Hacker News Reader

Comment by abalone | Hacker News Reader

Just to keep things in perspective, the goal of Touch ID is not to be unhackable. The goal is to get more consumers to move from zero security to pretty good security.

A very large number of people don't put any kind of passcode of any kind on their phone, simply because it's inconvenient. Touch ID is designed for them. It's not designed to secure nuclear footballs.

Touch ID is going to massively reduce the number of totally unsecured iPhones that require zero effort to access. That's the goal.

I think some people see "fingerprint scanner" and think "military-grade security" because that's where we've seen scanners before in movies and such. But this is really very much a solution for the consumer market, where convenience and usability are critical features of a security system. Sometimes infosec folks forget that. If you make it too hard to use (passcodes), people just bypass it. So you can blame the user, or you can try to design something easier to use. If in the end you've improved the overall security landscape, you've succeeded. I think that's what Apple is doing here.

View on HN

Here's Apple's main marketing text on the subject:

> Put your finger on the Home button, and just like that your iPhone unlocks. It’s a convenient and highly secure way to access your phone. Your fingerprint can also approve purchases from iTunes Store, the App Store, and the iBooks Store, so you don’t have to enter your password.

It is definitely intended to replace passwords. Pretty good security would be to require both the fingerprint and a PIN (for unlocking the phone, at that stage a fingerprint is fine for authenticating iTunes' digital purchases).

I think it's more than adequate security for App Store purchases.

My debit card, for example, has "paywave" short range payment support. So anybody who has my card can go around making small purchases, no PIN, no signature needed. I'm fine with this because the convenience far outweighs the security concern.

With the iPhone an attacker who replicates your fingerprint can make purchases to your iTunes account using your phone. They can't purchase to a different account, they can't purchase to a different device. In that sense, requiring a valid fingerprint is more than secure enough — even if faked it's not going to do much damage.

Creating a fake print that can fool the scanner is so much harder than stealing someone's debit/credit card. It's also so much less damaging to the victim (making purchases on their iTunes account vs. making any arbitrary purchase).

I think the balance between security and convenience for this technology is more than reasonable.

> Creating a fake print that can fool the scanner is so much harder than stealing someone's debit/credit card.

No, it's not. Starbug used simple means starting from a photo of a fingerprint. The fact that fingerprints are blasted all over the place makes this very easy. You could probably even build a cheap machine that automates this process.

I'd argue stealing a credit card is a much simpler one step process: Step 1. steal card. Done. Pretty easy too, lots of people leave their wallet or purse unattended in all sorts of scenarios, typically with their phone sitting underneath it. The home kitchen or the desk at work are typically places.

Creating fake print: Step 1. Either find a perfect print, or a number of imperfect prints. Step 2. photograph. Step 3. enhance. Step 4. print. Step 5. Use print on suitably encoded device (which probably means steeling their phone too).

Edit: Given the front of a phone is glass, there's probably going to be a print on the screen, though I wonder if any prints take from a phone screen would be clean? I don't know.

> Pretty good security would be to require both the fingerprint and a PIN

You're missing the point. Right now lots of people have no password at all. Touch ID is a big improvement over having no password.

Well, no password on their phone unlocks. But I thought Apple intended to replace your passwords in application services as well. Now, I didn't read the article at all (not a single damn word), so maybe the hack only applies to phone unlocks. If that is not the case however, then I think _you_ are missing the point. This would compromise all passwords replaced by finger print scans, right?

Reportedly when making purchases it "will still prompt you for your password every so often to 'renew Touch ID purchases.'"

Source: http://www.cultofmac.com/246572/iphone-5s-first-impressions-....

'every so often' seems a bit casual, for a payment [1,2]

[1] From the citation: "Passcodes and passwords aren’t completely eliminated by Touch ID, then, but they almost certainly will be later on."

[2] The glass screen will have your fingerprint on it, somewhere. That can be CSI'd by anyone who finds it. Anyone serious enough to do that (and its not much) can start escalating.

The primary use case here is keeping kids from buying apps or in-app purchases when their parents lend them the phone to play games. A casual solution is perfectly acceptable. If someone is going to go through the trouble of stealing my phone and cloning my fingerprint I'm guessing they would want more than purchasing music or apps under my iTunes account.

Locks just keep an honest man honest.

If someone wants what you have bad enough, there really isn't anything you can do to stop them.

If my kid is talented enough to create a silicone-gel replica of my fingerprint in order to buy in-game merch, she's earned it.

And if you know your phone is stolen you can disable it anyways.

