13 ms·

Well, no password on their phone unlocks. But I thought Apple intended to replace your passwords in application services as well. Now, I didn't read the article

Well, no password on their phone unlocks. But I thought Apple intended to replace your passwords in application services as well. Now, I didn't read the article at all (not a single damn word), so maybe the hack only applies to phone unlocks. If that is not the case however, then I think _you_ are missing the point. This would compromise all passwords replaced by finger print scans, right?

abalone 13y ago
Reportedly when making purchases it "will still prompt you for your password every so often to 'renew Touch ID purchases.'" Source: http://www.cultofmac.com/246572/iphone-5s-first-impressions-.. http://www.cultofmac.com/246572/iphone-5s-first-impressions-....
- 001sky 13y ago
  'every so often' seems a bit casual, for a payment [1,2] [1] From the citation: "Passcodes and passwords aren’t completely eliminated by Touch ID, then, but they almost certainly will be later on." [2] The glass screen will have your fingerprint on it, somewhere. That can be CSI'd by anyone who finds it. Anyone serious enough to do that (and its not much) can start escalating.
  - jamesaguilar 13y ago
    Since they'd reverse the charges anyway if it wasn't you who made them, what exactly is the problem here?
    - URSpider94 13y ago
      This is where things start to get tricky. I've read up on "chip and PIN" in Europe, where purchasers have to insert their cards into a reader and enter the numeric code that is stored on the card. From what I've found online, chip-PIN does indeed reduce fraud, but when fraud does happen, it becomes extraordinarily difficult for the cardholder to get a refund from the bank. I could see fingerprint scanning going the same way -- with vendors saying "what do you mean you aren't the one who made this purchase? The device was unlocked with your unique fingerprint!"
      - jamesaguilar 13y ago
        So you're going with a slippery slope argument? This thing could cause that thing that could cause that bad thing, so this thing is bad? I suppose that is something that could happen in the future. It's not a likely problem to complain about with this particular implementation.
        001sky 13y ago
        Since they'd reverse the charges anyway... You're baselessly asserting your position, though. If you write your pin on your ATM card, they will not refund you. That is policy and they ask everytime you lose your card. The bank views this as lack of due care. Likewise, if you leave copies of your fingerprints on your payment device, they could argue that you are likewise acting with un-reasonable care. Now that this has been (so easily?) spoofed, is it reasonable to believe it is secure? That is a valid concern. Unlike a pin, you cannot reset a fingerprint security mechanism. So when it is compromised, it is over. So, the result is messy in that it puts you in a problem using today's standard practices, but at the same time, the standard practice "defense" is not applicable, and lacks an obvious alternative. This is not a strawman, its a legitimate edge case.
        jamespo 13y ago
        The bank has never asked me if I had my PIN written on my card when I've lost it... all they ask is lost or stolen.
        001sky 13y ago
        From a sample card-holder's agreement: 3. I will hold in strict confidence my personal identification number (PIN). I will take reasonable precautions to keep my PIN separate from my ATM card and to prevent the unauthorized disclosure of my PIN. So, you sign an affadavit verifying you did not contravence this agreement. They will screen for this as/if you file a claim for fraud.
      - patrickk 13y ago
  - abalone 13y ago
    When most payments are under $5 it's probably ok. It's good enough for the credit/debit card payment industry, at least. (They relaxed the rules so you don't have to sign or enter a PIN for small purchases.)
    - icambron 13y ago
      Can we agree that Apple should not be marketing this as a "highly secure way to access your phone"?
      - etchalon 13y ago
        Why? It IS highly secure. Just not infallible.
      - smith7018 13y ago
        Did you read the article? To crack the sensor, the would-be malevolent party needs a _2400 DPI photo of the fingerprint._ TouchID is highly secure if the only way to break into it is to have an ultra high-def image of the exact finger the device is looking for. I guess 50 character-long passcodes aren't secure because you could just tell a thief the code?
        varjag 13y ago
        2400 dpi is nothing out of ordinary for a half decent scanner or a digital camera at 1:1 reproduction.
        bdamm 13y ago
        2400 DPI is not that hard to achieve. Any DSLR can do it with a macro lens attachment and a flash. Many scanners can do it as well.
        icambron 13y ago
        Yes, I read the article. We must have wildly different definitions of "highly". I'm pretty confident I could reproduce this result in one afternoon. Compare that to other things we might consider highly secure, like strong encryption or Fort Knox. What word do you use for security measures that take non-trivial resources to circumvent?
  - cstejerean 13y ago
    The primary use case here is keeping kids from buying apps or in-app purchases when their parents lend them the phone to play games. A casual solution is perfectly acceptable. If someone is going to go through the trouble of stealing my phone and cloning my fingerprint I'm guessing they would want more than purchasing music or apps under my iTunes account.
    - dunk010 13y ago
      And if you know your phone is stolen you can disable it anyways.
      - FuzzyDunlop 13y ago
        You can't renew your fingerprint, though.
    - legitsource 13y ago
      Locks just keep an honest man honest. If someone wants what you have bad enough, there really isn't anything you can do to stop them.
      - bashinator 13y ago
        If my kid is talented enough to create a silicone-gel replica of my fingerprint in order to buy in-game merch, she's earned it.
  - superuser2 13y ago
    The payment can (mostly) only benefit the device owner though, right? Buying apps with your device is not terribly useful unless you have take full posession of the device, in which case the owner can remote lock/wipe it with iCloud and dispute the charges with their CC company.
- adamfrank321 13y ago
  Since Friday, my 5s has prompted me for a password with this message more times than TouchID has worked succesfully.

abalone 13y ago

Reportedly when making purchases it "will still prompt you for your password every so often to 'renew Touch ID purchases.'" Source: http://www.cultofmac.com/246572/iphone-5s-first-impressions-.. http://www.cultofmac.com/246572/iphone-5s-first-impressions-....

