Welcome to DU! The truly grassroots left-of-center political community where regular people, not algorithms, drive the discussions and set the standards. Join the community: Create a free account Support DU (and get rid of ads!): Become a Star Member Latest Breaking News Editorials & Other Articles General Discussion The DU Lounge All Forums Issue Forums Culture Forums Alliance Forums Region Forums Support Forums Help & Search

frazzled

(18,402 posts)
12. Riiiiiiiiight ... but how's anyone gonna get my fingerprint?
Mon Sep 23, 2013, 12:24 PM
Sep 2013

You still have to get me to put my finger on the printer (and rots 'o ruck with that). You can't steal it from my phone ... because the fingerprint is not stored as an image on the phone.

First of all, there's a dedicated "enclave" in the iPhone 5s processor that's used solely for the purpose of storing encrypted data related to Touch ID. Its only connection to the rest of the iPhone's hardware is a function to say, "Touch ID check OK/Fail." The notion that someone could grab this data via a Bluetooth connection is ludicrous Hollywood "hacking" BS.

Second, the iPhone doesn't actually store fingerprint data in the first place. The iPhone 5s maps your fingerprint and converts that into a string of data (a one-way hash), then holds onto that chunk of data. The next time you put your paws on the phone, the same hashing process produces another data chunk; the two chunks -- not the two fingerprint images -- are matched up to allow access. In fact, assuming the hashing process works the same way as it does for existing iPhone passcodes, the fingerprint data is encoded in a way that's specific to that individual phone (salted). Copying it anywhere else would be useless. [Have we been hearing about hacker gangs remotely stealing iPhone passcodes via magical processes to use them elsewhere? No, we have not -- and if we had, it would almost certainly be via social engineering or visual spying as the phone is unlocked, both of which are impossible with Touch ID. –Ed.]

Anyone who somehow managed to access the iPhone's Touch ID circuitry and extract the hashed data would just find a string of alphanumeric gibberish, not a 3D-printable set of whorls and ridges ready to be turned into a latex Mission:Impossible-style fake finger. My TUAW colleague Dr. Richard Gaywood, who knows a thing or two about this stuff, says turning that data back into a readable fingerprint "would be like taking a cake, eating half of it, smashing the rest up with a fork, then giving it to someone and asking them, 'How much did the whole cake weigh, and what message was written on the icing that was on top of it?' "

http://www.tuaw.com/2013/09/22/iphone-5s-fingerprint-sensor-gets-completely-misunderstood/

Recommendations

0 members have recommended this reply (displayed in chronological order):

Um, so to compromise it, you somehow have to get a hi-res image of someone's fingerprint frazzled Sep 2013 #1
Wouldn't be hard to clean it up and interpolate to 2400 if you wanted to. sir pball Sep 2013 #4
Coming soon to a high resolution 3D Printer seveneyes Sep 2013 #7
Riiiiiiiiight ... but how's anyone gonna get my fingerprint? frazzled Sep 2013 #12
Easy Gore1FL Sep 2013 #15
Try reading. frazzled Sep 2013 #18
try reading what? Gore1FL Sep 2013 #22
They would only need a picture of your fingerprint seveneyes Sep 2013 #23
The iPhone stores plenty of fingerprint data. obxhead Sep 2013 #30
Pretty much. apnu Sep 2013 #13
You only have to lift their print from somewhere else. Also super easy to do. TalkingDog Sep 2013 #16
Except social engineering and coercion. AtheistCrusader Sep 2013 #2
Most don't even lock their phones Major Nikon Sep 2013 #6
Rubber-hose cryptanalysis.. sir pball Sep 2013 #8
OK, assuming you have access to a persons finger, or fingerprints, and apparently a 3D printer. denverbill Sep 2013 #3
Nope. AtheistCrusader Sep 2013 #9
How many people etch circuit boards? denverbill Sep 2013 #14
Etching a circuit is a lot easier than you think. Don't sell yourself short. AtheistCrusader Sep 2013 #17
Yeppers. n/t TalkingDog Sep 2013 #19
You make it sound like a 3D printer is still exotic uber-tech sir pball Sep 2013 #24
Didn't mean to imply that. denverbill Sep 2013 #26
Isn't it interesting... onyourleft Sep 2013 #5
'How to hack' is the first step in establishing whether the feature meets the sales hype or not. AtheistCrusader Sep 2013 #10
Ahhh... to live without all that pesky wonder. TalkingDog Sep 2013 #20
geepers... given that a lost iPhone will be covered with owner's fingerprints tomm2thumbs Sep 2013 #11
with so many of the owner's fingerprints that you might have a heard time getting a clean one. olddad56 Sep 2013 #21
Probably piece one together, and I doubt it actually has to be perfect at 1200dpi sir pball Sep 2013 #25
If I am right handed IBEWVET Sep 2013 #27
Your fingerprint. Your phone. TM99 Sep 2013 #28
Message auto-removed Name removed Sep 2013 #29
Latest Discussions»Latest Breaking News»"Chaos Computer Club...»Reply #12