Hacker News Reader

Comment by milesskorpen | Hacker News Reader

As people have written a thousand times so far, the finger print isn't saved off device. Yes, it is saved. But if someone can get your device, they can also get your fingerprint (probably from the screen of the same device).

View on HN

Since you are making this claim, I'll assume you've read the entire codebase of iOS. Is there anything stopping Apple from sending out an update that uploads the fingerprint?? Is there anything stopping the NSA from requiring Apple to do this?? It's not paranoia anymore.

Is it possible for software to even read the fingerprint from the sensor, as opposed to only asking the sensor if this fingerprint matches a previous fingerprint????

The processing happens on the A7 chip, but separated from the OS. Of course, the question is whether it's possible for Apple or someone else to update the fingerprint software to give back more data than just the yes/no, or if you could reconfigure the hardware so that the OS can talk to the sensor directly.

But again, I'm much more concerned about all the other information my cell phone operator, so this is quite simply just hysteria, and undermines the rightful concern us techies have about surveillance.

My theory is the hardware is isolated precisely to prevent a software bug (update) from being able to access the raw fingerprints. "Children's game steals fingerprints" is exactly the headline Apple doesn't want to see. But that's just speculation, maybe it is accessible.

Given the fact that we've seen no evidence of such updates previously, and rather we've seen Apple take many steps to protect privacy and even seen NSA leaked slides detailing how they need access to PCs to read iPhone backups, I think it's extremely unlikely that they would ever take the risk of pushing an customer-wide software update.

If you are worried about being specifically targeted, you shouldn't use an off the shelf cellphone at all, and this discussion is moot.

From an Occam's Razor POV: it would be simpler for some agency to require a backdoor or transfer the character-based unlock, which they could apply whether the phone has a finger-reader or not. Since I haven't read the entire codebase of any of the operating systems I use, my paranoid self says "Expect root-ation!" while my normal self says "Get back to work, quit reading and writing internet commments!"

How about hardware design doesn't allow it because the thing being stored is a hash?

Reply on news.ycombinator.com