001sky 13y ago
'every so often' seems a bit casual, for a payment [1,2] [1] From the citation: "Passcodes and passwords aren’t completely eliminated by Touch ID, then, but they almost certainly will be later on." [2] The glass screen will have your fingerprint on it, somewhere. That can be CSI'd by anyone who finds it. Anyone serious enough to do that (and its not much) can start escalating.
- jamesaguilar 13y ago
  Since they'd reverse the charges anyway if it wasn't you who made them, what exactly is the problem here?
  - URSpider94 13y ago
    This is where things start to get tricky. I've read up on "chip and PIN" in Europe, where purchasers have to insert their cards into a reader and enter the numeric code that is stored on the card. From what I've found online, chip-PIN does indeed reduce fraud, but when fraud does happen, it becomes extraordinarily difficult for the cardholder to get a refund from the bank. I could see fingerprint scanning going the same way -- with vendors saying "what do you mean you aren't the one who made this purchase? The device was unlocked with your unique fingerprint!"
    - jamesaguilar 13y ago
      So you're going with a slippery slope argument? This thing could cause that thing that could cause that bad thing, so this thing is bad? I suppose that is something that could happen in the future. It's not a likely problem to complain about with this particular implementation.
      - 001sky 13y ago
        Since they'd reverse the charges anyway... You're baselessly asserting your position, though. If you write your pin on your ATM card, they will not refund you. That is policy and they ask everytime you lose your card. The bank views this as lack of due care. Likewise, if you leave copies of your fingerprints on your payment device, they could argue that you are likewise acting with un-reasonable care. Now that this has been (so easily?) spoofed, is it reasonable to believe it is secure? That is a valid concern. Unlike a pin, you cannot reset a fingerprint security mechanism. So when it is compromised, it is over. So, the result is messy in that it puts you in a problem using today's standard practices, but at the same time, the standard practice "defense" is not applicable, and lacks an obvious alternative. This is not a strawman, its a legitimate edge case.
        jamespo 13y ago
        The bank has never asked me if I had my PIN written on my card when I've lost it... all they ask is lost or stolen.
        001sky 13y ago
        From a sample card-holder's agreement: 3. I will hold in strict confidence my personal identification number (PIN). I will take reasonable precautions to keep my PIN separate from my ATM card and to prevent the unauthorized disclosure of my PIN. So, you sign an affadavit verifying you did not contravence this agreement. They will screen for this as/if you file a claim for fraud.
    - patrickk 13y ago
- abalone 13y ago
  When most payments are under $5 it's probably ok. It's good enough for the credit/debit card payment industry, at least. (They relaxed the rules so you don't have to sign or enter a PIN for small purchases.)
  - icambron 13y ago
    Can we agree that Apple should not be marketing this as a "highly secure way to access your phone"?
    - etchalon 13y ago
      Why? It IS highly secure. Just not infallible.
    - smith7018 13y ago
      Did you read the article? To crack the sensor, the would-be malevolent party needs a _2400 DPI photo of the fingerprint._ TouchID is highly secure if the only way to break into it is to have an ultra high-def image of the exact finger the device is looking for. I guess 50 character-long passcodes aren't secure because you could just tell a thief the code?
      - varjag 13y ago
        2400 dpi is nothing out of ordinary for a half decent scanner or a digital camera at 1:1 reproduction.
      - bdamm 13y ago
        2400 DPI is not that hard to achieve. Any DSLR can do it with a macro lens attachment and a flash. Many scanners can do it as well.
      - icambron 13y ago
        Yes, I read the article. We must have wildly different definitions of "highly". I'm pretty confident I could reproduce this result in one afternoon. Compare that to other things we might consider highly secure, like strong encryption or Fort Knox. What word do you use for security measures that take non-trivial resources to circumvent?
- cstejerean 13y ago
  The primary use case here is keeping kids from buying apps or in-app purchases when their parents lend them the phone to play games. A casual solution is perfectly acceptable. If someone is going to go through the trouble of stealing my phone and cloning my fingerprint I'm guessing they would want more than purchasing music or apps under my iTunes account.
  - dunk010 13y ago
    And if you know your phone is stolen you can disable it anyways.
    - FuzzyDunlop 13y ago
      You can't renew your fingerprint, though.
  - legitsource 13y ago
    Locks just keep an honest man honest. If someone wants what you have bad enough, there really isn't anything you can do to stop them.
    - bashinator 13y ago
      If my kid is talented enough to create a silicone-gel replica of my fingerprint in order to buy in-game merch, she's earned it.
- superuser2 13y ago
  The payment can (mostly) only benefit the device owner though, right? Buying apps with your device is not terribly useful unless you have take full posession of the device, in which case the owner can remote lock/wipe it with iCloud and dispute the charges with their CC company.
adamfrank321 13y ago
Since Friday, my 5s has prompted me for a password with this message more times than TouchID has worked succesfully.