-Keynote/ http://www.earningsimpact.com/Transcript/83555/AAPL/Launch-o...
revelation 13y ago
Right. Yesterday, people clamored for a browser API to allow for that stuff to login, now that it is broken it has magically morphed into a mere 'convenience feature', a sidenote, a little fix. (Of course, this post ends with Apple has succeeded. Sigh.)
Steko 13y ago
This seems correct. Apple's moved the bar to breaking into those phones from having the phone and a 4 digit or no passcode to having: -- the phone -- a 2400 dpi resolution image of the correct fingerprint -- a 1200 dpi laser printer & transparent paper -- pink latex milk or white woodglue -- a non-trivial amount of time
- javajosh 13y ago
  That's what I was thinking, too. The fingerprint scanner is a bit like a LoJack - it's still possible to steal a car with a "The Club" on it, but most thieves will probably just move on to another car (although I've heard that car thieves, like pick pockets, don't really steal cars anymore, just components and loose gear.)
  - codfrantic 13y ago
    >although I've heard that car thieves, like pick pockets, don't really steal cars anymore, just components and loose gear. I heard that too, airbags, satnav and entertainment systems are the target...
- XorNot 13y ago
  The problem here is your implying getting past the 4 digit code is substantially easier then cloning a finger print. The code is in someone's head, or you have to deconvolute it from screen smudges. Your fingerprints are literally everywhere you go.
  - mmorris 13y ago
    I think it would be pretty easy to get many people's phone password -- just by being in the right place when they unlock it, and watching closely. Most people I know don't cover up their phone at all when they enter it, even in public. So you don't need to get "in someone's head". You just need a good view of them using it. Granted, getting an iTunes Store password by just watching would be a lot harder. But compared to the 4-digit lock screen pw (or even the Android shape pw) TouchID seems a bit more secure, at least to me.
imd23 13y ago
I don't put any passcode because thieves will throw aways SIM card and they won't be able to connect to wifi/internet. Then I will not be able to track it. Apple should implement a way to let them connect wifi and browse basic stuff like a "guest" mode. Meanwhile we track them.
hrktb 13y ago
> The goal is to get more consumers to move from zero security to pretty good security. One might argue that Touch ID is too strong to be used where there was no security before. In an arms race with thefts and hackers, leaping too far forwards might not be the best option in the long term.
- seanmcdirmid 13y ago
  Thefts are not limited by passwords, the thief will just reset the phone.
  - hrktb 13y ago
    I don't know, reproducing a fingerprint is relatively easy to understand (just scan and print), while cracking a password can be more exotic to 'traditional' thieves. When today they'd just wipe the phone, tomorrow they make take the extra step of pulling out the SIM card and unlock with the fingerprint, and sell the data as well.
    - seanmcdirmid 13y ago
      Your random thief is more worried about cell phone tracking than any data you have on your phone. They will wipe it as soon as possible today, and probably for the next few years; they don't give a crap about your cat photos. Even if your phone was unlocked, they probably wouldn't bother more than a cursory glance. They have more phones to steal than to bother with is on some random person's phone. When the data is important, the theft will be more targeted.
      - hrktb 13y ago
        I see where this assumption comes from, but scraping the personal info off a phone is a thing, and "random thieves" might be the minority when it comes to stealing and reselling phones (at least in europe or asia they are rarely random. It don't know for the US). I haven't heard of it recently, but a few years ago there was a story on phone operator temporary staff that would offer clients to move their contact info from their old phone to the new one (it's a completely legit service) and keep a backup of the old info to sell it. The price for an entry was something like 2 cents, but data would be sold by batches for about 700~800 dollars. I didn't find any quick resources in english, just for the numbers there was this piece by trendmicro (to note, they are of course biased to make the number a littre bigger) http://blog.trendmicro.co.jp/archives/4828 http://blog.trendmicro.co.jp/archives/4828
laureny 13y ago
> Touch ID is going to massively reduce the number of totally unsecured iPhones that require zero effort to access. I feel like we just went through this very same drill with the Chrome team refusing to hide web site passwords behind a master password, something that all browsers, except Chrome, support. Given how stubborn the Chrome team has been in its handling of this situation, I think fighting that TouchId battle is going to be equally challenging. Common sense is, sadly, not very common, not even among the security circles.
myko 13y ago
I agree. This is just like face unlock on Android. A nice feature, but not bulletproof.
billsix 13y ago
