LOL So much for Apple's touch ID "security"

[NoStateofMind]

http://www.phonearena.com/news/Euro...round-the-Touch-ID-on-Apple-iPhone-5s_id47653

Saying that the hardest part about hacking the Touch ID fingerprint sensor on the Apple iPhone 5s was finding an iPhone 5s to use, the Chaos Computer Club has found a way to circumvent the new fingerprint sensor on the latest full-featured iPhone. The process requires someone to take a picture of a person's fingerprints at 2400 DPI and then print it at 1200 DPI. The image is used to make a latex sheet that is used to trick the Touch ID sensor.

The bottom line is not to count on the Touch ID sensor to protect your more important information such as the number of your secret Swiss bank account. Granted, this is not a quick 1-2-3 process, but on the other hand there are not enough hurdles to prevent someone from doing it. The actual process dates back to 2004 showing you how elementary it is to fool the Touch ID sensor on the Apple iPhone 5s.

"We hope that this finally puts to rest the illusions people have about fingerprint biometrics. It is plain stupid to use something that you can´t change and that you leave everywhere every day as a security token. The public should no longer be fooled by the biometrics industry with false security claims. Biometrics is fundamentally a technology designed for oppression and control, not for securing everyday device access."-Frank Rieger, spokesperson, CCC

There goes that. So the big "upgrade" for iPhone 5s is....camera?

 

[Bman123]

Lmao right now, so much for that

 

[MrX8503]

I wouldn't exactly say that its cracked considering the amount of work it requires.

The upgrades are the A7, touch ID, and camera. I'd say that's good for an S version of the phone.

 

[thedosbox]

I wouldn't exactly say that its cracked considering the amount of work it requires.

Um, you're missing the point. Despite apple's hype, it can be circumvented using a similar technique first demonstrated five years ago.

One dose of Rohypnol later and any accounts you were relying on your fingerprint to secure are up for grabs. Though granted, you might have some more serious problems to worry about in that scenario

 

[MrX8503]

Um, you're missing the point. Despite apple's hype, it can be circumvented using a similar technique first demonstrated five years ago.

One dose of Rohypnol later and any accounts you were relying on your fingerprint to secure are up for grabs. Though granted, you might have some more serious problems to worry about in that scenario

I think you're missing the point that any security measure can be circumvented.

 

[RedRooster]

You still have to get the person's phone too, do you not?
Maybe some people are willy nilly, but I'll cut off your hand if you even touch my phone. That's my security.

 

[paperwastage]

I'm guessing that everyone's missing the point (or Apple isn't clearly defining the use case)

the touch ID is useful for those who don't want to mess around with lock screens (having to key in PIN = PITA), while pressing on the button to unlock is 100000% easier... with this, random strangers/friends can't get into your phone

that saying, it's not a replacement for true security that a password (or full device encryption) provides

remember, Apple is all about good experience / integration.... here, they've integrated a replacement for a lock screen that is very very very easy to use




it will help those users who currently DON'T have a lock screen because of the hassle of lock screens

 

[thedosbox]

I think you're missing the point that any security measure can be circumvented.

Of course it can. Hence it's ridiculous to use a fingerprint as a key.

 

[badb0y]

Did you actually read the article before posting it?

It would be easier to put a gun on someone's head and get the pin code then taking a picture of their fingerprint and printing it on latex. Lol.

 

[thedosbox]

Did you actually read the article before posting it?

It would be easier to put a gun on someone's head and get the pin code then taking a picture of their fingerprint and printing it on latex. Lol.

One roofie is all it would take. But as I pointed out earlier, you're likely going to have more serious problems in that case.

 

[podspi]

...what are we securing against? Is it secure enough for national security? Probably not. Is it secure enough that the average person won't have to worry about someone at a party picking up their phone and accessing it? Yes.

 

[Ravynmagi]

So you need access to the finger and the phone. And the solution is to scan the fingerprint, print it out on a latex surface, and use that fake fingerprint to unlock the phone?

I'm not a genius, but I think I could cut out a few of those middle steps in that process.

 

[MrX8503]

Of course it can. Hence it's ridiculous to use a fingerprint as a key.

