8 ms·

Touch ID is not "pretty good security" it's not even "good security" it's simply very bad security. Touch ID is better than nothing and that people use Touch I

by DasIch 13y ago

Touch ID is not "pretty good security" it's not even "good security" it's simply very bad security. Touch ID is better than nothing and that people use Touch ID instead of nothing is better than the current state but not by much and this definitely isn't a huge achievement. Which is really the biggest issue with Touch ID, it's advertised as such and people believe it.

x0054 13y ago
I was going to argue with your statements but than I turned the screen in my phone off and realized that the front part of the screen is covered with my thumb prints, and they are ripe for photographing.
mike-cardwell 13y ago
I'd be willing to bet that over the next couple of years millions of people will try to log into somebodys iPhone that they shouldn't have access to, but in the process are prevented from doing so by the fingerprint based security. I also bet, in 99.9999% or more of those cases, the attacker doesn't even attempt to bypass the security by faking the users fingerprint. I'd also be willing to bet that these figures are substantially better than the current situation where people don't bother to lock their phone at all. People will use it because it's a gimmick, not because of it's security properties, but it will still work.
- vdaniuk 13y ago
  But you have to consider potential damage from the successful attack. It doesn't matter if 99% of low damage attacks are unsuccessful but 1% high damage attacks will go through. The solution is fine by itself but millions of people will use it and not understand the real level of protection.
  - solarmist 13y ago
    Well right now I'd guess that the percent of high damage attacks that go through are significantly higher than 1%, so lowering that to "1%" isn't an improvement?
  - Bud 13y ago
    The potential damage is zero. You (and everyone else in this thread) are forgetting that you can't steal an iPhone for more than 30 seconds anymore without Activation Lock locking you and everyone else out, forever, period, paragraph. Activation Lock + Touch ID = all the security that almost anyone needs on a phone and much higher security than any of us have been used to up to now.
    - yaeger 13y ago
      I think this is key here. Before, you could try and lock or wipe your phone when it was stolen. But in order for it to work the thief must have let it powered on. If he was smart and shut it off, took it home and booted into DFU mode to restore a the thing back to factory settings, you were out of luck. But with the new Activation Lock, it supposedly doesn't matter if it is shut down, the minute someone tries to flash the phone. Be it normally via iTunes or via DFU mode and iTunes there should appear a message that the phone has been wiped and must be unlocked with the iCloud password of the account that did the wiping. So no chance to flash the phone back to factory settings.
fastball 13y ago
Using the method employed by the CCC to break the security is not trivial...
YOSPOS 13y ago
>Touch ID is better than nothing and that people use Touch ID instead of nothing is better than the current state That makes it great security.
jlmorton 13y ago
While I don't have data to back it up, I believe most Android users use the draw pattern to unlock method. This feature is absolutely trivial to defeat - you can simply hold the phone up to the light, see the trails of oil left on the phone, and follow that trail. People have done this to my own phone with just a few tries. TouchID represents a massive increase in security over draw pattern to unlock, and it's easier to use at the same time. It probably also represents an increase in security over 4 digit PIN codes, though that's shakier.
- dannyr 13y ago
  People actually do other actions on their phone after unlocking it. If somebody swipes on their homescreen, browse the web, etc, the trail would not be just the unlock pattern. The exploit you're talking about may work if you get hold of the phone right after the user unlocks it since the trail only has the pattern.
  - tcoppi 13y ago
    It also doesn't work nearly as well if you are OCD about wiping your screen often, not that that makes the pattern lock any better but it isn't quite that trivial to defeat
  - jlmorton 13y ago
    True enough, there is other "noise" on the phone, in the form of point-like finger prints, and even other trails. But you're imagining a blank phone, where you have to try and discern one trail from another. Now turn the phone on, and the unlock background appears. Which trails intersect all of the dots of the unlock background? It's much easier that you imagine. I've been using my phone as I normally do throughout the day, and I can see the unlock pattern clearly on the phone.