I took a security class where, amongst other things, we learned how to pick locks. After we learned how to do so with provided equipment, the instructor said "So since these locks are insecure, should I have them in my home? Yes, because if a motivated intruder wanted to come into my home, I still have windows."
asabjorn 13y ago
What worries me the most is that biometrics can be used to authorize payments, and for anyone that has crafty teenage (or younger) kinds this might sounds a bit risky. Getting access to your parents fingerprint is easy while getting access to their password is much harder.
- estel 13y ago
  Getting access to the equipment required to duplicate their fingerprint is much harder...
r0h1n 13y ago
Except, there is a larger point that CCC is making: > fingerprint biometrics is unsuitable as access control method and should be avoided. What happens when the next set of hackers figure out how to remotely access and extract the fingerprints (hashed, secured, whatever) stored on the iPhone itself?
- bobbles 13y ago
  I don't really think it is relevant. The iTunes authorisation for example wouldn't be sent the fingerprint information, it would be sent the response 'yes the person passed the test'. The fingerprint information stored in the 'secure enclave' of the A7 is a combination of the data related to the fingerprint combined with unique information for that specific device. So even if the data could be extracted, using it for any purpose other than unlocking that specific phone would be impossible.
  - lawnchair_larry 13y ago
    >I don't really think it is relevant. The iTunes authorisation for example wouldn't be sent the fingerprint information, it would be sent the response 'yes the person passed the test'. No, it wouldn't send that response at all. That's called a client-side security control, and I'm sure you can think of why that's out of the question in any system.
    - nucleardog 13y ago
      I don't want to jump in on the "how secure is my phone discussion", I just wanted to point out that with all the revelations and concerns regarding privacy, a single company having fingerprints for some significant portion of North America is nothing to be taken lightly. That said, I sincerely doubt this is the case. I imagine the phone acts as a proxy for the authentication, validating the fingerprint then sending some other form of authorization to Apple or using the fingerprint as input to a cryptographic algorothm.
      - hvidgaard 13y ago
smithzvk 13y ago
Usually when I see smart people talking about security, they think about what attack vector/situation you are trying to protect against. In this case, the situation you are trying to protect against is not keeping your phone locked when you are in custody or at gun point. The situation is someone unlocking your phone if someone swipes it from your pocket, you lose your phone, or simply leave it on your desk for a few moments as you go to the bathroom at the office. So, yes, a biometric scanner, even one that is easily beaten by an attacker, is good for this purpose. Whatever the case, maybe we should step back and get some more perspective. How many of us don't put locks on our shared computers and phones because we don't want the inconvenience of ensuring everybody that should be allowed to use it can? My phone is a shared device and I removed any and all locks on it as I got very tired of "oh, let me unlock that for you." Basically, I want everybody that can reach it physically (when it isn't lost or stolen) to be able to access it and make calls, surf the web, use the map, search contacts, play games, etc. Is any phone locking mechanism going to work perfectly, probably not. Being able to set up my phone to unlock for anybody in my family and friends circle by something like fingerprints is a pretty good start.
JimmaDaRustla 13y ago
Piss poor excuse - think of all the users using a password now downgrading their security, but Apple advertising it as "high security". I like what you're saying, massively allow users to secure their phones without the pain of entering a password, but when it comes at a compromise of "little is better than none" is not the mentality people need for security. I'd rather see corporations rewarding and encouraging proper security strategies rather than creating some compromise for marketing.
- deveac 13y ago
  >Piss poor excuse - think of all the users using a password now downgrading their security, but Apple advertising it as "high security". If you're talking aggregate security, TouchID will still increase security (even with current PIN users moving to a FP Scan) as currently about 50% don't use any sort of pass code now. If you're talking about the ability for current PIN users to maintain their level of security if they wish, -they can still use a PIN. Bottom line is that there will be fewer successful unauthorized login attempts in the wild.
desouzt 13y ago
That comment perfectly sums up what I have been trying to argue with friends the last day or two! Thank you! Presuming you don't mind I will send this over to them!
donutz 13y ago
"Touch ID is going to massively reduce the number of totally unsecured iPhones that require zero effort to access. That's the goal." ...while lowering the security of a massive number of iPhones previously secured by PINs.
JoachimS 13y ago
If users not using any PIN is moving to TouchID then it is good. If users using PIN moves to TouchID then it is not as sunny.

