Hacker News Reader

Comment by jonknee | Hacker News Reader

Here's Apple's main marketing text on the subject:

> Put your finger on the Home button, and just like that your iPhone unlocks. It’s a convenient and highly secure way to access your phone. Your fingerprint can also approve purchases from iTunes Store, the App Store, and the iBooks Store, so you don’t have to enter your password.

It is definitely intended to replace passwords. Pretty good security would be to require both the fingerprint and a PIN (for unlocking the phone, at that stage a fingerprint is fine for authenticating iTunes' digital purchases).

View on HN

I think it's more than adequate security for App Store purchases.

My debit card, for example, has "paywave" short range payment support. So anybody who has my card can go around making small purchases, no PIN, no signature needed. I'm fine with this because the convenience far outweighs the security concern.

With the iPhone an attacker who replicates your fingerprint can make purchases to your iTunes account using your phone. They can't purchase to a different account, they can't purchase to a different device. In that sense, requiring a valid fingerprint is more than secure enough — even if faked it's not going to do much damage.

Creating a fake print that can fool the scanner is so much harder than stealing someone's debit/credit card. It's also so much less damaging to the victim (making purchases on their iTunes account vs. making any arbitrary purchase).

I think the balance between security and convenience for this technology is more than reasonable.

> Creating a fake print that can fool the scanner is so much harder than stealing someone's debit/credit card.

No, it's not. Starbug used simple means starting from a photo of a fingerprint. The fact that fingerprints are blasted all over the place makes this very easy. You could probably even build a cheap machine that automates this process.

I'd argue stealing a credit card is a much simpler one step process: Step 1. steal card. Done. Pretty easy too, lots of people leave their wallet or purse unattended in all sorts of scenarios, typically with their phone sitting underneath it. The home kitchen or the desk at work are typically places.

Creating fake print: Step 1. Either find a perfect print, or a number of imperfect prints. Step 2. photograph. Step 3. enhance. Step 4. print. Step 5. Use print on suitably encoded device (which probably means steeling their phone too).

Edit: Given the front of a phone is glass, there's probably going to be a print on the screen, though I wonder if any prints take from a phone screen would be clean? I don't know.

> Pretty good security would be to require both the fingerprint and a PIN

You're missing the point. Right now lots of people have no password at all. Touch ID is a big improvement over having no password.

Well, no password on their phone unlocks. But I thought Apple intended to replace your passwords in application services as well. Now, I didn't read the article at all (not a single damn word), so maybe the hack only applies to phone unlocks. If that is not the case however, then I think _you_ are missing the point. This would compromise all passwords replaced by finger print scans, right?

Reportedly when making purchases it "will still prompt you for your password every so often to 'renew Touch ID purchases.'"

Source: http://www.cultofmac.com/246572/iphone-5s-first-impressions-....

'every so often' seems a bit casual, for a payment [1,2]

[1] From the citation: "Passcodes and passwords aren’t completely eliminated by Touch ID, then, but they almost certainly will be later on."

[2] The glass screen will have your fingerprint on it, somewhere. That can be CSI'd by anyone who finds it. Anyone serious enough to do that (and its not much) can start escalating.

The primary use case here is keeping kids from buying apps or in-app purchases when their parents lend them the phone to play games. A casual solution is perfectly acceptable. If someone is going to go through the trouble of stealing my phone and cloning my fingerprint I'm guessing they would want more than purchasing music or apps under my iTunes account.

Locks just keep an honest man honest.

If someone wants what you have bad enough, there really isn't anything you can do to stop them.

If my kid is talented enough to create a silicone-gel replica of my fingerprint in order to buy in-game merch, she's earned it.

And if you know your phone is stolen you can disable it anyways.

You can't renew your fingerprint, though.

When most payments are under $5 it's probably ok. It's good enough for the credit/debit card payment industry, at least. (They relaxed the rules so you don't have to sign or enter a PIN for small purchases.)

Can we agree that Apple should not be marketing this as a "highly secure way to access your phone"?

Did you read the article? To crack the sensor, the would-be malevolent party needs a _2400 DPI photo of the fingerprint._

TouchID is highly secure if the only way to break into it is to have an ultra high-def image of the exact finger the device is looking for. I guess 50 character-long passcodes aren't secure because you could just tell a thief the code?

