4 ms·
I think there is reason to doubt that TouchID stores your fingerprint as a hash. Let me elaborate: Even after the initial priming phase, TouchID continues to l
by Holbein 12y ago
I think there is reason to doubt that TouchID stores your fingerprint as a hash. Let me elaborate:
Even after the initial priming phase, TouchID continues to learn and adapt to your fingerprints. So during priming, you could always place your finger flat on the sensor, and then after that, during usage, you can continuously use different parts of your finger, and if at least a part of your finger overlaps with a previous image of your finger, TouchID unlocks the device and - crucially - it continues to learn those new angles of your finger.
This indicates that TouchID internally aggregates an image of your fingerprint during actual usage. Now to merge those images together, you have to compare previous images with the new image, to find a common section. And you can't do that if you have only got a hash of the previous image.
I think therefore just by looking at its operation from outside, we can infer TouchID stores a fingerprint in a way that it can reproduce the fingerprint itself.
- CHY872 12y agoApple claim that the fingerprint is not stored in a way for which the fingerprint itself could be reconstructed - which makes sense. https://ssl.apple.com/iphone/business/docs/iOS_Security_Feb14.pdf https://ssl.apple.com/iphone/business/docs/iOS_Security_Feb1...
- Holbein 12y agoSo how do they internally aggregate an image of your fingerprint during actual usage, then? Also, hash plus salt together is info that identifies a fingerprint. Why shouldn't it be possible to leak that info? Once you have it, you can apply it to your existing database of fingerprints to get matches - no actual fingerprint image needed...