You can't renew your fingerprint, though.

When most payments are under $5 it's probably ok. It's good enough for the credit/debit card payment industry, at least. (They relaxed the rules so you don't have to sign or enter a PIN for small purchases.)

Can we agree that Apple should not be marketing this as a "highly secure way to access your phone"?

Did you read the article? To crack the sensor, the would-be malevolent party needs a _2400 DPI photo of the fingerprint._

TouchID is highly secure if the only way to break into it is to have an ultra high-def image of the exact finger the device is looking for. I guess 50 character-long passcodes aren't secure because you could just tell a thief the code?

Yes, I read the article.

We must have wildly different definitions of "highly". I'm pretty confident I could reproduce this result in one afternoon. Compare that to other things we might consider highly secure, like strong encryption or Fort Knox. What word do you use for security measures that take non-trivial resources to circumvent?

And the social aspect? Is it common for you to obtain the image of the correct finger and then the phone from a stranger?

How do you approach that part of the problem?

It's not common for me to do that, but it's also not common for me to try breaking into iPhones.

But if I were trying to break into an iPhone, perhaps the finger prints are on the phone. Or some other item I also got as part of the same theft. Or I found the phone in the owner's house when I robbed it and have my pick of surfaces. Or I have the owner's prints in a database because they went were convicted of a crime(I admit I have no idea what resolution those are taken at). I don't think there's a shortage possibilities. You leave prints on almost everything you touch.

To be extra clear, I'm not saying the finger print reader isn't good enough for most iPhone users; I'm not arguing the nth-grandparent's point about that. My point is that it's not highly secure, and Apple shouldn't be marketing it that way. Similarly, the lock on my front door is plenty good for my house, but no one would ever describe my house as highly secure.

Got it and I understand your comment a bit better. I hadn't thought of the fingerprint lifted from the phone scenario.

You do have a very valid argument.

2400 DPI is not that hard to achieve. Any DSLR can do it with a macro lens attachment and a flash. Many scanners can do it as well.

a _2400 DPI photo of the fingerprint._

It needs a 2400 dpi output. This is not hard. 300 ppi source can easily generate a 2400 dpi output. DPI =/= PPI.

2400 dpi is nothing out of ordinary for a half decent scanner or a digital camera at 1:1 reproduction.

Why? It IS highly secure. Just not infallible.

Since they'd reverse the charges anyway if it wasn't you who made them, what exactly is the problem here?

This is where things start to get tricky. I've read up on "chip and PIN" in Europe, where purchasers have to insert their cards into a reader and enter the numeric code that is stored on the card.

From what I've found online, chip-PIN does indeed reduce fraud, but when fraud does happen, it becomes extraordinarily difficult for the cardholder to get a refund from the bank.

I could see fingerprint scanning going the same way -- with vendors saying "what do you mean you aren't the one who made this purchase? The device was unlocked with your unique fingerprint!"

So you're going with a slippery slope argument? This thing could cause that thing that could cause that bad thing, so this thing is bad? I suppose that is something that could happen in the future. It's not a likely problem to complain about with this particular implementation.

Since they'd reverse the charges anyway...

You're baselessly asserting your position, though.

If you write your pin on your ATM card, they will not refund you. That is policy and they ask everytime you lose your card. The bank views this as lack of due care. Likewise, if you leave copies of your fingerprints on your payment device, they could argue that you are likewise acting with un-reasonable care.

Now that this has been (so easily?) spoofed, is it reasonable to believe it is secure? That is a valid concern. Unlike a pin, you cannot reset a fingerprint security mechanism. So when it is compromised, it is over. So, the result is messy in that it puts you in a problem using today's standard practices, but at the same time, the standard practice "defense" is not applicable, and lacks an obvious alternative.

This is not a strawman, its a legitimate edge case.

The bank has never asked me if I had my PIN written on my card when I've lost it... all they ask is lost or stolen.

From a sample card-holder's agreement:

3. I will hold in strict confidence my personal identification number (PIN). I will take reasonable precautions to keep my PIN separate from my ATM card and to prevent the unauthorized disclosure of my PIN.

So, you sign an affadavit verifying you did not contravence this agreement. They will screen for this as/if you file a claim for fraud.

In particular, it turned out that there was a flaw in the Chip and PIN specification which made it possible to bypass the PIN requirement. There's some evidence this was exploited fairly widely in the wild before security researchers found the flaw, but since the banks erased the logs that recorded whether a PIN was actually used all the customers ended up liable for the fraudulent charges.

