CCC Says Apple iPhone 5S TouchID Broken

← Back to Stories (view on slashdot.org)

CCC Says Apple iPhone 5S TouchID Broken

Posted by timothy on Sunday September 22, 2013 @06:58AM from the well-if-that's-all dept.

hypnosec writes with word that the Chaos Computer Club claims to have "managed to break Apple's TouchID using everyday material and methods available on the web. Explaining their method on their website, the CCC hackers have claimed that all they did was photograph a fingerprint from a glass surface, ramped up the resolution of the photographed fingerprint, inverted and printed it using thick toner settings, smeared pink latex milk or white woodglue onto the pattern, lifted the latex sheet, moistened it a little and then placed it on the iPhone 5S's fingerprint sensor to unlock the phone." Update: 09/22 21:32 GMT by T :Reader mask.of.sanity adds a link to a video of the hack.

296 of 481 comments (clear)

Easy! by amiga3D · 2013-09-22 07:01 · Score: 4, Funny

sounds really trivial to break. I can see all kinds of kids doing this.
1. Re:Easy! by fuzzyfuzzyfungus · 2013-09-22 07:07 · Score: 4, Insightful
  
  It's a bit much for casual purposes; but it effectively demonstrates that Apple's little toy is just another fingerprint sensor (albeit a more attractive one than the usual little stripe-thing) with no more resistance to an under-a-hundred-bucks, probably a few bucks per print, in quantity, attacks than any of the others.
  
  Still beats no passcode at all against a casual attacker; but it sounds like the CCC technique works just fine with digital reproductions (ie, you don't need the original thumbprint to use as a mold, or develop with cyanoacrylate vapor, or anything like that) so it's fuck up once, have your fingerprint on file for however long it stays roughly the same, which is never terribly encouraging.
2. Re:Easy! by noh8rz10 · 2013-09-22 07:14 · Score: 5, Funny
  
  Remember that a hacker won't know which of 5 fingers the owner uses, so that's another layer of security
3. Re:Easy! by Dins · 2013-09-22 07:19 · Score: 5, Insightful
  
  I was with you until you said "sheeple".
4. Re:Easy! by Sique · 2013-09-22 07:21 · Score: 1
  
  So we have (as we can use 10 fingers) the gigantic key length of slightly more than 3 bits.
  
  --
  .sig: Sique *sigh*
5. Re:Easy! by noh8rz10 · 2013-09-22 07:23 · Score: 1
  
  We'll that means they can gather it even if you don't use it, because it's built into the home button. If you feel strongly about it, better stick to iPhone 5 and earlier!
  In CA it doesn't matter because they take everybody's fingerprint when you get a drivers license. So the NSA already has it.
6. Re:Easy! by ShanghaiBill · 2013-09-22 07:24 · Score: 4, Insightful
  
  Remember that a hacker won't know which of 5 fingers the owner uses, so that's another layer of security
  Actually, many people have up to ten fingers. Personally, I use my big toe.
  But this shows that Apple was less than honest in their claims about pulse detection, and sub-surface tissue detection.
7. Re:Easy! by Zero__Kelvin · 2013-09-22 07:24 · Score: 1
  
  Yes. It isn't like Microsoft developed the phone, in which case it would be a relative certainty which one the owner used.
  
  --
  Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
8. Re:Easy! by lgw · 2013-09-22 07:28 · Score: 1
  
  Just like the "unlock gesture" in the new Windows stuff, this is a replacement for a 4 digit PIN, not for a real password. This break seems harder and more time consuming than brute forcing a 4 digit PIN, so it's fine.
  Anyone who actually cares will have forensic tools that will just immediately present the data anyhow - for any consumer device, physical access is access to the data, eventually.
  
  --
  Socialism: a lie told by totalitarians and believed by fools.
9. Re:Easy! by Anonymous Coward · 2013-09-22 07:30 · Score: 1
  
  As a male, I better don't use what was thinking to use then.
10. Re:Easy! by sribe · 2013-09-22 07:33 · Score: 1
  
  ...have your fingerprint on file for however long it stays roughly the same...
  Yes, but to be clear: setting up TouchID on an iPhone does not result in your fingerprint being on file, as it, like ALL fingerprint-matching software as far as I know, stores what is essentially a hash derived from landmark features of your prints, not your actual prints. So the on-file data would have to come from somewhere else in order to use this method.
  So, it's not super-secure, but at least you can't unlock it by breathing on it ;-)
11. Re:Easy! by dinfinity · 2013-09-22 07:34 · Score: 4, Insightful
  
  Still beats no passcode at all against a casual attacker
  Also beats pattern or password unlocks, which can be 'beaten' by just a bit of careful spying.
  To me, the only things that are of real concern with this technology are false negatives and durability (I'm pretty sure putting the scanner on the home button is going to end up being a bad idea).
12. Re:Easy! by K.+S.+Kyosuke · 2013-09-22 07:36 · Score: 2
  
  Obligatory...
  
