Hacker News Reader

Comment by MarcScott | Hacker News Reader

If we've learned anything over the past few months, it is that security is an illusion when it comes to Google, Apple and Facebook.

The fingerprint scanner is not intended to protect your personal data from being accessed by nefarious cyber-spooks or crackers. The $5 dollar wrench technique is fairly effective in bypassing such security anyway.

The fingerprint scanner is there so that when your phone is nicked by a mugger, they can't reset to factory defaults and sell it on eBay. If some knife wielding thug that robs me of my phone has the intellectual capability of lifting my fingerprints off the case and then using them to bypass the security, he still has to know my AppleID password before he can remove the 'Find my Phone' feature.

Give Apple a break. This is just another layer of security. It's _not_ the panacea to all our security woes, and they have never claimed it was.

View on HN

Apple claims that "The technology within Touch ID is some of the most advanced hardware and software we've put in any device." [1]. This attack showed that increasing sensor resolution only requires increasing the resolution on the fake print to match.

This attack is an interesting data point in the debate over using biometrics in access control systems. Apple was hyped to have introduced something new and exciting in this space, but it's quickly been shown to not be a significant advance in fingerprint sensor technology.

Touch ID, however, is still an adequately secure access control check to be useful to consumers.

[1]http://support.apple.com/kb/HT5949?viewlocale=en_US

Well, since they've never put a fingerprint authentication system in their hardware, I think that their claim still holds...

> This attack showed that increasing sensor resolution only requires increasing the resolution on the fake print to match.

Just to clarify, it wasn't just the increased resolution that was required here, but "latex milk", I assume to simulate a living finger, as well. It's not as simple as print-of-print = unlock.

It's "latex milk" today, tomorrow it might be just "regular milk" that's needed! The point is that the fingerprint security was bypassed so soon after release, and posted on the internet. Sure, it takes a lot of effort with the first generation of this hack.

No matter how cool the fingerprint tech is on iPhones, you wouldn't go as far as using it for your master access to your password manager app or bank account app.

For the purpose of replacing the lock screen pin, or as others have said, no pin at all, I think it's fine.

Latex milk, white glue, grocery-store gelatin— they all work. You just need something thin and flexible that'll take an impression.

Giving Apple a break? Just another layer of security? That's not how Apple describes it:

http://support.apple.com/kb/HT5949?viewlocale=en_US

And selling a stolen iPhone on eBay does not need a password or a fingerprint, a jailbreak is enough …

Jailbreak is enough... When it exists. And for now it doesn't.

taking past trends into consideration, it looks like you're betting on the wrong horse, here. it will exist.

What are the actual trends on jailbreaks for iOS on current hardware?

Past trends do indicate that. However, the very recent past indicates that Apple is getting progressively better at foiling jailbreaks. It's taking greenpois0n and those folks longer and longer to crack each successive version of iOS. Took a long time for there to be an untethered jailbreak of iOS 6 and the latest rev of iOS 6 wasn't cracked til about two weeks ago. There was no jailbreak of any kind on the iPhone 5 for several months after its release, which is a long time considering that the time between device generations is one year.

Judging by latest Apple TV jailbreak status, it still might never appear.

You linked to a support document explaining how the technology works. You may have had a point if this was listed on their product page describing the feature, but instead you have them touting the convenience of using your finger to unlock your phone and make purchases:

You check your iPhone dozens and dozens of times a day, probably more. Entering a passcode each time just slows you down. But you do it because making sure no one else has access to your iPhone is important. With iPhone 5s, getting into your phone is faster, easier, and even a little futuristic. Introducing Touch ID — a new fingerprint identity sensor.

Put your finger on the Home button, and just like that your iPhone unlocks. It’s a convenient and highly secure way to access your phone. Your fingerprint can also approve purchases from iTunes Store, the App Store, and the iBooks Store, so you don’t have to enter your password. And Touch ID is capable of 360-degree readability. Which means no matter what its orientation — portrait, landscape, or anything in between — your iPhone reads your fingerprint and knows who you are. And because Touch ID lets you enroll multiple fingerprints, it knows the people you trust, too.

