Apple Opens Up Touch ID To All Apps

http://techcrunch.com/2014/06/02/apple-touch-id/

by panabee • 12 years ago

61 20 12 years ago

koblas• 12 years ago

This is going to be a big game changer for 2 factor authentication. No longer will you have to deal with a series of numbers, but should be able to just auth with your phone.

cr3ative• 12 years ago

To ask a silly question - how? 2FA apps like Authy don't communicate with the service they provide for. An app per 2FA application would be extremely clunky.

vmiroshnikov• 12 years ago

It won't. Even your grandmother can fool a fingerprint scanner. https://www.youtube.com/watch?v=geTgSzrKYdc

Holbein7• 12 years ago

I'm still creeped out by Touch ID (not this opening up, just Touch ID in general): The recent Snowden files revealed that the NSA actively searches for and indexes pictures of faces and fingerprints.

I doubt this is 100% secure (since all the code, including the TouchID code can be updated in iOS updates, you can add a leak function to a future iOS update).

When that happens, an attacker can nicely cross-reference your fingerprint with all the other data.

Anybody else feel that way?

aeontech• 12 years ago

Just like you don't store a plaintext password, neither does TouchID store your fingerprint as anything recognizable - it's stored as a hashed and salted representation of your fingerprint. I'd venture to guess that it's device specific too, I doubt that your fingerprint hash stored on one phone is identical to the same fingerprint hash stored on a different phone.

Check out the whitepaper here: http://images.apple.com/iphone/business/docs/iOS_Security_Fe... if you're curious about details.

tomschlick• 12 years ago

Yeah at that point the only attack you could do would be to put a trigger in the middle before its hashed and compared with the stored value.

Holbein7• 12 years ago

I think there is reason to doubt that TouchID stores your fingerprint as a hash. Let me elaborate:

Even after the initial priming phase, TouchID continues to learn and adapt to your fingerprints. So during priming, you could always place your finger flat on the sensor, and then after that, during usage, you can continuously use different parts of your finger, and if at least a part of your finger overlaps with a previous image of your finger, TouchID unlocks the device and - crucially - it continues to learn those new angles of your finger.

This indicates that TouchID internally aggregates an image of your fingerprint during actual usage. Now to merge those images together, you have to compare previous images with the new image, to find a common section. And you can't do that if you have only got a hash of the previous image.

I think therefore just by looking at its operation from outside, we can infer TouchID stores a fingerprint in a way that it can reproduce the fingerprint itself.

phantom784• 12 years ago

I'd be more worried about the camera, microphone, and GPS that every iPhone has.

atonse2• 12 years ago

You might want to listen to this podcast episode: https://www.grc.com/sn/sn-446-notes.pdf

The security behind TouchID and the secure enclave in the A7 chip is pretty damn mind boggling and unprecedented. The pains Apple has gone through to secure your fingerprint and things like that, is just amazing for a consumer product.

Holbein7• 12 years ago

Thanks for the link!

Apple sent out at least 1 update to TouchID as part of a regular iOS update. In my view, from a few miles up, the fact that you can update TouchID doesn't install a lot of confidence in this tech. Apple can change its workings, and it can also interface with TouchID from outside in order to update it.

Would you care to elaborate why you're still sure that Apple (or the NSA) couldn't change TouchID to send my fingerprints to an outside server?

33W• 12 years ago

I'll be interested to see how this is used. I've never liked biometrics as a password, as once it is compromised, it cannot be changed. They are much more useful as a username, in my opinion. Does anyone here have any specific uses in mind?

omgitstom• 12 years ago

I'm not super excited about Touch ID, would have been more excited about opening Siri or Apple TV for devs

Apple Opens Up Touch ID To All Apps

Related Stories