Yes, I read the article.

We must have wildly different definitions of "highly". I'm pretty confident I could reproduce this result in one afternoon. Compare that to other things we might consider highly secure, like strong encryption or Fort Knox. What word do you use for security measures that take non-trivial resources to circumvent?

And the social aspect? Is it common for you to obtain the image of the correct finger and then the phone from a stranger?

How do you approach that part of the problem?

It's not common for me to do that, but it's also not common for me to try breaking into iPhones.

But if I were trying to break into an iPhone, perhaps the finger prints are on the phone. Or some other item I also got as part of the same theft. Or I found the phone in the owner's house when I robbed it and have my pick of surfaces. Or I have the owner's prints in a database because they went were convicted of a crime(I admit I have no idea what resolution those are taken at). I don't think there's a shortage possibilities. You leave prints on almost everything you touch.

To be extra clear, I'm not saying the finger print reader isn't good enough for most iPhone users; I'm not arguing the nth-grandparent's point about that. My point is that it's not highly secure, and Apple shouldn't be marketing it that way. Similarly, the lock on my front door is plenty good for my house, but no one would ever describe my house as highly secure.

Got it and I understand your comment a bit better. I hadn't thought of the fingerprint lifted from the phone scenario.

You do have a very valid argument.

2400 DPI is not that hard to achieve. Any DSLR can do it with a macro lens attachment and a flash. Many scanners can do it as well.

a _2400 DPI photo of the fingerprint._

It needs a 2400 dpi output. This is not hard. 300 ppi source can easily generate a 2400 dpi output. DPI =/= PPI.

2400 dpi is nothing out of ordinary for a half decent scanner or a digital camera at 1:1 reproduction.

Why? It IS highly secure. Just not infallible.

Since they'd reverse the charges anyway if it wasn't you who made them, what exactly is the problem here?

This is where things start to get tricky. I've read up on "chip and PIN" in Europe, where purchasers have to insert their cards into a reader and enter the numeric code that is stored on the card.

From what I've found online, chip-PIN does indeed reduce fraud, but when fraud does happen, it becomes extraordinarily difficult for the cardholder to get a refund from the bank.

I could see fingerprint scanning going the same way -- with vendors saying "what do you mean you aren't the one who made this purchase? The device was unlocked with your unique fingerprint!"

So you're going with a slippery slope argument? This thing could cause that thing that could cause that bad thing, so this thing is bad? I suppose that is something that could happen in the future. It's not a likely problem to complain about with this particular implementation.

Since they'd reverse the charges anyway...

You're baselessly asserting your position, though.

If you write your pin on your ATM card, they will not refund you. That is policy and they ask everytime you lose your card. The bank views this as lack of due care. Likewise, if you leave copies of your fingerprints on your payment device, they could argue that you are likewise acting with un-reasonable care.

Now that this has been (so easily?) spoofed, is it reasonable to believe it is secure? That is a valid concern. Unlike a pin, you cannot reset a fingerprint security mechanism. So when it is compromised, it is over. So, the result is messy in that it puts you in a problem using today's standard practices, but at the same time, the standard practice "defense" is not applicable, and lacks an obvious alternative.

This is not a strawman, its a legitimate edge case.

The bank has never asked me if I had my PIN written on my card when I've lost it... all they ask is lost or stolen.

From a sample card-holder's agreement:

3. I will hold in strict confidence my personal identification number (PIN). I will take reasonable precautions to keep my PIN separate from my ATM card and to prevent the unauthorized disclosure of my PIN.

So, you sign an affadavit verifying you did not contravence this agreement. They will screen for this as/if you file a claim for fraud.

In particular, it turned out that there was a flaw in the Chip and PIN specification which made it possible to bypass the PIN requirement. There's some evidence this was exploited fairly widely in the wild before security researchers found the flaw, but since the banks erased the logs that recorded whether a PIN was actually used all the customers ended up liable for the fraudulent charges.

It's not legal (now) for European banks to shift the fraud liability to the Customer with chip-and-PIN, but that hasn't stopped them from trying: http://www.thisismoney.co.uk/money/saving/article-2215223/Vi...

> From what I've found online, chip-PIN does indeed reduce fraud, but when fraud does happen, it becomes extraordinarily difficult for the cardholder to get a refund from the bank.