It's not legal (now) for European banks to shift the fraud liability to the Customer with chip-and-PIN, but that hasn't stopped them from trying: http://www.thisismoney.co.uk/money/saving/article-2215223/Vi...

> From what I've found online, chip-PIN does indeed reduce fraud, but when fraud does happen, it becomes extraordinarily difficult for the cardholder to get a refund from the bank.

I live in Europe, and twice in the last two years or so my card details have been compromised, and both times my bank has rang me to notify me of suspicious transactions before I'd even noticed. It depends on the bank (and the country most likely) with regards to getting a refund. I got refunds no problem, but I've heard people having problems in the UK. The fraud happened online (not sure how, I'm reasonably tech savvy and careful with my card details).

When Chip and PIN came in, as part of the TOS that you accepted by using the card, it included a clause that the bank is not liable for any fraud on the card as Chip/PIN is unbreakable (the implication being you must have given away your PIN).

I believe that this has now changed (although I've not had a new card recently and I don't remember seeing any new TOS).

The big gaping problem of course being that most fraud does not involve chip+pin transactions, but online transactions that are no better protected than before.

The payment can (mostly) only benefit the device owner though, right?

Buying apps with your device is not terribly useful unless you have take full posession of the device, in which case the owner can remote lock/wipe it with iCloud and dispute the charges with their CC company.

Since Friday, my 5s has prompted me for a password with this message more times than TouchID has worked succesfully.

No, you are missing the point.

Having some shiny new method does not mean these people that do not currently use a pin/password will magically start using this.

Now, if Apple started forcing everyone to use one or the other (or both), that's another story.

>Having some shiny new method does not mean these people that do not currently use a pin/password will magically start using this.

It actually does mean exactly that in the aggregate. There are huge number of people that don't use pass codes not because they don't care, but because they are inconvenient. This technology is for them, and it will have nothing to do with "magic" when they adopt this fundamental improvement (that happens to be also a heavily marketed main differentiation from the previous model).

As for the people that never used a pass code because they weren't aware/didn't care... probably less adoption, but just because the feature is so heavily marketed, many of them will also use it.

But yeah. Significant numbers of people who didn't secure their devices with pass codes will now do so. No magic required.

IT managers will either be thanking or cursing the CCC at this point...

I understand that iPhone (and iPad) allow IT to enforce setting of password (1). I think from the security perspective, IT is more worried about ability to remotely manage the device (like remote wipes in case of loss etc).

1. http://images.apple.com/iphone/business/docs/iOS_6_Security_...

Edit: I realized that the link is for iOS 6 - though I wouldn't expect them to reduce business IT functionality, not sure if these options are still in iOS 7.

"you don’t have to enter your password" != "you don't need a password"

As I understand it every now and again Apple will prompt you to enter your passcode/password, such as when you restart your device or if you haven't unlocked it in two days. Hardly a signal that passwords are done.

My iPad asks me for my iTunes password pretty much every time I update the apps. I'm assuming this is orthogonal from my having set a PIN to unlock the thing.

I love the psuedo lawyer speak in this thread

I love how certain people try to use complicated words and yet don't know how to spell them.

Passwords aren't exactly nuclear football grade either.

The full marketing text on the subject:

>You check your iPhone dozens and dozens of times a day, probably more. Entering a passcode each time just slows you down. But you do it because making sure no one else has access to your iPhone is important. With iPhone 5s, getting into your phone is faster, easier, and even a little futuristic. Introducing Touch ID — a new fingerprint identity sensor.

Put your finger on the Home button, and just like that your iPhone unlocks. It’s a convenient and highly secure way to access your phone. Your fingerprint can also approve purchases from iTunes Store, the App Store, and the iBooks Store, so you don’t have to enter your password. And Touch ID is capable of 360-degree readability. Which means no matter what its orientation — portrait, landscape, or anything in between — your iPhone reads your fingerprint and knows who you are. And because Touch ID lets you enroll multiple fingerprints, it knows the people you trust, too.

That's a matter of opinion, not fact.

What's the opinion? Apple said you can use this to replace your password. No one had an iTunes Store account without a password before, so this would 100% be replacing a password.

>> "Pretty good security would be to require both the fingerprint and a PIN (for unlocking the phone, at that stage a fingerprint is fine for authenticating iTunes' digital purchases)."

I believe that's the opinion being referred to.

Yes, thanks.

Actually, I did. I have a tweak from Cydia which autocompletes my Apple ID password when making a purchase from the App/iTunes Store.

If it autocompletes your name as well, would you say you don't have a name?

