"Chaos Computer Club: iPhone 5S finger-sniffer COMPROMISED"

[TM99]

28. Your fingerprint. Your phone.

You check your iPhone dozens and dozens of times a day, probably more. Entering a passcode each time just slows you down. But you do it because making sure no one else has access to your iPhone is important. With iPhone 5s, getting into your phone is faster, easier, and even a little futuristic. Introducing Touch ID — a new fingerprint identity sensor.

Put your finger on the Home button, and just like that your iPhone unlocks. It’s a convenient and highly secure way to access your phone. Your fingerprint can also approve purchases from iTunes Store, the App Store, and the iBooks Store, so you don’t have to enter your password. And Touch ID is capable of 360-degree readability. Which means no matter what its orientation — portrait, landscape, or anything in between — your iPhone reads your fingerprint and knows who you are. And because Touch ID lets you enroll multiple fingerprints, it knows the people you trust, too.

This is a big deal because Apple has made it a big deal.

Has biometrics been used before? Yup, for over a decade now. Is it fairly secure. Yup, it is, but serious hackers will find ways like this to crack the security. Has biometrics been a part of heavily marketed consumer products?

This is where this now comes in as real and important. No. Thinkpad business models had options for biometrics. But Apple is pushing this through their marketing as not only a 'new' convenience but also as being 'secure'. So if that 'security' is cracked within days of release, that is a huge marketing failure even if it isn't a huge security failure.

But as a techie, the key for me is that Touch ID allows the enrollment of multiple fingerprints. That is a nice further little vector for hacking.

I agree with the OP in that given the choice, I would prefer a well-managed password system over a biometric scanner. Yes, a housewife's iTunes account may not be worth hacking, but now that iDevices are being used in business & government, those people's secure data are indeed worth hacking.