Welcome to DU!
The truly grassroots left-of-center political community where regular people, not algorithms, drive the discussions and set the standards.
Join the community:
Create a free account
Support DU (and get rid of ads!):
Become a Star Member
Latest Breaking News
Editorials & Other Articles
General Discussion
The DU Lounge
All Forums
Issue Forums
Culture Forums
Alliance Forums
Region Forums
Support Forums
Help & Search
Latest Breaking News
In reply to the discussion: "Chaos Computer Club: iPhone 5S finger-sniffer COMPROMISED" [View all]frazzled
(18,402 posts)12. Riiiiiiiiight ... but how's anyone gonna get my fingerprint?
You still have to get me to put my finger on the printer (and rots 'o ruck with that). You can't steal it from my phone ... because the fingerprint is not stored as an image on the phone.
First of all, there's a dedicated "enclave" in the iPhone 5s processor that's used solely for the purpose of storing encrypted data related to Touch ID. Its only connection to the rest of the iPhone's hardware is a function to say, "Touch ID check OK/Fail." The notion that someone could grab this data via a Bluetooth connection is ludicrous Hollywood "hacking" BS.
Second, the iPhone doesn't actually store fingerprint data in the first place. The iPhone 5s maps your fingerprint and converts that into a string of data (a one-way hash), then holds onto that chunk of data. The next time you put your paws on the phone, the same hashing process produces another data chunk; the two chunks -- not the two fingerprint images -- are matched up to allow access. In fact, assuming the hashing process works the same way as it does for existing iPhone passcodes, the fingerprint data is encoded in a way that's specific to that individual phone (salted). Copying it anywhere else would be useless. [Have we been hearing about hacker gangs remotely stealing iPhone passcodes via magical processes to use them elsewhere? No, we have not -- and if we had, it would almost certainly be via social engineering or visual spying as the phone is unlocked, both of which are impossible with Touch ID. Ed.]
Anyone who somehow managed to access the iPhone's Touch ID circuitry and extract the hashed data would just find a string of alphanumeric gibberish, not a 3D-printable set of whorls and ridges ready to be turned into a latex Mission:Impossible-style fake finger. My TUAW colleague Dr. Richard Gaywood, who knows a thing or two about this stuff, says turning that data back into a readable fingerprint "would be like taking a cake, eating half of it, smashing the rest up with a fork, then giving it to someone and asking them, 'How much did the whole cake weigh, and what message was written on the icing that was on top of it?' "
http://www.tuaw.com/2013/09/22/iphone-5s-fingerprint-sensor-gets-completely-misunderstood/
Second, the iPhone doesn't actually store fingerprint data in the first place. The iPhone 5s maps your fingerprint and converts that into a string of data (a one-way hash), then holds onto that chunk of data. The next time you put your paws on the phone, the same hashing process produces another data chunk; the two chunks -- not the two fingerprint images -- are matched up to allow access. In fact, assuming the hashing process works the same way as it does for existing iPhone passcodes, the fingerprint data is encoded in a way that's specific to that individual phone (salted). Copying it anywhere else would be useless. [Have we been hearing about hacker gangs remotely stealing iPhone passcodes via magical processes to use them elsewhere? No, we have not -- and if we had, it would almost certainly be via social engineering or visual spying as the phone is unlocked, both of which are impossible with Touch ID. Ed.]
Anyone who somehow managed to access the iPhone's Touch ID circuitry and extract the hashed data would just find a string of alphanumeric gibberish, not a 3D-printable set of whorls and ridges ready to be turned into a latex Mission:Impossible-style fake finger. My TUAW colleague Dr. Richard Gaywood, who knows a thing or two about this stuff, says turning that data back into a readable fingerprint "would be like taking a cake, eating half of it, smashing the rest up with a fork, then giving it to someone and asking them, 'How much did the whole cake weigh, and what message was written on the icing that was on top of it?' "
http://www.tuaw.com/2013/09/22/iphone-5s-fingerprint-sensor-gets-completely-misunderstood/
Edit history
Please sign in to view edit histories.
Recommendations
0 members have recommended this reply (displayed in chronological order):
30 replies
= new reply since forum marked as read
Highlight:
NoneDon't highlight anything
5 newestHighlight 5 most recent replies
RecommendedHighlight replies with 5 or more recommendations
Um, so to compromise it, you somehow have to get a hi-res image of someone's fingerprint
frazzled
Sep 2013
#1
You only have to lift their print from somewhere else. Also super easy to do.
TalkingDog
Sep 2013
#16
OK, assuming you have access to a persons finger, or fingerprints, and apparently a 3D printer.
denverbill
Sep 2013
#3
Etching a circuit is a lot easier than you think. Don't sell yourself short.
AtheistCrusader
Sep 2013
#17
'How to hack' is the first step in establishing whether the feature meets the sales hype or not.
AtheistCrusader
Sep 2013
#10
geepers... given that a lost iPhone will be covered with owner's fingerprints
tomm2thumbs
Sep 2013
#11
with so many of the owner's fingerprints that you might have a heard time getting a clean one.
olddad56
Sep 2013
#21
Probably piece one together, and I doubt it actually has to be perfect at 1200dpi
sir pball
Sep 2013
#25