I live in Europe, and twice in the last two years or so my card details have been compromised, and both times my bank has rang me to notify me of suspicious transactions before I'd even noticed. It depends on the bank (and the country most likely) with regards to getting a refund. I got refunds no problem, but I've heard people having problems in the UK. The fraud happened online (not sure how, I'm reasonably tech savvy and careful with my card details).

When Chip and PIN came in, as part of the TOS that you accepted by using the card, it included a clause that the bank is not liable for any fraud on the card as Chip/PIN is unbreakable (the implication being you must have given away your PIN).

I believe that this has now changed (although I've not had a new card recently and I don't remember seeing any new TOS).

The big gaping problem of course being that most fraud does not involve chip+pin transactions, but online transactions that are no better protected than before.

The payment can (mostly) only benefit the device owner though, right?

Buying apps with your device is not terribly useful unless you have take full posession of the device, in which case the owner can remote lock/wipe it with iCloud and dispute the charges with their CC company.

Since Friday, my 5s has prompted me for a password with this message more times than TouchID has worked succesfully.

No, you are missing the point.

Having some shiny new method does not mean these people that do not currently use a pin/password will magically start using this.

Now, if Apple started forcing everyone to use one or the other (or both), that's another story.

>Having some shiny new method does not mean these people that do not currently use a pin/password will magically start using this.

It actually does mean exactly that in the aggregate. There are huge number of people that don't use pass codes not because they don't care, but because they are inconvenient. This technology is for them, and it will have nothing to do with "magic" when they adopt this fundamental improvement (that happens to be also a heavily marketed main differentiation from the previous model).

As for the people that never used a pass code because they weren't aware/didn't care... probably less adoption, but just because the feature is so heavily marketed, many of them will also use it.

But yeah. Significant numbers of people who didn't secure their devices with pass codes will now do so. No magic required.

IT managers will either be thanking or cursing the CCC at this point...

I understand that iPhone (and iPad) allow IT to enforce setting of password (1). I think from the security perspective, IT is more worried about ability to remotely manage the device (like remote wipes in case of loss etc).

1. http://images.apple.com/iphone/business/docs/iOS_6_Security_...

Edit: I realized that the link is for iOS 6 - though I wouldn't expect them to reduce business IT functionality, not sure if these options are still in iOS 7.

"you don’t have to enter your password" != "you don't need a password"

As I understand it every now and again Apple will prompt you to enter your passcode/password, such as when you restart your device or if you haven't unlocked it in two days. Hardly a signal that passwords are done.

My iPad asks me for my iTunes password pretty much every time I update the apps. I'm assuming this is orthogonal from my having set a PIN to unlock the thing.

I love the psuedo lawyer speak in this thread

I love how certain people try to use complicated words and yet don't know how to spell them.

Passwords aren't exactly nuclear football grade either.

The full marketing text on the subject:

>You check your iPhone dozens and dozens of times a day, probably more. Entering a passcode each time just slows you down. But you do it because making sure no one else has access to your iPhone is important. With iPhone 5s, getting into your phone is faster, easier, and even a little futuristic. Introducing Touch ID — a new fingerprint identity sensor.

Put your finger on the Home button, and just like that your iPhone unlocks. It’s a convenient and highly secure way to access your phone. Your fingerprint can also approve purchases from iTunes Store, the App Store, and the iBooks Store, so you don’t have to enter your password. And Touch ID is capable of 360-degree readability. Which means no matter what its orientation — portrait, landscape, or anything in between — your iPhone reads your fingerprint and knows who you are. And because Touch ID lets you enroll multiple fingerprints, it knows the people you trust, too.

That's a matter of opinion, not fact.

What's the opinion? Apple said you can use this to replace your password. No one had an iTunes Store account without a password before, so this would 100% be replacing a password.

>> "Pretty good security would be to require both the fingerprint and a PIN (for unlocking the phone, at that stage a fingerprint is fine for authenticating iTunes' digital purchases)."

I believe that's the opinion being referred to.

Yes, thanks.

Actually, I did. I have a tweak from Cydia which autocompletes my Apple ID password when making a purchase from the App/iTunes Store.

If it autocompletes your name as well, would you say you don't have a name?

Reply on news.ycombinator.com