This seems correct. Apple's moved the bar to breaking into those phones from having the phone and a 4 digit or no passcode to having:

-- the phone

-- a 2400 dpi resolution image of the correct fingerprint

-- a 1200 dpi laser printer & transparent paper

-- pink latex milk or white woodglue

-- a non-trivial amount of time

That's what I was thinking, too. The fingerprint scanner is a bit like a LoJack - it's still possible to steal a car with a "The Club" on it, but most thieves will probably just move on to another car (although I've heard that car thieves, like pick pockets, don't really steal cars anymore, just components and loose gear.)

>although I've heard that car thieves, like pick pockets, don't really steal cars anymore, just components and loose gear.

I heard that too, airbags, satnav and entertainment systems are the target...

The problem here is your implying getting past the 4 digit code is substantially easier then cloning a finger print.

The code is in someone's head, or you have to deconvolute it from screen smudges. Your fingerprints are literally everywhere you go.

I think it would be pretty easy to get many people's phone password -- just by being in the right place when they unlock it, and watching closely. Most people I know don't cover up their phone at all when they enter it, even in public.

So you don't need to get "in someone's head". You just need a good view of them using it.

Granted, getting an iTunes Store password by just watching would be a lot harder. But compared to the 4-digit lock screen pw (or even the Android shape pw) TouchID seems a bit more secure, at least to me.

Conversely you can just change a phone password. Hell you could rotate it daily if you wanted (surprised that's not a feature yet). But you can't change your fingerprints.

or you could just rotate your fingers/toes/nipples?

Do you think the finger prints you leave everywhere are a substitute for the 2400 dpi photograph?

I bet you if CCC wanted to make a much stronger case, they would have taken that image from a fingerprint on a glass - but that didn't work. They photographed the finger and not a stray print for a reason.

-- a lot of luck, because after 5 failed attempts, you must enter your passcode

I have 8 digit pass code on my phone.

and also the fingerprint.

To corroborate your point, here is the transcript from the 5S launch:

"The third feature is all about security. Now we have so much personal information on our devices that we want to protect. <snipped> So we have to protect them. The most common wave of course is to set up a passcode. Simple four digit passcode or more complex one if you want. This is something you do, dozens of times a day to unlock and get access to your phone. Unfortunately, some people find that's too cumbersome and they don't set it up. In fact in our research about half of smartphone customers do not set up a passcode on the device and they really, really should. That's the team has worked so hard in the brand new technology to make this easy and fun to do."

http://www.earningsimpact.com/Transcript/83555/AAPL/Launch-o...

Touch ID is not "pretty good security" it's not even "good security" it's simply very bad security.

Touch ID is better than nothing and that people use Touch ID instead of nothing is better than the current state but not by much and this definitely isn't a huge achievement. Which is really the biggest issue with Touch ID, it's advertised as such and people believe it.

I'd be willing to bet that over the next couple of years millions of people will try to log into somebodys iPhone that they shouldn't have access to, but in the process are prevented from doing so by the fingerprint based security.

I also bet, in 99.9999% or more of those cases, the attacker doesn't even attempt to bypass the security by faking the users fingerprint.

I'd also be willing to bet that these figures are substantially better than the current situation where people don't bother to lock their phone at all. People will use it because it's a gimmick, not because of it's security properties, but it will still work.

But you have to consider potential damage from the successful attack. It doesn't matter if 99% of low damage attacks are unsuccessful but 1% high damage attacks will go through. The solution is fine by itself but millions of people will use it and not understand the real level of protection.

The potential damage is zero. You (and everyone else in this thread) are forgetting that you can't steal an iPhone for more than 30 seconds anymore without Activation Lock locking you and everyone else out, forever, period, paragraph.

Activation Lock + Touch ID = all the security that almost anyone needs on a phone and much higher security than any of us have been used to up to now.

I think this is key here. Before, you could try and lock or wipe your phone when it was stolen. But in order for it to work the thief must have let it powered on. If he was smart and shut it off, took it home and booted into DFU mode to restore a the thing back to factory settings, you were out of luck.

But with the new Activation Lock, it supposedly doesn't matter if it is shut down, the minute someone tries to flash the phone. Be it normally via iTunes or via DFU mode and iTunes there should appear a message that the phone has been wiped and must be unlocked with the iCloud password of the account that did the wiping. So no chance to flash the phone back to factory settings.

Well right now I'd guess that the percent of high damage attacks that go through are significantly higher than 1%, so lowering that to "1%" isn't an improvement?