by abalone 13y ago

ParkerK 13y ago

>Just to keep things in perspective, the goal of Touch ID is not to be unhackable. The goal is to get more consumers to move from zero security to pretty good security. Agreed. Complaining about this hack would be like people saying locks are "hackable" if you steal someones key and make a copy. There's always a way around any system, if a criminal is dedicated enough to get past it.

jonknee 13y ago

Here's Apple's main marketing text on the subject: > Put your finger on the Home button, and just like that your iPhone unlocks. It’s a convenient and highly secure way to access your phone. Your fingerprint can also approve purchases from iTunes Store, the App Store, and the iBooks Store, so you don’t have to enter your password. It is definitely intended to replace passwords. Pretty good security would be to require both the fingerprint and a PIN (for unlocking the phone, at that stage a fingerprint is fine for authenticating iTunes' digital purchases).

DigitalJack 13y ago
That's a matter of opinion, not fact.
- jonknee 13y ago
  What's the opinion? Apple said you can use this to replace your password. No one had an iTunes Store account without a password before, so this would 100% be replacing a password.
  - k-mcgrady 13y ago
    >> "Pretty good security would be to require both the fingerprint and a PIN (for unlocking the phone, at that stage a fingerprint is fine for authenticating iTunes' digital purchases)." I believe that's the opinion being referred to.
    - DigitalJack 13y ago
      Yes, thanks.
  - fastball 13y ago
    Actually, I did. I have a tweak from Cydia which autocompletes my Apple ID password when making a purchase from the App/iTunes Store.
    - biot 13y ago
      If it autocompletes your name as well, would you say you don't have a name?
  - deleted 13y ago
    [deleted]
YOSPOS 13y ago
The full marketing text on the subject: >You check your iPhone dozens and dozens of times a day, probably more. Entering a passcode each time just slows you down. But you do it because making sure no one else has access to your iPhone is important. With iPhone 5s, getting into your phone is faster, easier, and even a little futuristic. Introducing Touch ID — a new fingerprint identity sensor. Put your finger on the Home button, and just like that your iPhone unlocks. It’s a convenient and highly secure way to access your phone. Your fingerprint can also approve purchases from iTunes Store, the App Store, and the iBooks Store, so you don’t have to enter your password. And Touch ID is capable of 360-degree readability. Which means no matter what its orientation — portrait, landscape, or anything in between — your iPhone reads your fingerprint and knows who you are. And because Touch ID lets you enroll multiple fingerprints, it knows the people you trust, too.

DasIch 13y ago

Touch ID is not "pretty good security" it's not even "good security" it's simply very bad security. Touch ID is better than nothing and that people use Touch ID instead of nothing is better than the current state but not by much and this definitely isn't a huge achievement. Which is really the biggest issue with Touch ID, it's advertised as such and people believe it.

x0054 13y ago
I was going to argue with your statements but than I turned the screen in my phone off and realized that the front part of the screen is covered with my thumb prints, and they are ripe for photographing.
mike-cardwell 13y ago
I'd be willing to bet that over the next couple of years millions of people will try to log into somebodys iPhone that they shouldn't have access to, but in the process are prevented from doing so by the fingerprint based security. I also bet, in 99.9999% or more of those cases, the attacker doesn't even attempt to bypass the security by faking the users fingerprint. I'd also be willing to bet that these figures are substantially better than the current situation where people don't bother to lock their phone at all. People will use it because it's a gimmick, not because of it's security properties, but it will still work.
- vdaniuk 13y ago
  But you have to consider potential damage from the successful attack. It doesn't matter if 99% of low damage attacks are unsuccessful but 1% high damage attacks will go through. The solution is fine by itself but millions of people will use it and not understand the real level of protection.
  - solarmist 13y ago
    Well right now I'd guess that the percent of high damage attacks that go through are significantly higher than 1%, so lowering that to "1%" isn't an improvement?

squidi 13y ago

To corroborate your point, here is the transcript from the 5S launch: "The third feature is all about security. Now we have so much personal information on our devices that we want to protect. <snipped> So we have to protect them. The most common wave of course is to set up a passcode. Simple four digit passcode or more complex one if you want. This is something you do, dozens of times a day to unlock and get access to your phone. Unfortunately, some people find that's too cumbersome and they don't set it up. In fact in our research about half of smartphone customers do not set up a passcode on the device and they really, really should. That's the team has worked so hard in the brand new technology to make this easy and fun to do." http://www.earningsimpact.com/Transcript/83555/AAPL/Launch-of-iPhone5S-Keynote/ http://www.earningsimpact.com/Transcript/83555/AAPL/Launch-o...

revelation 13y ago

Right. Yesterday, people clamored for a browser API to allow for that stuff to login, now that it is broken it has magically morphed into a mere 'convenience feature', a sidenote, a little fix. (Of course, this post ends with Apple has succeeded. Sigh.)

