451–458 of 458 posts
Presumably solvable by using a digit that isn't normally in contact with your phone - eg the pinky of your non-dominant hand?
Wonder if using your nose would work... A toe surely would but accessing that piece of hardware is an ugly hack in too many ways.
Earlier quoted context omitted.
Having a lock in your front door is not perfect but it is much better than not having one at all. The way that Apple haters use stunts like this to suspend normal logic and reasoning in order to express their juvenile spite is staggering. No one, ever, claimed TouchID was impregnable, but it is very good security and is better than what the vast majority of people do at present. Anyone prepared to devote the time and…
> Anyone prepared to devote the time and resources that CCC did to breaking your phone has other simpler means at their disposal Really? Lift someone's print, leave it with superglue, scan and print it and then dump glue on the scan. That seems to be the sum total of what needs to be done. You need only sticky tape to lift the print and the rest can be done in an hour. It sounds quite action movie, but in reality it'…
Also, it's not remotely "pretty damn simple":
https://blog.lookout.com/blog/2013/09/23/why-i-hacked-apples...
"Creating the fake fingerprint is arguably the hardest part and by no means “easy.” It is a lengthy process that takes several hours and uses over a thousand dollars worth of equipment..."
Earlier quoted context omitted.
And the social aspect? Is it common for you to obtain the image of the correct finger and then the phone from a stranger? How do you approach that part of the problem?
It's not common for me to do that, but it's also not common for me to try breaking into iPhones. But if I were trying to break into an iPhone, perhaps the finger prints are on the phone. Or some other item I also got as part of the same theft. Or I found the phone in the owner's house when I robbed it and have my pick of surfaces. Or I have the owner's prints in a database because they went were convicted of a crime(…
You do have a very valid argument.
Earlier quoted context omitted.
Can we agree that Apple should not be marketing this as a "highly secure way to access your phone"?
Did you read the article? To crack the sensor, the would-be malevolent party needs a _2400 DPI photo of the fingerprint._ TouchID is highly secure if the only way to break into it is to have an ultra high-def image of the exact finger the device is looking for. I guess 50 character-long passcodes aren't secure because you could just tell a thief the code?
It needs a 2400 dpi output. This is not hard. 300 ppi source can easily generate a 2400 dpi output. DPI =/= PPI.
Earlier quoted context omitted.
Since they'd reverse the charges anyway... You're baselessly asserting your position, though. If you write your pin on your ATM card, they will not refund you. That is policy and they ask everytime you lose your card. The bank views this as lack of due care. Likewise, if you leave copies of your fingerprints on your payment device, they could argue that you are likewise acting with un-reasonable care. Now that this h…
The bank has never asked me if I had my PIN written on my card when I've lost it... all they ask is lost or stolen.
3. I will hold in strict confidence my personal identification number (PIN). I will take reasonable precautions to keep my PIN separate from my ATM card and to prevent the unauthorized disclosure of my PIN.
So, you sign an affadavit verifying you did not contravence this agreement. They will screen for this as/if you file a claim for fraud.
What is the resolution of the fingerprint image stored in biometric passport, i.e., the kind of passport you need to enter the US? Biometric passports store an actual fingerprint image and not just a hash like the iPhone 5S. So if the resolution was high enough, everyone with access to a biometric passport – for example by scanning people carrying such passports around at an airport – could forge fingerprints …
Biometric passports don't necessarily include fingerprint data. For example, current US passports are considered biometric but do not include fingerprint data since fingerprinting is not required to obtain a US passport.
Earlier quoted context omitted.
I didn't say "simple." I said "trivial" :) Nope, I've never done this live. For this I'm reliant upon what I've read. Feel free to tell me what's wrong. Stating how it works, or pointing the way to an accurate source, is infinitely more helpful than saying "you're wrong", even if it might feel satisfying. Here's my understanding of how the initial loading works. BootROM uses a series of RSA validity checks on the cha…
I just told you. You need a bootrom exploit. That's the non-trivial part. Nobody has one, and they haven't since 2010. I mean, the NSA might, but the forensics companies don't, and there aren't any public ones. Hence, it's far from trivial. Even with the multi-thousand dollar forensics kits, you cannot even begin a brute force PIN attack on any bootrom for any iphone or ipad still on sale. The last devices it worked…
Pretending to have knowledge when you don't understand the fundamentals of the problem is both a good way to make yourself look foolish, and is certainly the cardinal sin in engineering. For that, I apologize.
For context, the reason I've been insistent is that there is a particular company that claims to be able to pull data from iPhone 5 and below in spite of the encryption. Whether this is true or not, I don't know, but I've heard it from a person I trust in mobile security.
If you keep up with the jailbreak hacking community (which I'm just now getting into), the Grugq (a fairly reputable source) posted on MuscleNerd's twitter that he's heard a private company has a new 0-day bootrom exploit, which would fit with the information I've heard.
Regardless, I should have just shut the f*ck up and let you teach me some science, instead of letting my competitive instincts lead me down a rabbit hole. I'll work on that.