> Touch ID is better than nothing... but not by much

You can't be serious. A completely unlocked phone that anybody can trivially access with a swipe.. vs. a scanner that you'd have to lift and reconstruct someone's fingerprint to bypass. That is definitely a significant improvement.

Yes, how many people run $10,000 dollar competitions to get past the default swipe to unlock screen?

Based on what they've said previously, I'm pretty sure the people who ran that competition expected TouchID to be a lot harder than this to bypass and were doing it as a publicity stunt to try and demonstrate that.

> That is definitely a significant improvement.

Sure is a significant improvement for some people at least. http://t.co/EK3sdeloUX

Baseless FUD is OK as long as Linux ain't the target, right?

Where the fuck did that come from? It is neither baseless or FUD. That fingerprint will be sent over the wire at some point and the NSA will gladly pick it up. How you think otherwise is beyond me.

What operating system I prefer really has nothing to do with it, even if it is linux.

Posted from my iPhone, android, third mac mini, 2nd mac air, or first thinkpad who the fuck knows (or cares? oh you obviously)

From Apple's site [1]:

> Touch ID does not store any images of your fingerprint. It stores only a mathematical representation of your fingerprint.

> The Secure Enclave is walled off from the rest of A7 and as well as the rest of iOS. Therefore, your fingerprint data is never accessed by iOS or other apps, never stored on Apple servers, and never backed up to iCloud or anywhere else. Only Touch ID uses it and it can't be used to match against other fingerprint databases.

[1] http://support.apple.com/kb/HT5949?viewlocale=en_US

Your trust in Apple is heartwarming.

Then you might as well say Apple already secretly have finger scanner since iPhone first generation and already sent that data over the wire. Or may be there are also finger scanner on your keyboard right now!!! Also that video-cam on most notebook, it's now always on and secretly send the data to NSA!!!!

a "mathematical representation of" is exactly what a "digital image" is.

They're clearly referring to storing some kind of "hash"/mathematical representation of your fingerprint vs a plain photo/"digital image".

It's fud until you or someone else posts evidence that the fingerprint is sent over the wire, or that Apple intends to do the same (for example, code that sends the fingerprint that awaits activation by a third party). You're not going to be able to do that. It's shameful that you can't even recognize the fudishness of what you posted, especially if Linux actually is your operating system of choice and you have been through the fud wars of the late nineties and early two thousands (that was only a guess on my part).

"It's fud until you or someone else posts evidence that the fingerprint is sent over the wire"

It absolutely isn't. Even if just the hash were sent over the wire (or if it were possible for the authorities to extract it over the wire), it would be perfectly possible for the authorities to run the same hash algorithm on their candidate print and see if the hashes match. Such evidence would likely not be admissible in court but 1) it would be enough to give the authorities a tipoff, 2) for matters deemed important enough, secret trials seem to be all the rage these days.

I would be _very_ surprised if there were no backdoor in iPhones for the authorities. Even their "secure" area. The U.S. authorities simply do not take no for an answer when having a "talk" with a vendor producing a widespread "security" related product.

> I would be _very_ surprised if there were no backdoor

I'm not sure if you understand what FUD means. Your surprise or lack thereof does not count as evidence, and is irrelevant to whether something is FUD or not.

> MS Exec: "I'd be very surprised if Linux had a lower TCO than Windows Server."

Canonical example of FUD. EXACT same thing as you're saying, just in a different context.

"EXACT same thing as you're saying"

You've got to be careful when you say things like that, because they're trivial to refute.

The whole point of a backdoor is to be obfuscated and hard to find. So it would be very likely that you would not find one even if one were present. Your example is simply a Microsoft not bothering to do something that's perfectly researchable.

We don't have any _proof_ that Dual EC DRBG is defeatable to the NSA. By your logic we should still be using it happily until we have that proof and until then any caution is simply "FUD".

So if that's "FUD", then I've got news for you: the security world is very sensibly built upon FUD.

I would be very surprised if the fingerprint is sent over the wire. Instead, I would expect the "secure enclave" to validate the fingerprint, and then emit a time-limited certificate of some sort to authenticate with servers. The fingerprint information - or derived information such as hashes - never needs to leave the phone.

Firstly nobody cares what hardware you have. It doesn't make what you say any more or less accurate.

Which in this case doesn't matter because you're talking complete nonsense. Apple does not send your fingerprint over the wire.

While I don't have data to back it up, I believe most Android users use the draw pattern to unlock method. This feature is absolutely trivial to defeat - you can simply hold the phone up to the light, see the trails of oil left on the phone, and follow that trail. People have done this to my own phone with just a few tries.

