Hacker News Reader

Comment by r00fus | Hacker News Reader

If you have something as sophisticated as TouchID, it's actually hard to replicate a valid print. CCC did it in a lab situation (wine glass + latex paint), how is a smear on a tabletop or mug going to be retrievable for a sophisticated scanner?

View on HN

If I recall correctly, someone was able to fool TouchID a few years ago using a fake print created purely from pictures of a German government official.

That was impressive but it's still something of an edge case: he used it to register & unlock a phone but did not unlock her phone and it sounds like it required a photograph taken a few feet away at a press conference using a big lens:

https://www.youtube.com/watch?annotation_id=annotation_26842...

I think for most people convenience remains a win over the marginal increase in risk — someone who can get that close to you can also use a hidden camera/drone to watch you enter a password, steal your wallet/bag with two-factor codes, etc.

Given that YT link ist im Deutsch I'm going to pass on decyphering it.

How does registering and unlocking another phone show that it would work on her phone?

I really don't think TouchID is at all riskier than even a 6-digit passcode. I really still wish Apple allowed multi-factor unlocking though.

That’s the English translation but, yes, recovering a fingerprint which can be used to unlock a test device doesn’t show it can replace the original. It’s prudent to assume that the attacks will get better but I think this really highlights the difference between broad and targeted attacks since so many people are better off with the fingerprint unlock.

I recall it was not TouchID that was fooled, but Starbug just copied her fingerprint via photos [1].

I don't remember how/if it was demonstrated that the fingerprint was a useful copy in any way (and certainly not on that official's iPhone).

https://www.theguardian.com/technology/2014/dec/30/hacker-fa...

Reply on news.ycombinator.com