Hacker News Reader

Comment by newman314 | Hacker News Reader

I'd avoid using TouchID to unlock your phone for legal reasons.

Once the phone is unlocked, you can use TouchID as the phone is already open and you would not gain/lose anything from using TouchID in that scenario. But until the courts rule that you cannot be compelled to TouchID unlock your phone like a PIN, I think that is the safer route to take for now.

View on HN

If you expect you can reliably turn off your phone (7 seconds) before you get in a search situation, then use a full password instead of a numeric pin, then touch ID is a great balance of convenience and security. TouchID also prevents shoulder surfing of your code.

It's all about the threat model.

Correct me if I'm wrong, but isn't it also possible to just use one of your fingers that you didn't register with touch ID for 5 or so consecutive unlock attempts and it will have the same effect as rebooting your phone?

There is a slight difference.

Keychain and NSFileManager have possible modes of "kSecAttrAccessibleAfterFirstUnlock" [0] and "NSFileProtectionCompleteUntilFirstUserAuthentication" [1] respectively that are (fittingly) in an open state within your app after you've unlocked the device.

[0]: https://developer.apple.com/reference/security/ksecattracces...

[1]: https://developer.apple.com/reference/foundation/nsfilemanag...

That will stop you using Touch ID thereafter, but it's quite slow to do in practice.

As an aside, I've found that, at least with my iPhone 5S, if my finger is wet (e.g. if I've licked it), it also is rejected.

Reply on news.ycombinator.com