Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by LeoPanthera | Hacker News Reader

Parent Full thread

LeoPanthera·

I have a 9-digit PIN. So I guess I'm immune from this type of attack? (In any reasonable time, at least.)

View on HN

With this particular tool, probably. You're a lot better off using an alphanumeric passcode and Touch ID though.

Strike out the Touch ID.

Care to explain why? I know it's possible to clone someone's fingerprint, but that's doable in nearly clinical settings, where you have a very,very clear image of the fingerprint in the first place - a phone stolen out of a pocket or handbag is not going to have them.

The demonstration by starbug, who won the bounty for cracking TouchID, was made using a fingerprint taken from the screen.

https://vimeo.com/75324765

It's not too complicated, see starbugs latest talk:

https://media.ccc.de/browse/congress/2014/31c3_-_6450_-_de_-...

(Download MP4 and use a desktop player, it contains an English translation)

In that talk he even describes, how they got the fingerprint from the German Secretary of Defense from a photograph taken in a distance of 3m at a press conference.

If your fingerprint is your password, it's much easier for authorities to get it. It becomes essentially impossible to refuse to divulge your password.

If you're only concerned about thieves, sure, TouchID is probably fine.

You need the passcode on reboot of the device anyway. I'd rather have a strong passcode and Touch ID than a weak passcode that's easily broken. A strong password and no Touch ID is almost completely unusable.

Without the touch ID, a long password is too inconvenient.

A nine digit numeric pin would take at most 18 weeks to crack at 40 seconds per attempt.

edit: at most 18 weeks; actual time will probably be shorter

I don't think so. My math says it would be more like 1268 years.

1268 years is correct.

You're right--not sure how I screwed that up.

Reply on news.ycombinator.com