    - eru 13y ago
      That's why you need a unlock pattern that intersects / overlaps itself. (Not foolproof, just makes that attack harder.)
kevinpet 13y ago
Touch ID is competing against pins chosen from a universe of 10,000. This isn't great security, but it's appropriate security for unlocking a device you already must have physical access to.
- dsuth 13y ago
  Actually doesn't that highlight one of the biggest flaws with this, in that your finger prints will already be all over the device? Lift the device, get the authorisation token for free. At least with a password you also need to either crack it or discover it from some other means.
  - travisp 13y ago
    So far, nobody has demonstrated an attack that is able to break the fingerprint reader by reading fingerprints off of the device (or another surface). The attack demonstrated by CCC requires them to take a high resolution photograph of your finger. It is likely substantially harder to just lift a good enough quality fingerprint to defeat the system.
abalone 13y ago
> Touch ID is better than nothing... but not by much You can't be serious. A completely unlocked phone that anybody can trivially access with a swipe.. vs. a scanner that you'd have to lift and reconstruct someone's fingerprint to bypass. That is definitely a significant improvement.
- taproot 13y ago
  > That is definitely a significant improvement. Sure is a significant improvement for some people at least. http://t.co/EK3sdeloUX http://t.co/EK3sdeloUX
  - jamesaguilar 13y ago
    Baseless FUD is OK as long as Linux ain't the target, right?
    - taproot 13y ago
      Where the fuck did that come from? It is neither baseless or FUD. That fingerprint will be sent over the wire at some point and the NSA will gladly pick it up. How you think otherwise is beyond me. What operating system I prefer really has nothing to do with it, even if it is linux. Posted from my iPhone, android, third mac mini, 2nd mac air, or first thinkpad who the fuck knows (or cares? oh you obviously)
      - jbraithwaite 13y ago
        From Apple's site [1]: > Touch ID does not store any images of your fingerprint. It stores only a mathematical representation of your fingerprint. > The Secure Enclave is walled off from the rest of A7 and as well as the rest of iOS. Therefore, your fingerprint data is never accessed by iOS or other apps, never stored on Apple servers, and never backed up to iCloud or anywhere else. Only Touch ID uses it and it can't be used to match against other fingerprint databases. [1] http://support.apple.com/kb/HT5949?viewlocale=en_US http://support.apple.com/kb/HT5949?viewlocale=en_US
epo 13y ago
Having a lock in your front door is not perfect but it is much better than not having one at all. The way that Apple haters use stunts like this to suspend normal logic and reasoning in order to express their juvenile spite is staggering. No one, ever, claimed TouchID was impregnable, but it is very good security and is better than what the vast majority of people do at present. Anyone prepared to devote the time and resources that CCC did to breaking your phone has other simpler means at their disposal. I personally believe that no one else will replicate this achievement because it is simply a publicity stunt to get clicks and feed the hordes of anti-Apple zealots.
- hahainternet 13y ago
  > Anyone prepared to devote the time and resources that CCC did to breaking your phone has other simpler means at their disposal Really? Lift someone's print, leave it with superglue, scan and print it and then dump glue on the scan. That seems to be the sum total of what needs to be done. You need only sticky tape to lift the print and the rest can be done in an hour. It sounds quite action movie, but in reality it's pretty damn simple and if I wanted to get access to your phone I could easily prepare it in advance and carry a tiny latex strip in my wallet for just the right occasion without your knowledge at any point.
  - deveac 13y ago
    It sounds quite action movie, but in reality it's pretty damn simple Also in reality it will foil over 99% of potential unauthorized activation attempts as most people aren't going to craft fingerprints to get into someone's device. If reality is the bar you're using, TouchID still wins.
  - deveac 13y ago
    >but in reality it's pretty damn simple Also, it's not remotely "pretty damn simple": https://blog.lookout.com/blog/2013/09/23/why-i-hacked-apples-touchid-and-still-think-it-is-awesome/ https://blog.lookout.com/blog/2013/09/23/why-i-hacked-apples... "Creating the fake fingerprint is arguably the hardest part and by no means “easy.” It is a lengthy process that takes several hours and uses over a thousand dollars worth of equipment..."