Steko 13y ago

This seems correct. Apple's moved the bar to breaking into those phones from having the phone and a 4 digit or no passcode to having: -- the phone -- a 2400 dpi resolution image of the correct fingerprint -- a 1200 dpi laser printer & transparent paper -- pink latex milk or white woodglue -- a non-trivial amount of time

javajosh 13y ago
That's what I was thinking, too. The fingerprint scanner is a bit like a LoJack - it's still possible to steal a car with a "The Club" on it, but most thieves will probably just move on to another car (although I've heard that car thieves, like pick pockets, don't really steal cars anymore, just components and loose gear.)
- codfrantic 13y ago
  >although I've heard that car thieves, like pick pockets, don't really steal cars anymore, just components and loose gear. I heard that too, airbags, satnav and entertainment systems are the target...
XorNot 13y ago
The problem here is your implying getting past the 4 digit code is substantially easier then cloning a finger print. The code is in someone's head, or you have to deconvolute it from screen smudges. Your fingerprints are literally everywhere you go.
- mmorris 13y ago
  I think it would be pretty easy to get many people's phone password -- just by being in the right place when they unlock it, and watching closely. Most people I know don't cover up their phone at all when they enter it, even in public. So you don't need to get "in someone's head". You just need a good view of them using it. Granted, getting an iTunes Store password by just watching would be a lot harder. But compared to the 4-digit lock screen pw (or even the Android shape pw) TouchID seems a bit more secure, at least to me.

imd23 13y ago

I don't put any passcode because thieves will throw aways SIM card and they won't be able to connect to wifi/internet. Then I will not be able to track it. Apple should implement a way to let them connect wifi and browse basic stuff like a "guest" mode. Meanwhile we track them.

hrktb 13y ago

> The goal is to get more consumers to move from zero security to pretty good security. One might argue that Touch ID is too strong to be used where there was no security before. In an arms race with thefts and hackers, leaping too far forwards might not be the best option in the long term.

seanmcdirmid 13y ago
Thefts are not limited by passwords, the thief will just reset the phone.
- hrktb 13y ago
  I don't know, reproducing a fingerprint is relatively easy to understand (just scan and print), while cracking a password can be more exotic to 'traditional' thieves. When today they'd just wipe the phone, tomorrow they make take the extra step of pulling out the SIM card and unlock with the fingerprint, and sell the data as well.
  - seanmcdirmid 13y ago
    Your random thief is more worried about cell phone tracking than any data you have on your phone. They will wipe it as soon as possible today, and probably for the next few years; they don't give a crap about your cat photos. Even if your phone was unlocked, they probably wouldn't bother more than a cursory glance. They have more phones to steal than to bother with is on some random person's phone. When the data is important, the theft will be more targeted.
    - hrktb 13y ago
      I see where this assumption comes from, but scraping the personal info off a phone is a thing, and "random thieves" might be the minority when it comes to stealing and reselling phones (at least in europe or asia they are rarely random. It don't know for the US). I haven't heard of it recently, but a few years ago there was a story on phone operator temporary staff that would offer clients to move their contact info from their old phone to the new one (it's a completely legit service) and keep a backup of the old info to sell it. The price for an entry was something like 2 cents, but data would be sold by batches for about 700~800 dollars. I didn't find any quick resources in english, just for the numbers there was this piece by trendmicro (to note, they are of course biased to make the number a littre bigger) http://blog.trendmicro.co.jp/archives/4828 http://blog.trendmicro.co.jp/archives/4828

laureny 13y ago

> Touch ID is going to massively reduce the number of totally unsecured iPhones that require zero effort to access. I feel like we just went through this very same drill with the Chrome team refusing to hide web site passwords behind a master password, something that all browsers, except Chrome, support. Given how stubborn the Chrome team has been in its handling of this situation, I think fighting that TouchId battle is going to be equally challenging. Common sense is, sadly, not very common, not even among the security circles.

myko 13y ago

I agree. This is just like face unlock on Android. A nice feature, but not bulletproof.

