7 ms·

Apple’s Cool iPhone Fingerprint ID Means You’re Screwed

11 points by rbcgerard 12y ago

k2enemy 12y ago
>...so when Apple offered fingerprint ID in place of a PIN to access its iPhone, what hipster could resist? Stopped reading after the first sentence.
- nb4hnp 12y ago
  Same here. iOS devices are well past the hipster threshold. Also, it looks like this isn't the only article trying to spook iOS users out of using TouchID today. PandoDaily is running one as well. They even included some snark about how the writer doesn't know how to make TouchID work, therefore making it garbage I guess. If anyone out there doesn't know the trick yet, use two TouchID fingerprint "slots" per thumb and one for your main hand index finger. I'm well over 95% success rate on TouchID use with this method.
astrowilliam 12y ago
Resource limit reached. Can't access the page. This is the site of Scott H. Greenfield, TV Legal Analyst.
calgaryeng 12y ago
Page is down. Cached version: http://webcache.googleusercontent.com/search?q=cache:T5Tk3ZboqiIJ:blog.simplejustice.us/2014/10/31/apples-cool-iphone-fingerprint-id-means-youre-screwed/+&cd=1&hl=en&ct=clnk&gl=ca&client=firefox-a http://webcache.googleusercontent.com/search?q=cache:T5Tk3Zb...
swamp40 12y ago
Not really surprising from a legal standpoint. Fingerprints and DNA can be legally taken from you by law enforcement without your permission - but information, like your PIN #, cannot legally be forced from you. Just one more thing to add to the "Law Breaking for Dummies" book.
remarkEon 12y ago
I wonder if one could be compelled to tell law enforcement which finger print opens the device, or that any of yours do at all.
- donkeyd 12y ago
  This would be knowledge, which you don't have to share, according to the article.
  - greenpizza13 12y ago
    So therefore the answer is to try and use the wrong finger 5 times until the phone requires a passcode. Done.
    - remarkEon 12y ago
      Yeah that's what I was getting at.
donkeyd 12y ago
I just don't see how this changes much. You have to give them a finger print, but nowhere does it say that you have to provide the fingerprint onto the device. This means they'll have to lift it and reproduce it in order to unlock the device. Since you're fingerprint is undoubtedly already on the phone they could just lift it and unlock the device anyway...
- r00fus 12y ago
  > Since you're fingerprint is undoubtedly already on the phone they could just lift it and unlock the device anyway I don't think your smeared fingerprints all over your phone are going to be high-quality enough to enable them to unlock the phone. The process identified by the CCC crack [1] seems very involved and seems to require a lab-environment. You get 5 tries and 48 hours to unlock the phone or it will revert to passcode prompts... add in time requirement for a warrant, and this may be just enough difficulty to dissuade LEOs from attempting this method all the time. One thing is certain, you should likely not use the simple passcode - that's brute-forceable. But a manageable complex passcode and TouchID sounds very convenient and relatively secure. Oh, and always shut down your phone if you get pulled over. First power-on unlock mandates passcode entry. [1] http://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid http://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid
jmnicolas 12y ago
I have a hard time believing that the Police can't unlock an iPhone without its user permission. Maybe they want to spare the cost of a forensic expert or is the phone so well secured ?
- dmishe 12y ago
  It's the whole apple/android full encryption debacle that has been going on for what, two months now? Brute-forcing an iPhone with iOS 8 is extremely slow.
gergles 12y ago
When you get pulled over, hit the fingerprint sensor 5 times; that invalidates the use of it and you're done.
- pillfill 12y ago
  Or just turn off the phone. It requires a password on restart or 48h of inactivity. You can hate biometrics (and I'm still skeptical in general), but Apple did a damned fine job of how they implemented it.
no_future 12y ago
Barring the fact that Apple probably provides tools for unlocking their devices to authorities(like Microsoft's COFFEE), its a 4 digit passcode, it isn't that hard to crack.

11 points by rbcgerard 12y ago

>...so when Apple offered fingerprint ID in place of a PIN to access its iPhone, what hipster could resist? Stopped reading after the first sentence.

nb4hnp 12y ago
Same here. iOS devices are well past the hipster threshold. Also, it looks like this isn't the only article trying to spook iOS users out of using TouchID today. PandoDaily is running one as well. They even included some snark about how the writer doesn't know how to make TouchID work, therefore making it garbage I guess. If anyone out there doesn't know the trick yet, use two TouchID fingerprint "slots" per thumb and one for your main hand index finger. I'm well over 95% success rate on TouchID use with this method.

astrowilliam 12y ago

Resource limit reached. Can't access the page. This is the site of Scott H. Greenfield, TV Legal Analyst.

calgaryeng 12y ago

Page is down. Cached version: http://webcache.googleusercontent.com/search?q=cache:T5Tk3ZboqiIJ:blog.simplejustice.us/2014/10/31/apples-cool-iphone-fingerprint-id-means-youre-screwed/+&cd=1&hl=en&ct=clnk&gl=ca&client=firefox-a http://webcache.googleusercontent.com/search?q=cache:T5Tk3Zb...

swamp40 12y ago

Not really surprising from a legal standpoint. Fingerprints and DNA can be legally taken from you by law enforcement without your permission - but information, like your PIN #, cannot legally be forced from you. Just one more thing to add to the "Law Breaking for Dummies" book.

remarkEon 12y ago

I wonder if one could be compelled to tell law enforcement which finger print opens the device, or that any of yours do at all.

donkeyd 12y ago
This would be knowledge, which you don't have to share, according to the article.
- greenpizza13 12y ago
  So therefore the answer is to try and use the wrong finger 5 times until the phone requires a passcode. Done.
  - remarkEon 12y ago
    Yeah that's what I was getting at.

donkeyd 12y ago

I just don't see how this changes much. You have to give them a finger print, but nowhere does it say that you have to provide the fingerprint onto the device. This means they'll have to lift it and reproduce it in order to unlock the device. Since you're fingerprint is undoubtedly already on the phone they could just lift it and unlock the device anyway...

r00fus 12y ago
> Since you're fingerprint is undoubtedly already on the phone they could just lift it and unlock the device anyway I don't think your smeared fingerprints all over your phone are going to be high-quality enough to enable them to unlock the phone. The process identified by the CCC crack [1] seems very involved and seems to require a lab-environment. You get 5 tries and 48 hours to unlock the phone or it will revert to passcode prompts... add in time requirement for a warrant, and this may be just enough difficulty to dissuade LEOs from attempting this method all the time. One thing is certain, you should likely not use the simple passcode - that's brute-forceable. But a manageable complex passcode and TouchID sounds very convenient and relatively secure. Oh, and always shut down your phone if you get pulled over. First power-on unlock mandates passcode entry. [1] http://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid http://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid

jmnicolas 12y ago

I have a hard time believing that the Police can't unlock an iPhone without its user permission. Maybe they want to spare the cost of a forensic expert or is the phone so well secured ?

dmishe 12y ago
It's the whole apple/android full encryption debacle that has been going on for what, two months now? Brute-forcing an iPhone with iOS 8 is extremely slow.

gergles 12y ago

When you get pulled over, hit the fingerprint sensor 5 times; that invalidates the use of it and you're done.

pillfill 12y ago
Or just turn off the phone. It requires a password on restart or 48h of inactivity. You can hate biometrics (and I'm still skeptical in general), but Apple did a damned fine job of how they implemented it.

no_future 12y ago

Barring the fact that Apple probably provides tools for unlocking their devices to authorities(like Microsoft's COFFEE), its a 4 digit passcode, it isn't that hard to crack.