5 ms·

Reportedly when making purchases it "will still prompt you for your password every so often to 'renew Touch ID purchases.'" Source: http://www.cultofmac.com/24

• 001sky 13y ago
  'every so often' seems a bit casual, for a payment [1,2] [1] From the citation: "Passcodes and passwords aren’t completely eliminated by Touch ID, then, but they almost certainly will be later on." [2] The glass screen will have your fingerprint on it, somewhere. That can be CSI'd by anyone who finds it. Anyone serious enough to do that (and its not much) can start escalating.
  • jamesaguilar 13y ago
    Since they'd reverse the charges anyway if it wasn't you who made them, what exactly is the problem here?
    • URSpider94 13y ago
      This is where things start to get tricky. I've read up on "chip and PIN" in Europe, where purchasers have to insert their cards into a reader and enter the numeric code that is stored on the card. From what I've found online, chip-PIN does indeed reduce fraud, but when fraud does happen, it becomes extraordinarily difficult for the cardholder to get a refund from the bank. I could see fingerprint scanning going the same way -- with vendors saying "what do you mean you aren't the one who made this purchase? The device was unlocked with your unique fingerprint!"
      • jamesaguilar 13y ago
        So you're going with a slippery slope argument? This thing could cause that thing that could cause that bad thing, so this thing is bad? I suppose that is something that could happen in the future. It's not a likely problem to complain about with this particular implementation.
        • 001sky 13y ago
          Since they'd reverse the charges anyway... You're baselessly asserting your position, though. If you write your pin on your ATM card, they will not refund you. That is policy and they ask everytime you lose your card. The bank views this as lack of due care. Likewise, if you leave copies of your fingerprints on your payment device, they could argue that you are likewise acting with un-reasonable care. Now that this has been (so easily?) spoofed, is it reasonable to believe it is secure? That is a valid concern. Unlike a pin, you cannot reset a fingerprint security mechanism. So when it is compromised, it is over. So, the result is messy in that it puts you in a problem using today's standard practices, but at the same time, the standard practice "defense" is not applicable, and lacks an obvious alternative. This is not a strawman, its a legitimate edge case.
          • jamespo 13y ago
            The bank has never asked me if I had my PIN written on my card when I've lost it... all they ask is lost or stolen.
            • 001sky 13y ago
              From a sample card-holder's agreement: 3. I will hold in strict confidence my personal identification number (PIN). I will take reasonable precautions to keep my PIN separate from my ATM card and to prevent the unauthorized disclosure of my PIN. So, you sign an affadavit verifying you did not contravence this agreement. They will screen for this as/if you file a claim for fraud.
      • patrickk 13y ago
        > From what I've found online, chip-PIN does indeed reduce fraud, but when fraud does happen, it becomes extraordinarily difficult for the cardholder to get a refund from the bank. I live in Europe, and twice in the last two years or so my card details have been compromised, and both times my bank has rang me to notify me of suspicious transactions before I'd even noticed. It depends on the bank (and the country most likely) with regards to getting a refund. I got refunds no problem, but I've heard people having problems in the UK. The fraud happened online (not sure how, I'm reasonably tech savvy and careful with my card details).
        • rahoulb 13y ago
          When Chip and PIN came in, as part of the TOS that you accepted by using the card, it included a clause that the bank is not liable for any fraud on the card as Chip/PIN is unbreakable (the implication being you must have given away your PIN). I believe that this has now changed (although I've not had a new card recently and I don't remember seeing any new TOS).
          • vidarh 13y ago
            The big gaping problem of course being that most fraud does not involve chip+pin transactions, but online transactions that are no better protected than before.
      • deleted 13y ago
        [deleted]
      • deleted 13y ago
        [deleted]
      • makomk 13y ago
        In particular, it turned out that there was a flaw in the Chip and PIN specification which made it possible to bypass the PIN requirement. There's some evidence this was exploited fairly widely in the wild before security researchers found the flaw, but since the banks erased the logs that recorded whether a PIN was actually used all the customers ended up liable for the fraudulent charges.
      • EvanAnderson 13y ago
        It's not legal (now) for European banks to shift the fraud liability to the Customer with chip-and-PIN, but that hasn't stopped them from trying: http://www.thisismoney.co.uk/money/saving/article-2215223/Victim-chip-pin-fraud-Its-YOUR-fault-insist-banks.html http://www.thisismoney.co.uk/money/saving/article-2215223/Vi...
  • abalone 13y ago
    When most payments are under $5 it's probably ok. It's good enough for the credit/debit card payment industry, at least. (They relaxed the rules so you don't have to sign or enter a PIN for small purchases.)
    • icambron 13y ago
      Can we agree that Apple should not be marketing this as a "highly secure way to access your phone"?
      • etchalon 13y ago
        Why? It IS highly secure. Just not infallible.
      • smith7018 13y ago
        Did you read the article? To crack the sensor, the would-be malevolent party needs a _2400 DPI photo of the fingerprint._ TouchID is highly secure if the only way to break into it is to have an ultra high-def image of the exact finger the device is looking for. I guess 50 character-long passcodes aren't secure because you could just tell a thief the code?
        • varjag 13y ago
          2400 dpi is nothing out of ordinary for a half decent scanner or a digital camera at 1:1 reproduction.
        • bdamm 13y ago
          2400 DPI is not that hard to achieve. Any DSLR can do it with a macro lens attachment and a flash. Many scanners can do it as well.
        • icambron 13y ago
          Yes, I read the article. We must have wildly different definitions of "highly". I'm pretty confident I could reproduce this result in one afternoon. Compare that to other things we might consider highly secure, like strong encryption or Fort Knox. What word do you use for security measures that take non-trivial resources to circumvent?
  • cstejerean 13y ago
    The primary use case here is keeping kids from buying apps or in-app purchases when their parents lend them the phone to play games. A casual solution is perfectly acceptable. If someone is going to go through the trouble of stealing my phone and cloning my fingerprint I'm guessing they would want more than purchasing music or apps under my iTunes account.
    • dunk010 13y ago
      And if you know your phone is stolen you can disable it anyways.
      • FuzzyDunlop 13y ago
        You can't renew your fingerprint, though.
    • legitsource 13y ago
      Locks just keep an honest man honest. If someone wants what you have bad enough, there really isn't anything you can do to stop them.
      • bashinator 13y ago
        If my kid is talented enough to create a silicone-gel replica of my fingerprint in order to buy in-game merch, she's earned it.
  • superuser2 13y ago
    The payment can (mostly) only benefit the device owner though, right? Buying apps with your device is not terribly useful unless you have take full posession of the device, in which case the owner can remote lock/wipe it with iCloud and dispute the charges with their CC company.
• adamfrank321 13y ago
  Since Friday, my 5s has prompted me for a password with this message more times than TouchID has worked succesfully.