Hacker News Reader

Comment by ccozan | Hacker News Reader

Why not both?

First, a fingerprint is unique, also serves as _identification_.

Secondly, a fingerprint is secure to a very high degree - cannot be easily stolen and duplicated, always is with you and so on. Thus, it serves as _authentication_ too.

EDIT: to the downvoters and critics: what you describe is using an _excess_ of effort to get my fingerprint ( technically, using force, etc ) . If I see a password, I can use it immediatelly, if you see my finger, there is a long way ( in terms of steps) until you can use the fingerprint attached to it. And btw, I am not defending Apple here.

View on HN

Fingerprints can easily be acquired, if that weren't the case they wouldn't be extensively used in crime scene investigation. When fingerprints were supposed to be used as authentication, together with an ID card, in Germany, the German Chaos Computer Club acquired the fingerprint of the minister of the interior from a used glass and spoofed a reader with it by transfering the print to some adhesive tape.

I think what op means is that if you find someone's password, you can type it into their device and you are in. Total breaking in time < 30s. If you find someone's fingerprint, you need to make a copy of it, scan it at high resolution, prepare a good printout and only then you can use it. Total breaking in time >1h.

While that's true, you can change a broken password, you can't change a fingerprint that easily.

you might want to review some of the literature around bypassing fingerprint readers before making that kind of statement... A large number of readers are easily fooled by copied prints. Also there's the False acceptance/false rejection rate tradeoff to consider.

Once of the major issues with biometrics is revocation. If compromised it can be difficult to change!

There's also the glossy fingerprint attracting screen of the iphone. Creating an artificial fingerprint from what you've left on the screen would be non trivial but far from impossible.

A fingerprint is trivially stolen and duplicated, and once they have physical access to you it's trivial to coerce you to use it too.

People have been saying this kind of thing since the 5s debuted - is there any evidence that it's actually happened outside of the fevered imaginations of Whatif Warriors?

This is only an issue to people on the left hand side of this: http://xkcd.com/538/

lol. This is not Hollywood. A phone thief isn't going to be using tape and superglue to find your fingerprint. Do you really want to encourage someone to remove your index finger when they mug you for your phone?

But is there a single piece of evidence for this ever happening outside of Hollywood?

Yes. A man had his finger ripped off by a thief stealing his iPad. It was not for the touch ID, but that is beside the point IMO. There have been plenty of incidents where muggers remove fingers to steal rings. I don't think a phone is so different.

Having looked up this iPad theft, they didn't rip his finger off - the drawstring of his bag got tightly wrapped around his little finger and the force of their grabbing the bag stripped it. An awful thing to happen, sure, but not at all "had his finger ripped off by a thief" - it was a pure accident.

Reply on news.ycombinator.com