4 ms·

Just like you don't store a plaintext password, neither does TouchID store your fingerprint as anything recognizable - it's stored as a hashed and salted repres

Just like you don't store a plaintext password, neither does TouchID store your fingerprint as anything recognizable - it's stored as a hashed and salted representation of your fingerprint. I'd venture to guess that it's device specific too, I doubt that your fingerprint hash stored on one phone is identical to the same fingerprint hash stored on a different phone. Check out the whitepaper here: http://images.apple.com/iphone/business/docs/iOS_Security_Feb14.pdf http://images.apple.com/iphone/business/docs/iOS_Security_Fe... if you're curious about details.

tomschlick 12y ago
Yeah at that point the only attack you could do would be to put a trigger in the middle before its hashed and compared with the stored value.
Holbein 12y ago
I think there is reason to doubt that TouchID stores your fingerprint as a hash. Let me elaborate: Even after the initial priming phase, TouchID continues to learn and adapt to your fingerprints. So during priming, you could always place your finger flat on the sensor, and then after that, during usage, you can continuously use different parts of your finger, and if at least a part of your finger overlaps with a previous image of your finger, TouchID unlocks the device and - crucially - it continues to learn those new angles of your finger. This indicates that TouchID internally aggregates an image of your fingerprint during actual usage. Now to merge those images together, you have to compare previous images with the new image, to find a common section. And you can't do that if you have only got a hash of the previous image. I think therefore just by looking at its operation from outside, we can infer TouchID stores a fingerprint in a way that it can reproduce the fingerprint itself.
- CHY872 12y ago
  Apple claim that the fingerprint is not stored in a way for which the fingerprint itself could be reconstructed - which makes sense. https://ssl.apple.com/iphone/business/docs/iOS_Security_Feb14.pdf https://ssl.apple.com/iphone/business/docs/iOS_Security_Feb1...
  - Holbein 12y ago
    So how do they internally aggregate an image of your fingerprint during actual usage, then? Also, hash plus salt together is info that identifies a fingerprint. Why shouldn't it be possible to leak that info? Once you have it, you can apply it to your existing database of fingerprints to get matches - no actual fingerprint image needed...

tomschlick 12y ago

Yeah at that point the only attack you could do would be to put a trigger in the middle before its hashed and compared with the stored value.

Holbein 12y ago

I think there is reason to doubt that TouchID stores your fingerprint as a hash. Let me elaborate: Even after the initial priming phase, TouchID continues to learn and adapt to your fingerprints. So during priming, you could always place your finger flat on the sensor, and then after that, during usage, you can continuously use different parts of your finger, and if at least a part of your finger overlaps with a previous image of your finger, TouchID unlocks the device and - crucially - it continues to learn those new angles of your finger. This indicates that TouchID internally aggregates an image of your fingerprint during actual usage. Now to merge those images together, you have to compare previous images with the new image, to find a common section. And you can't do that if you have only got a hash of the previous image. I think therefore just by looking at its operation from outside, we can infer TouchID stores a fingerprint in a way that it can reproduce the fingerprint itself.

CHY872 12y ago
Apple claim that the fingerprint is not stored in a way for which the fingerprint itself could be reconstructed - which makes sense. https://ssl.apple.com/iphone/business/docs/iOS_Security_Feb14.pdf https://ssl.apple.com/iphone/business/docs/iOS_Security_Feb1...
- Holbein 12y ago
  So how do they internally aggregate an image of your fingerprint during actual usage, then? Also, hash plus salt together is info that identifies a fingerprint. Why shouldn't it be possible to leak that info? Once you have it, you can apply it to your existing database of fingerprints to get matches - no actual fingerprint image needed...