Live data from Hacker News

Chaos Computer Club breaks Apple TouchID

ccc.de

231–240 of 458 posts

Re: Chaos Computer Club breaks Apple TouchID

#232
post #160
post #140

Earlier quoted context omitted.

> Fingerprint scanning is absolutely better than a pass code How often can you change your fingerprint? I can change my pass code virtually an infinite number of times. How often do you inadvertently leave your pass code in random places just by touching things? A good pass code is absolutely better than fingerprint scanning.

That's hyperbolic. How often can someone see your passcode over your shoulder? Or have it picked up by a security camera? Fingerprint scanning absolutely has advantages over pass codes. Security is all about trade-offs. This result was to be expected (in some form). What will be worry me is if the "secure enclave" where the fingerprint data is stored is cracked (and I wouldn't be surprised if that happens too eventua…

Your point is moot. As soon as your fp is digitally available online. E.g.,the CCC has captured and published former german minister of the interior, Wolfgang Schäuble's fingerprint in 2008 [1]. This finger of him is not secure any more and readily available via a google image search.

[1] http://www.h-online.com/newsticker/news/item/CCC-publishes-f...

Re: Chaos Computer Club breaks Apple TouchID

#233

Just to keep things in perspective, the goal of Touch ID is not to be unhackable. The goal is to get more consumers to move from zero security to pretty good security. A very large number of people don't put any kind of passcode of any kind on their phone, simply because it's inconvenient. Touch ID is designed for them. It's not designed to secure nuclear footballs. Touch ID is going to massively reduce the number of…

Here's Apple's main marketing text on the subject: > Put your finger on the Home button, and just like that your iPhone unlocks. It’s a convenient and highly secure way to access your phone. Your fingerprint can also approve purchases from iTunes Store, the App Store, and the iBooks Store, so you don’t have to enter your password. It is definitely intended to replace passwords. Pretty good security would be to requir…

> Pretty good security would be to require both the fingerprint and a PIN

You're missing the point. Right now lots of people have no password at all. Touch ID is a big improvement over having no password.

Re: Chaos Computer Club breaks Apple TouchID

#234
post #169

Just to keep things in perspective, the goal of Touch ID is not to be unhackable. The goal is to get more consumers to move from zero security to pretty good security. A very large number of people don't put any kind of passcode of any kind on their phone, simply because it's inconvenient. Touch ID is designed for them. It's not designed to secure nuclear footballs. Touch ID is going to massively reduce the number of…

Touch ID is not "pretty good security" it's not even "good security" it's simply very bad security. Touch ID is better than nothing and that people use Touch ID instead of nothing is better than the current state but not by much and this definitely isn't a huge achievement. Which is really the biggest issue with Touch ID, it's advertised as such and people believe it.

Touch ID is competing against pins chosen from a universe of 10,000. This isn't great security, but it's appropriate security for unlocking a device you already must have physical access to.

Re: Chaos Computer Club breaks Apple TouchID

#235
post #169

Just to keep things in perspective, the goal of Touch ID is not to be unhackable. The goal is to get more consumers to move from zero security to pretty good security. A very large number of people don't put any kind of passcode of any kind on their phone, simply because it's inconvenient. Touch ID is designed for them. It's not designed to secure nuclear footballs. Touch ID is going to massively reduce the number of…

Touch ID is not "pretty good security" it's not even "good security" it's simply very bad security. Touch ID is better than nothing and that people use Touch ID instead of nothing is better than the current state but not by much and this definitely isn't a huge achievement. Which is really the biggest issue with Touch ID, it's advertised as such and people believe it.

> Touch ID is better than nothing... but not by much

You can't be serious. A completely unlocked phone that anybody can trivially access with a swipe.. vs. a scanner that you'd have to lift and reconstruct someone's fingerprint to bypass. That is definitely a significant improvement.

Re: Chaos Computer Club breaks Apple TouchID

#236

Much more convienient than a passcode with a little less security. I'd still use it unless I was a CIA agent.

How is it less security though? You don't have to follow someone for very long with a high zoom camera before you can get their passcode and that is a lot easier than duplicating their fingerprint. And yeh it is much much more convenient.

The Touch ID is less secure because you can force a person to put their fingerprint to unlock their own phone. Forcing the passcode out of someone can prove more difficult and the phone will wipe itself after 10 tries (if you have that feature enabled).

I could steal your phone and manage to unlock in the process by taking your hand and unlocking the phone before walking away, somewhat more difficult to do with a passcode.

Re: Chaos Computer Club breaks Apple TouchID

#238

Just to keep things in perspective, the goal of Touch ID is not to be unhackable. The goal is to get more consumers to move from zero security to pretty good security. A very large number of people don't put any kind of passcode of any kind on their phone, simply because it's inconvenient. Touch ID is designed for them. It's not designed to secure nuclear footballs. Touch ID is going to massively reduce the number of…

This seems correct. Apple's moved the bar to breaking into those phones from having the phone and a 4 digit or no passcode to having:

-- the phone

-- a 2400 dpi resolution image of the correct fingerprint

-- a 1200 dpi laser printer & transparent paper

-- pink latex milk or white woodglue

-- a non-trivial amount of time

Re: Chaos Computer Club breaks Apple TouchID

#239

Earlier quoted context omitted.

Here's Apple's main marketing text on the subject: > Put your finger on the Home button, and just like that your iPhone unlocks. It’s a convenient and highly secure way to access your phone. Your fingerprint can also approve purchases from iTunes Store, the App Store, and the iBooks Store, so you don’t have to enter your password. It is definitely intended to replace passwords. Pretty good security would be to requir…

> Pretty good security would be to require both the fingerprint and a PIN You're missing the point. Right now lots of people have no password at all. Touch ID is a big improvement over having no password.

Well, no password on their phone unlocks. But I thought Apple intended to replace your passwords in application services as well. Now, I didn't read the article at all (not a single damn word), so maybe the hack only applies to phone unlocks. If that is not the case however, then I think _you_ are missing the point. This would compromise all passwords replaced by finger print scans, right?

Re: Chaos Computer Club breaks Apple TouchID

#240
Talk about missing the point.

I dislike entering a passcode every time I pick up my phone. Yet if someone steals my phone or I leave it somewhere I don't want someone to be able to access my photographs or my data.

Fingerprint sensor sounds like a pretty good solution to me.

Do I want Fort Knox security on my phone? No.

Could someone still access all my data even if it was secured with a passcode, certainly they could with physical access to the device and a couple of debugging tools they could lay it wide open.

So put simply, fingerprint is more convenient than having to type in a passcode. +1 for Apple

Good to know how easy it is to break though so no one gets carried away and starts using it for things worth breaking into.

Post reply on HN