TouchID represents a massive increase in security over draw pattern to unlock, and it's easier to use at the same time.

It probably also represents an increase in security over 4 digit PIN codes, though that's shakier.

People actually do other actions on their phone after unlocking it.

If somebody swipes on their homescreen, browse the web, etc, the trail would not be just the unlock pattern.

The exploit you're talking about may work if you get hold of the phone right after the user unlocks it since the trail only has the pattern.

True enough, there is other "noise" on the phone, in the form of point-like finger prints, and even other trails. But you're imagining a blank phone, where you have to try and discern one trail from another. Now turn the phone on, and the unlock background appears. Which trails intersect all of the dots of the unlock background?

It's much easier that you imagine. I've been using my phone as I normally do throughout the day, and I can see the unlock pattern clearly on the phone.

That's why you need a unlock pattern that intersects / overlaps itself. (Not foolproof, just makes that attack harder.)

It also doesn't work nearly as well if you are OCD about wiping your screen often, not that that makes the pattern lock any better but it isn't quite that trivial to defeat

Doesn't the trail get cleaned off when you put it in your pocket?

No, it takes pretty vigorous scrubbing, at least on mine.

Having a lock in your front door is not perfect but it is much better than not having one at all.

The way that Apple haters use stunts like this to suspend normal logic and reasoning in order to express their juvenile spite is staggering.

No one, ever, claimed TouchID was impregnable, but it is very good security and is better than what the vast majority of people do at present.

Anyone prepared to devote the time and resources that CCC did to breaking your phone has other simpler means at their disposal. I personally believe that no one else will replicate this achievement because it is simply a publicity stunt to get clicks and feed the hordes of anti-Apple zealots.

The problem is not so much what CCC has done, but CCC has started. In the days/month ahead.. there is now a possibility of building a more practical attack. Remember the firefox plugin which allowed users to steal FB user sessions in a cafe with Free WiFi (or any WiFi hotspot)? That wasn't a new attack.. just made an existing attack easier (and hence caught a LOT of attention).

The threat is similar. Now there is an exploit.. now the collective security researcher (and hacktivist) will work to make the hack easier by building a tool.. THERE lies the real danger.

I still commend Apple for trying. The real issue will be if I can steal the "Hash" of the fingerprint and reverse it to know who it is... so far TouchId has done well. The way that happens, Apple users will need to rethink using TouchID

> Anyone prepared to devote the time and resources that CCC did to breaking your phone has other simpler means at their disposal

Really? Lift someone's print, leave it with superglue, scan and print it and then dump glue on the scan.

That seems to be the sum total of what needs to be done. You need only sticky tape to lift the print and the rest can be done in an hour.

It sounds quite action movie, but in reality it's pretty damn simple and if I wanted to get access to your phone I could easily prepare it in advance and carry a tiny latex strip in my wallet for just the right occasion without your knowledge at any point.

It sounds quite action movie, but in reality it's pretty damn simple

Also in reality it will foil over 99% of potential unauthorized activation attempts as most people aren't going to craft fingerprints to get into someone's device.

If reality is the bar you're using, TouchID still wins.

>but in reality it's pretty damn simple

Also, it's not remotely "pretty damn simple":

https://blog.lookout.com/blog/2013/09/23/why-i-hacked-apples...

"Creating the fake fingerprint is arguably the hardest part and by no means “easy.” It is a lengthy process that takes several hours and uses over a thousand dollars worth of equipment..."

Is not about Apple haters is that the security code is actually more secure than TouchID.

If having TouchID will increase the amount of people that doesn't lock thir phone I'm up for it. But is not this amazing super-secure technology that will revolutionize the world.

Really? You think a four digit security code that users have to enter repeatedly is more secure than obtaining a 2400 dpi clean image of a specific fingerprint and a nontrivial lab procedure? It might require some patience but if you have an excuse for being around the target, it doesn't require great skill to see the digits as they are entered. In either case the adversary has to deal with Activation Lock which has been introduced with iOS7.

I've read there is already something like 35% adoption of iOS7 so we may see soon how effective Activation Lock is at deterring theft.

Using the method employed by the CCC to break the security is not trivial...

Touch ID is competing against pins chosen from a universe of 10,000. This isn't great security, but it's appropriate security for unlocking a device you already must have physical access to.

Actually doesn't that highlight one of the biggest flaws with this, in that your finger prints will already be all over the device? Lift the device, get the authorisation token for free. At least with a password you also need to either crack it or discover it from some other means.

