Chaos Computer Club breaks Apple TouchID

More context, for those of us not up-to-date on German politics?

>The statistically likelihood of matches between distinct parties is in some cases well under the population of the world.

In addition to that, there are problems with bias and statistical independence. A given marker is unlikely to be present in exactly 50% of the population, and to the extent that it isn't it can reduce the probability by that amount that a test match is a true match. Meanwhile the suspect pool for a given crime is likely to encompass several (perhaps many) members of the same extended family, who for the obvious reason are significantly more likely than random members of the world population to have the tested markers match one another. Even within a city you will generally see concentrations of specific ethnicities who may have a higher statistical incidence of specific genetic markers than other populations, which can screw up the numbers by an amount that historically hasn't even knowable because we don't have good numbers on the statistical incidence of specific markers within geographical populations.

The place where this is most pernicious is when they get a sample from a crime scene and run it against some "DNA database" to find a hit. Then everybody is talking about the probability that X suspect would match the DNA at the crime scene rather than the probability that someone in the database would match even if the actual perpetrator wasn't in the database.

I don't think I've seen anyone parry an appeal to authority with an ad hominem lately. Good one.

If you slightly smear your finger every time you remove it from the sensor you shouldn't have this problem. Additionally, if you are keeping your phone in your pocket, as I do, pull it out and take a look (like I just did) and you'll be hard pressed to see much of anything resembling a useful print. I use my phone pretty much all day long and it is devoid of useful prints.

Does that mean you couldn't find my prints in other places? Sure. But I can probably find your keys in other places, too.

We know that SSL is generally not implemented properly, that the CAs are probably all hacked or subverted by the NSA, that the NSA may have developed backdoors to a number of the more popular encryption suites, but I don't hear anyone running around demanding Google or Facebook disable SSL.

If you are doing something that requires sufficient security that you don't want someone to access it via your fingerprint alone, add additional layers of security.

If you are doing something potentially incriminating ... don't do it on your freaking phone because it's probably been exploited in a dozen other ways by various authorities who can use it to find out most of what they need without being in physical possession of the phone anyway.

Most people aren't worried about the mafia or the CIA or the NSA. Most people don't even bother using a passcode, let alone a passphrase on their phones. If you can add something as easy to use as this, then it adds an additional layer of security against the casual abuse most people will find themselves subjected to (random people making calls from your phone, spouses spying on their email, etc.).

If you are worried about the CIA and the NSA, using a phone at all for anything is probably not in your best interest at this point.

So the big question is, how hard is it to get at 2400 DPI finger print?

They don't show if they can scan the finger print off the phone. I would imagine that it could be quite tricky to get that level of resolution.

I would like to see a complete hack purely based on a finger print on the phone.