billsix 13y ago

I took a security class where, amongst other things, we learned how to pick locks. After we learned how to do so with provided equipment, the instructor said "So since these locks are insecure, should I have them in my home? Yes, because if a motivated intruder wanted to come into my home, I still have windows."

asabjorn 13y ago

What worries me the most is that biometrics can be used to authorize payments, and for anyone that has crafty teenage (or younger) kinds this might sounds a bit risky. Getting access to your parents fingerprint is easy while getting access to their password is much harder.

estel 13y ago
Getting access to the equipment required to duplicate their fingerprint is much harder...

r0h1n 13y ago

Except, there is a larger point that CCC is making: > fingerprint biometrics is unsuitable as access control method and should be avoided. What happens when the next set of hackers figure out how to remotely access and extract the fingerprints (hashed, secured, whatever) stored on the iPhone itself?

bobbles 13y ago
I don't really think it is relevant. The iTunes authorisation for example wouldn't be sent the fingerprint information, it would be sent the response 'yes the person passed the test'. The fingerprint information stored in the 'secure enclave' of the A7 is a combination of the data related to the fingerprint combined with unique information for that specific device. So even if the data could be extracted, using it for any purpose other than unlocking that specific phone would be impossible.
- lawnchair_larry 13y ago
  >I don't really think it is relevant. The iTunes authorisation for example wouldn't be sent the fingerprint information, it would be sent the response 'yes the person passed the test'. No, it wouldn't send that response at all. That's called a client-side security control, and I'm sure you can think of why that's out of the question in any system.
  - nucleardog 13y ago
    I don't want to jump in on the "how secure is my phone discussion", I just wanted to point out that with all the revelations and concerns regarding privacy, a single company having fingerprints for some significant portion of North America is nothing to be taken lightly. That said, I sincerely doubt this is the case. I imagine the phone acts as a proxy for the authentication, validating the fingerprint then sending some other form of authorization to Apple or using the fingerprint as input to a cryptographic algorothm.
    - hvidgaard 13y ago

smithzvk 13y ago

Usually when I see smart people talking about security, they think about what attack vector/situation you are trying to protect against. In this case, the situation you are trying to protect against is not keeping your phone locked when you are in custody or at gun point. The situation is someone unlocking your phone if someone swipes it from your pocket, you lose your phone, or simply leave it on your desk for a few moments as you go to the bathroom at the office. So, yes, a biometric scanner, even one that is easily beaten by an attacker, is good for this purpose. Whatever the case, maybe we should step back and get some more perspective. How many of us don't put locks on our shared computers and phones because we don't want the inconvenience of ensuring everybody that should be allowed to use it can? My phone is a shared device and I removed any and all locks on it as I got very tired of "oh, let me unlock that for you." Basically, I want everybody that can reach it physically (when it isn't lost or stolen) to be able to access it and make calls, surf the web, use the map, search contacts, play games, etc. Is any phone locking mechanism going to work perfectly, probably not. Being able to set up my phone to unlock for anybody in my family and friends circle by something like fingerprints is a pretty good start.

JimmaDaRustla 13y ago

Piss poor excuse - think of all the users using a password now downgrading their security, but Apple advertising it as "high security". I like what you're saying, massively allow users to secure their phones without the pain of entering a password, but when it comes at a compromise of "little is better than none" is not the mentality people need for security. I'd rather see corporations rewarding and encouraging proper security strategies rather than creating some compromise for marketing.

deveac 13y ago
>Piss poor excuse - think of all the users using a password now downgrading their security, but Apple advertising it as "high security". If you're talking aggregate security, TouchID will still increase security (even with current PIN users moving to a FP Scan) as currently about 50% don't use any sort of pass code now. If you're talking about the ability for current PIN users to maintain their level of security if they wish, -they can still use a PIN. Bottom line is that there will be fewer successful unauthorized login attempts in the wild.

desouzt 13y ago

That comment perfectly sums up what I have been trying to argue with friends the last day or two! Thank you! Presuming you don't mind I will send this over to them!

donutz 13y ago

"Touch ID is going to massively reduce the number of totally unsecured iPhones that require zero effort to access. That's the goal." ...while lowering the security of a massive number of iPhones previously secured by PINs.

JoachimS 13y ago

If users not using any PIN is moving to TouchID then it is good. If users using PIN moves to TouchID then it is not as sunny.