So far, nobody has demonstrated an attack that is able to break the fingerprint reader by reading fingerprints off of the device (or another surface). The attack demonstrated by CCC requires them to take a high resolution photograph of your finger. It is likely substantially harder to just lift a good enough quality fingerprint to defeat the system.

I was going to argue with your statements but than I turned the screen in my phone off and realized that the front part of the screen is covered with my thumb prints, and they are ripe for photographing.

>Touch ID is better than nothing and that people use Touch ID instead of nothing is better than the current state

That makes it great security.

I took a security class where, amongst other things, we learned how to pick locks. After we learned how to do so with provided equipment, the instructor said "So since these locks are insecure, should I have them in my home? Yes, because if a motivated intruder wanted to come into my home, I still have windows."

Except, there is a larger point that CCC is making:

> fingerprint biometrics is unsuitable as access control method and should be avoided.

What happens when the next set of hackers figure out how to remotely access and extract the fingerprints (hashed, secured, whatever) stored on the iPhone itself?

I don't really think it is relevant. The iTunes authorisation for example wouldn't be sent the fingerprint information, it would be sent the response 'yes the person passed the test'.

The fingerprint information stored in the 'secure enclave' of the A7 is a combination of the data related to the fingerprint combined with unique information for that specific device. So even if the data could be extracted, using it for any purpose other than unlocking that specific phone would be impossible.

>I don't really think it is relevant. The iTunes authorisation for example wouldn't be sent the fingerprint information, it would be sent the response 'yes the person passed the test'.

No, it wouldn't send that response at all. That's called a client-side security control, and I'm sure you can think of why that's out of the question in any system.

I don't want to jump in on the "how secure is my phone discussion", I just wanted to point out that with all the revelations and concerns regarding privacy, a single company having fingerprints for some significant portion of North America is nothing to be taken lightly.

That said, I sincerely doubt this is the case. I imagine the phone acts as a proxy for the authentication, validating the fingerprint then sending some other form of authorization to Apple or using the fingerprint as input to a cryptographic algorothm.

We don't really know exactly what it stores, but they claim it's a hash of the fingerprint. That is not the same as the actual fingerprint at all, and it should be unusable outside the iPhone 5S ecosystem. I would imagine this hash, is also what they send to the servers to authenticate, but time will tell.

If they send a hash to servers, that still has privacy implications. Apple could build a searchable database of those hashes, and the government could issue subpoenas to search that database for particular fingerprints. Maybe that's not such a bad thing, because it could help to solve crimes, but it's worth thinking about.

That's an awful idea. The potential for false positives is significant, since fingerprints are not 100% accurate identification method.

http://www.ncbi.nlm.nih.gov/pmc/articles/PMC3093498/ states that even professional forensics required independent verification to eliminate false positives.

The hashes, whatever they are, will not be "binary" in their nature. Matching against a range of visual characteristics requires to allow some level of fuzziness. Even assuming that near future improvements bring the false positive rate to half of that of the best forensic experts (to 0.05%), the law of large numbers guarantees that innocent people will be caught up in investigation dragnets. Just imagine the lives destroyed by these kinds of clerical errors.

The above is the same reason I'm against our national law enforcement getting access to the passport biometric databases. Even discounting the potential for abuse: once the police have a suspect with "matching" fingerprint available, they will have less incentive to find other ones.

It's a shame really, because all evidence is fuzzy on some level. DNA could be planted, videos can be a of a lookalike, or being at a particular location at a particular time could be a coincidence. I don't know exactly how law enforcement works, but they really should be looking for connections and try to explain why a suspect is not the right guy, instead of the other way around. Maybe that is just wishful thinking.

I remember reading (but can't find the source, I think it was Anand) that they store a hash of the fingerprint data and a unique identifier of the phone.

Usually when I see smart people talking about security, they think about what attack vector/situation you are trying to protect against. In this case, the situation you are trying to protect against is not keeping your phone locked when you are in custody or at gun point. The situation is someone unlocking your phone if someone swipes it from your pocket, you lose your phone, or simply leave it on your desk for a few moments as you go to the bathroom at the office. So, yes, a biometric scanner, even one that is easily beaten by an attacker, is good for this purpose.

Whatever the case, maybe we should step back and get some more perspective. How many of us don't put locks on our shared computers and phones because we don't want the inconvenience of ensuring everybody that should be allowed to use it can? My phone is a shared device and I removed any and all locks on it as I got very tired of "oh, let me unlock that for you." Basically, I want everybody that can reach it physically (when it isn't lost or stolen) to be able to access it and make calls, surf the web, use the map, search contacts, play games, etc. Is any phone locking mechanism going to work perfectly, probably not. Being able to set up my phone to unlock for anybody in my family and friends circle by something like fingerprints is a pretty good start.