by DasIch 13y ago

x0054 13y ago

I was going to argue with your statements but than I turned the screen in my phone off and realized that the front part of the screen is covered with my thumb prints, and they are ripe for photographing.

mike-cardwell 13y ago

I'd be willing to bet that over the next couple of years millions of people will try to log into somebodys iPhone that they shouldn't have access to, but in the process are prevented from doing so by the fingerprint based security. I also bet, in 99.9999% or more of those cases, the attacker doesn't even attempt to bypass the security by faking the users fingerprint. I'd also be willing to bet that these figures are substantially better than the current situation where people don't bother to lock their phone at all. People will use it because it's a gimmick, not because of it's security properties, but it will still work.

vdaniuk 13y ago
But you have to consider potential damage from the successful attack. It doesn't matter if 99% of low damage attacks are unsuccessful but 1% high damage attacks will go through. The solution is fine by itself but millions of people will use it and not understand the real level of protection.
- solarmist 13y ago
  Well right now I'd guess that the percent of high damage attacks that go through are significantly higher than 1%, so lowering that to "1%" isn't an improvement?
- Bud 13y ago
  The potential damage is zero. You (and everyone else in this thread) are forgetting that you can't steal an iPhone for more than 30 seconds anymore without Activation Lock locking you and everyone else out, forever, period, paragraph. Activation Lock + Touch ID = all the security that almost anyone needs on a phone and much higher security than any of us have been used to up to now.
  - yaeger 13y ago
    I think this is key here. Before, you could try and lock or wipe your phone when it was stolen. But in order for it to work the thief must have let it powered on. If he was smart and shut it off, took it home and booted into DFU mode to restore a the thing back to factory settings, you were out of luck. But with the new Activation Lock, it supposedly doesn't matter if it is shut down, the minute someone tries to flash the phone. Be it normally via iTunes or via DFU mode and iTunes there should appear a message that the phone has been wiped and must be unlocked with the iCloud password of the account that did the wiping. So no chance to flash the phone back to factory settings.

fastball 13y ago

Using the method employed by the CCC to break the security is not trivial...

YOSPOS 13y ago

>Touch ID is better than nothing and that people use Touch ID instead of nothing is better than the current state That makes it great security.

jlmorton 13y ago

While I don't have data to back it up, I believe most Android users use the draw pattern to unlock method. This feature is absolutely trivial to defeat - you can simply hold the phone up to the light, see the trails of oil left on the phone, and follow that trail. People have done this to my own phone with just a few tries. TouchID represents a massive increase in security over draw pattern to unlock, and it's easier to use at the same time. It probably also represents an increase in security over 4 digit PIN codes, though that's shakier.

dannyr 13y ago
People actually do other actions on their phone after unlocking it. If somebody swipes on their homescreen, browse the web, etc, the trail would not be just the unlock pattern. The exploit you're talking about may work if you get hold of the phone right after the user unlocks it since the trail only has the pattern.
- tcoppi 13y ago
  It also doesn't work nearly as well if you are OCD about wiping your screen often, not that that makes the pattern lock any better but it isn't quite that trivial to defeat
- jlmorton 13y ago
  True enough, there is other "noise" on the phone, in the form of point-like finger prints, and even other trails. But you're imagining a blank phone, where you have to try and discern one trail from another. Now turn the phone on, and the unlock background appears. Which trails intersect all of the dots of the unlock background? It's much easier that you imagine. I've been using my phone as I normally do throughout the day, and I can see the unlock pattern clearly on the phone.
  - eru 13y ago
    That's why you need a unlock pattern that intersects / overlaps itself. (Not foolproof, just makes that attack harder.)