Only an idiot would buy a jailbroken phone without a clean ESN on it. Those who do, know what they are getting. And you're forgetting Activation Lock, which a jailbreak will not defeat.

That's not true. Most non-idiots that I know have no idea what an ESN even is.

Regardless of whether or not fingerprint scanners are good security wise, it's a bit silly to think that phone robbing thugs are completely dim. The way it works in my first world modern country is that there are shops everywhere that unlock or reset phones as part of their services, and it isn't thugs running them. It's people with an affinity for 'tech' who just happen to deal with a shadier area.

If cracking fingerprint authentication is as easy as this article suggests then there's no doubt that these types of shops will do this readily. Steal a phone -> bring it to a place that does it.

The AppleID password is another thing though.

No, this is not the same as sim unlock. Circumventing touch id technology by making fake fingerprints is exactly the same case as being called to unlock a locked doors. The specialist knows when he is liable to crime and cannot make a legal bussines out of illegal access.

Honestly I think you're underestimating the gall of certain businesses. These aren't big multinational chains, they're like booths that pop up and down every year, in the less salubrious parts of town. They might not do it as openly, but there will be places thieves can go to circumvent touch ID if it's hackable...the knife wielding thug wont have to sit in his bedroom fiddling with acetate paper.

Except where I live there is organized phone snatching. A crew of phone hackers hire drug addicts to yoink phones off transit riders and then pay them 10% of the value. They then go to work on the phone changing the IMEI and I would imagine easily bypassing this fingerprint auth. They make use of the data for fraud purposes and then wipe and sell the phone on the street, a block away from where I live outside a run down sketchy bar.

Police caught the "muggers" slipping the phones into faraday bags so they couldn't be remotely wiped which led them to the ringleaders. They were busted but I'm sure there's a new crew doing it

I don't think it's possible to change the IMEI on an iPhone at all, and "easily bypassing" touchID involves collecting the user's fingerprint, which I guess is not included in the drug addicts' service offerings.

You can swap the logic board. They sell these for $80 or just trade with somebody who has a backlisted IMEI in UK/Australia for your US blacklisted phone. There's a bunch of crime forums that offer this service

> The $5 dollar wrench technique

I prefer Schneier's original rubber hose technique. Leaves fewer broken bones and bruises, but just as effective.

Plus, you can't get a decent sized adjustable wrench for less than $15 nowadays. Even the cheap Chinese ones that loosen the parallel alignment on the jaws after a few weeks cost more.

"Thermorectal cryptanalysis" it is called in Russian, and involves a soldering iron.

Agreed. But they always blow it out of proportion. As if the existing fingerprint systems are extremely insecure and theirs is not. The truth is they are all the same- insecure.

Theirs is better than the standard old fingerprint scanners and far better than using 'nothing' which is what they are replacing. They have blown nothing out of proportion.

if it causes people to behave recklessly because they have the false impression of security, when they would otherwise have taken better custodianship of their device and their data, then yes ... it can be worse than nothing.

That shouldn't be an issue considering most people don't have a passcode set.

Another option would be to just require a PIN (or both a PIN and fingerprint).

Yeah, that's going to move consumer devices. "Now harder to use!"

What would you call more reckless than having no passcode at all?

> he still has to know my AppleID password before he can remove the 'Find my Phone' feature.

I don't know if others are experiencing this, but as of iOS 7, that feature turns itself off every time my phone is rebooted.

Stop moving the goalpost.

> It's _not_ the panacea to all our security woes, and they have never claimed it was.

But they've never said it wasn't, either. It's important that everyone is in the clear about how secure TouchID is. I'm going to use it anyway, but the other decision is how much personal data I want to store on my phone.

TouchID*

* Note: TouchID is not the panacea to all our security woes. will not cure cancer, create world peace, does not kill kittens, [continues on listing everything it's not for 9 trillion pages]

Reply on news.ycombinator.com