> Touch ID is going to massively reduce the number of totally unsecured iPhones that require zero effort to access.

I feel like we just went through this very same drill with the Chrome team refusing to hide web site passwords behind a master password, something that all browsers, except Chrome, support. Given how stubborn the Chrome team has been in its handling of this situation, I think fighting that TouchId battle is going to be equally challenging.

Common sense is, sadly, not very common, not even among the security circles.

What worries me the most is that biometrics can be used to authorize payments, and for anyone that has crafty teenage (or younger) kinds this might sounds a bit risky. Getting access to your parents fingerprint is easy while getting access to their password is much harder.

Getting access to the equipment required to duplicate their fingerprint is much harder...

>Just to keep things in perspective, the goal of Touch ID is not to be unhackable. The goal is to get more consumers to move from zero security to pretty good security.

Agreed. Complaining about this hack would be like people saying locks are "hackable" if you steal someones key and make a copy. There's always a way around any system, if a criminal is dedicated enough to get past it.

I agree. This is just like face unlock on Android. A nice feature, but not bulletproof.

Piss poor excuse - think of all the users using a password now downgrading their security, but Apple advertising it as "high security".

I like what you're saying, massively allow users to secure their phones without the pain of entering a password, but when it comes at a compromise of "little is better than none" is not the mentality people need for security. I'd rather see corporations rewarding and encouraging proper security strategies rather than creating some compromise for marketing.

>Piss poor excuse - think of all the users using a password now downgrading their security, but Apple advertising it as "high security".

If you're talking aggregate security, TouchID will still increase security (even with current PIN users moving to a FP Scan) as currently about 50% don't use any sort of pass code now.

If you're talking about the ability for current PIN users to maintain their level of security if they wish, -they can still use a PIN.

Bottom line is that there will be fewer successful unauthorized login attempts in the wild.

> The goal is to get more consumers to move from zero security to pretty good security.

One might argue that Touch ID is too strong to be used where there was no security before. In an arms race with thefts and hackers, leaping too far forwards might not be the best option in the long term.

Thefts are not limited by passwords, the thief will just reset the phone.

I don't know, reproducing a fingerprint is relatively easy to understand (just scan and print), while cracking a password can be more exotic to 'traditional' thieves. When today they'd just wipe the phone, tomorrow they make take the extra step of pulling out the SIM card and unlock with the fingerprint, and sell the data as well.

Your random thief is more worried about cell phone tracking than any data you have on your phone. They will wipe it as soon as possible today, and probably for the next few years; they don't give a crap about your cat photos.

Even if your phone was unlocked, they probably wouldn't bother more than a cursory glance. They have more phones to steal than to bother with is on some random person's phone. When the data is important, the theft will be more targeted.

I see where this assumption comes from, but scraping the personal info off a phone is a thing, and "random thieves" might be the minority when it comes to stealing and reselling phones (at least in europe or asia they are rarely random. It don't know for the US).

I haven't heard of it recently, but a few years ago there was a story on phone operator temporary staff that would offer clients to move their contact info from their old phone to the new one (it's a completely legit service) and keep a backup of the old info to sell it. The price for an entry was something like 2 cents, but data would be sold by batches for about 700~800 dollars.

I didn't find any quick resources in english, just for the numbers there was this piece by trendmicro (to note, they are of course biased to make the number a littre bigger) http://blog.trendmicro.co.jp/archives/4828

I live in Beijing, the first thing the thief will do here is take the sim out and wipe the phone. They will also hawk the phone as soon as possible to maximize turnover, so it's usually possible to buy your stolons phone back within the hour.

Actually, with iOS7s new activation lock feature, thefts are limited by passwords.

Right. Yesterday, people clamored for a browser API to allow for that stuff to login, now that it is broken it has magically morphed into a mere 'convenience feature', a sidenote, a little fix.

(Of course, this post ends with Apple has succeeded. Sigh.)

"Touch ID is going to massively reduce the number of totally unsecured iPhones that require zero effort to access. That's the goal."

...while lowering the security of a massive number of iPhones previously secured by PINs.

That comment perfectly sums up what I have been trying to argue with friends the last day or two! Thank you! Presuming you don't mind I will send this over to them!

If users not using any PIN is moving to TouchID then it is good. If users using PIN moves to TouchID then it is not as sunny.

Reply on news.ycombinator.com