2 ms·

I think it's more than adequate security for App Store purchases. My debit card, for example, has "paywave" short range payment support. So anybody who has my

I think it's more than adequate security for App Store purchases. My debit card, for example, has "paywave" short range payment support. So anybody who has my card can go around making small purchases, no PIN, no signature needed. I'm fine with this because the convenience far outweighs the security concern. With the iPhone an attacker who replicates your fingerprint can make purchases to your iTunes account using your phone. They can't purchase to a different account, they can't purchase to a different device. In that sense, requiring a valid fingerprint is more than secure enough — even if faked it's not going to do much damage. Creating a fake print that can fool the scanner is so much harder than stealing someone's debit/credit card. It's also so much less damaging to the victim (making purchases on their iTunes account vs. making any arbitrary purchase). I think the balance between security and convenience for this technology is more than reasonable.

stefanix 13y ago
> Creating a fake print that can fool the scanner is so much harder than stealing someone's debit/credit card. No, it's not. Starbug used simple means starting from a photo of a fingerprint. The fact that fingerprints are blasted all over the place makes this very easy. You could probably even build a cheap machine that automates this process.
- TheSpiceIsLife 13y ago
  I'd argue stealing a credit card is a much simpler one step process: Step 1. steal card. Done. Pretty easy too, lots of people leave their wallet or purse unattended in all sorts of scenarios, typically with their phone sitting underneath it. The home kitchen or the desk at work are typically places. Creating fake print: Step 1. Either find a perfect print, or a number of imperfect prints. Step 2. photograph. Step 3. enhance. Step 4. print. Step 5. Use print on suitably encoded device (which probably means steeling their phone too). Edit: Given the front of a phone is glass, there's probably going to be a print on the screen, though I wonder if any prints take from a phone screen would be clean? I don't know.

stefanix 13y ago

> Creating a fake print that can fool the scanner is so much harder than stealing someone's debit/credit card. No, it's not. Starbug used simple means starting from a photo of a fingerprint. The fact that fingerprints are blasted all over the place makes this very easy. You could probably even build a cheap machine that automates this process.

TheSpiceIsLife 13y ago
I'd argue stealing a credit card is a much simpler one step process: Step 1. steal card. Done. Pretty easy too, lots of people leave their wallet or purse unattended in all sorts of scenarios, typically with their phone sitting underneath it. The home kitchen or the desk at work are typically places. Creating fake print: Step 1. Either find a perfect print, or a number of imperfect prints. Step 2. photograph. Step 3. enhance. Step 4. print. Step 5. Use print on suitably encoded device (which probably means steeling their phone too). Edit: Given the front of a phone is glass, there's probably going to be a print on the screen, though I wonder if any prints take from a phone screen would be clean? I don't know.