Why is it ridiculous to use a fingerprint? It's convenient for the user and I expect competitors to follow suit.

 

[Stuka87]

I do not see this as an issue. If the bad guy has access to the finger and the phone, he simply pushes the finger against the phone. Bam, you are in. NOBODY is going to try and photograph the finger print, print it out, go through the 5 stage process to get it to be realistic enough for the scanner to read, and then use it.

The scanner is plenty secure enough to keep a Frenemy™ or family member from looking through your phone while you are in the other room. Or even if you lose the phone, and you have not yet had a chance to mark it as stolen for the Find My iPhone functionality (Which will wipe it and prevent it from being used ever again).

 

[lopri]

Well, didn't we see this countless times in TV/movies? (e.g. Mission Impossible) It's not some high-tech security stuff, let alone being bullet-proof.

But let's get real. Majority of the people around me don't even protect their lock screens. For those folks, finger print identification is a quantum leap when it comes to personal security. My bigger concern would be users' finger print data going into Apple's servers, regardless of whatever Apple says about it.

 

[mikegg]

Why is this news? You can obviously fool a finger print software if you do this. But this is like saying all passwords are not secured anymore because you can keylog someone or you trick someone into saying the password.

Why go through the trouble of taking a picture if you have the person right there? Why not just force his finger onto the phone? Or better yet, chop off the finger.

 

[mikegg]

This is even dumber the second time reading it.

If someone happens to take a clear picture of your finger prints using a 2400 DPI camera and steals your phone, this would be a disaster. Luckily, no thief is this dumb and you can simply delete all your data remotely if someone stole your phone or if someone took a picture of your finger using a 2400 DPI camera.

 

[Joe1987]

What's to stop someone from tying you up and using your finger to reset the scanner.

Bottom line is that locks and security measures keep honest people honest.

 

[tvdang7]

As much as I think this is funny ,android did have the whole face unlock thing where people would just use another person's picture and unlock it.......

 

[mikegg]

What's to stop someone from tying you up and using your finger to reset the scanner.

Bottom line is that locks and security measures keep honest people honest.

What's stopping someone from torturing you until you tell them your password?

 

[thedosbox]

Why is it ridiculous to use a fingerprint? It's convenient for the user and I expect competitors to follow suit.

Seriously? You don't see a problem using something that you cannot change as a key once it's stolen?

Better hope you don't get on the wrong side of anyone in your house....

This is even dumber the second time reading it.

If someone happens to take a clear picture of your finger prints using a 2400 DPI camera and steals your phone, this would be a disaster. Luckily, no thief is this dumb and you can simply delete all your data remotely if someone stole your phone or if someone took a picture of your finger using a 2400 DPI camera.

Hint - they don't even need to do that. People sell these things for a reason.

 

[zerocool84]

As much as I think this is funny ,android did have the whole face unlock thing where people would just use another person's picture and unlock it.......

While I think that the fingerprint ID thing will keep 99% of people out of your phone, that was never touted as being super secure.

 

[Zaap]

Seriously? Someone actually qualifies that as an actual security breach?

So I guess iPhone 5S owners should be weary of strangers who want to "borrow" their iPhone while taking 2400 dpi scans of their fingerprints. *eyeroll*

This is like reporting that my car's security is compromised because all someone has to do is steal my key, make an exact duplicate of it... no wait, in fact, that's actually far more likely to happen in reality.

 

[silverpig]

You guys are completely missing the point.

With other phones, I need your phone and your PIN to gain access. With the 5s, I just need your phone.

Why?

Well because your phone has your fingerprints all over it of course. Apple has basically just invented a system whereby you leave your PIN written on a sticky on the back of your phone. A PIN you can't change.

 

[silverpig]

Seriously? Someone actually qualifies that as an actual security breach?

So I guess iPhone 5S owners should be weary of strangers who want to "borrow" their iPhone while taking 2400 dpi scans of their fingerprints. *eyeroll*

This is like reporting that my car's security is compromised because all someone has to do is steal my key, make an exact duplicate of it... no wait, in fact, that's actually far more likely to happen in reality.

To make your analogy more accurate: you always leave your key in the wheel well. And on the windshield...