kevinpet 13y ago

Touch ID is competing against pins chosen from a universe of 10,000. This isn't great security, but it's appropriate security for unlocking a device you already must have physical access to.

dsuth 13y ago
Actually doesn't that highlight one of the biggest flaws with this, in that your finger prints will already be all over the device? Lift the device, get the authorisation token for free. At least with a password you also need to either crack it or discover it from some other means.
- travisp 13y ago
  So far, nobody has demonstrated an attack that is able to break the fingerprint reader by reading fingerprints off of the device (or another surface). The attack demonstrated by CCC requires them to take a high resolution photograph of your finger. It is likely substantially harder to just lift a good enough quality fingerprint to defeat the system.

abalone 13y ago

> Touch ID is better than nothing... but not by much You can't be serious. A completely unlocked phone that anybody can trivially access with a swipe.. vs. a scanner that you'd have to lift and reconstruct someone's fingerprint to bypass. That is definitely a significant improvement.

taproot 13y ago
> That is definitely a significant improvement. Sure is a significant improvement for some people at least. http://t.co/EK3sdeloUX http://t.co/EK3sdeloUX
- jamesaguilar 13y ago
  Baseless FUD is OK as long as Linux ain't the target, right?
  - taproot 13y ago
    Where the fuck did that come from? It is neither baseless or FUD. That fingerprint will be sent over the wire at some point and the NSA will gladly pick it up. How you think otherwise is beyond me. What operating system I prefer really has nothing to do with it, even if it is linux. Posted from my iPhone, android, third mac mini, 2nd mac air, or first thinkpad who the fuck knows (or cares? oh you obviously)
    - jbraithwaite 13y ago
      From Apple's site [1]: > Touch ID does not store any images of your fingerprint. It stores only a mathematical representation of your fingerprint. > The Secure Enclave is walled off from the rest of A7 and as well as the rest of iOS. Therefore, your fingerprint data is never accessed by iOS or other apps, never stored on Apple servers, and never backed up to iCloud or anywhere else. Only Touch ID uses it and it can't be used to match against other fingerprint databases. [1] http://support.apple.com/kb/HT5949?viewlocale=en_US http://support.apple.com/kb/HT5949?viewlocale=en_US

epo 13y ago

Having a lock in your front door is not perfect but it is much better than not having one at all. The way that Apple haters use stunts like this to suspend normal logic and reasoning in order to express their juvenile spite is staggering. No one, ever, claimed TouchID was impregnable, but it is very good security and is better than what the vast majority of people do at present. Anyone prepared to devote the time and resources that CCC did to breaking your phone has other simpler means at their disposal. I personally believe that no one else will replicate this achievement because it is simply a publicity stunt to get clicks and feed the hordes of anti-Apple zealots.

hahainternet 13y ago
> Anyone prepared to devote the time and resources that CCC did to breaking your phone has other simpler means at their disposal Really? Lift someone's print, leave it with superglue, scan and print it and then dump glue on the scan. That seems to be the sum total of what needs to be done. You need only sticky tape to lift the print and the rest can be done in an hour. It sounds quite action movie, but in reality it's pretty damn simple and if I wanted to get access to your phone I could easily prepare it in advance and carry a tiny latex strip in my wallet for just the right occasion without your knowledge at any point.
- deveac 13y ago
  It sounds quite action movie, but in reality it's pretty damn simple Also in reality it will foil over 99% of potential unauthorized activation attempts as most people aren't going to craft fingerprints to get into someone's device. If reality is the bar you're using, TouchID still wins.
- deveac 13y ago
  >but in reality it's pretty damn simple Also, it's not remotely "pretty damn simple": https://blog.lookout.com/blog/2013/09/23/why-i-hacked-apples-touchid-and-still-think-it-is-awesome/ https://blog.lookout.com/blog/2013/09/23/why-i-hacked-apples... "Creating the fake fingerprint is arguably the hardest part and by no means “easy.” It is a lengthy process that takes several hours and uses over a thousand dollars worth of equipment..."