  --
  Ezekiel 23:20
13. Re:Easy! by Intrepid+imaginaut · 2013-09-22 07:40 · Score: 2
  
  Indeed, what happened to all the posters insisting it read the blood vessels under the skin instead?
  I'll tell you what though, the security of my phone wouldn't be a concern if I was a new iphone owner, it's where my fingerprints might end up that would worry me. And to think that concern might have been tinfoil hattery only a short while ago.
14. Re:Easy! by Jane+Q.+Public · 2013-09-22 07:41 · Score: 4, Insightful
  
  "sounds really trivial to break. I can see all kinds of kids doing this."
  It's straight out of the Mythbusters fingerprint scanning episode.
  
  They didn't find one they couldn't defeat, and many of them were ridiculously easy. They used exactly this technique.
  
  I've been saying it for years: at our currently level of technology, relying on fingerprints for security (or nearly any biometric for that matter) is asking for trouble. It's just not good enough.
15. Re:Easy! by Jeremy+Erwin · 2013-09-22 07:46 · Score: 5, Insightful
  
  The cops will have copies of all 10 fingers, and will be able to add this technique to their fourth and fifth amendment circumvention strategies.
16. Re:Easy! by Desler · 2013-09-22 07:46 · Score: 1
  
  They can get your fingerprint without needing to go through this route.
17. Re:Easy! by Anonymous Coward · 2013-09-22 07:55 · Score: 3, Insightful
  
  This is far short of the lengths a crazy ex girlfriend or suspicious spouse would go to.
18. Re:Easy! by iluvcapra · 2013-09-22 07:56 · Score: 1
  
  "Nobody trusts an official story and everyone believes anonymous sources."
  I'd interpret this as being a statement about the tendency of politicos ("everyone") to uncritically repeat salacious gossip, and to intentionally discount "official" statements, not because they're false or irrelevant, but because they're boring and lack the whiff of exclusive, "insider" provenance.
  This saying is an example of artful equivocation, in the sense that it is either critical of "an official story," or critical of "everyone" for believing it, and the listener is free to accept either.
  
  --
  Don't blame me, I voted for Baltar.
19. Re:Easy! by Anonymous Coward · 2013-09-22 07:57 · Score: 2, Insightful
  
  It's a capacitative scanner. It's not a photo scanner.
  
  From the abstract: 'latex sheet, moistened it a little'. I see no reason why that wouldn't work on this capacitative scanner.
20. Re:Easy! by Nerdfest · 2013-09-22 07:58 · Score: 4, Insightful
  
  Based on their respective histories, a sensible person would probably trust CCC over Apple.
21. Re:Easy! by maccodemonkey · 2013-09-22 08:00 · Score: 4, Interesting
  
  It's a bit much for casual purposes; but it effectively demonstrates that Apple's little toy is just another fingerprint sensor (albeit a more attractive one than the usual little stripe-thing) with no more resistance to an under-a-hundred-bucks, probably a few bucks per print, in quantity, attacks than any of the others.
  Still beats no passcode at all against a casual attacker; but it sounds like the CCC technique works just fine with digital reproductions (ie, you don't need the original thumbprint to use as a mold, or develop with cyanoacrylate vapor, or anything like that) so it's fuck up once, have your fingerprint on file for however long it stays roughly the same, which is never terribly encouraging.
  I think every Slashdotter's wet dream is that they need to keep to keep their phones safe against a CSI style government interrogation, but this is really just for anti-theft or corporate secrets. The passcode expires in 48 hours anyway, and a business has remote wipe, so it's just a backup in another chain of security measures. And the fingerprint ready is really meant as a convenience for people who are too lazy to set a passcode at all, which is undeniably less safe.
  You know what a government is going to do if they have you and your phone? Take your finger, and press it to your phone, which legally they can compel (or physically force) you to do. All this talk about "Oh, what if the government has your fingerprint on file?" Please. That's overthinking it.
22. Re:Easy! by __aaltlg1547 · 2013-09-22 08:05 · Score: 1
  
  Right index, left index, right thumb and left thumb will suffice for 99.9% of the population.
  Side note: you may have to resort to these techniques if you have a band-aid on your chosen finger, or if you cut it and it heals with a more permanent mar on your pattern.
23. Re:Easy! by davester666 · 2013-09-22 08:08 · Score: 1
  
  you mean, besides just holding your hand against the sensor? As, if they have your phone, they probably also have you...
  
  --
  Sleep your way to a whiter smile...date a dentist!
24. Re:Easy! by __aaltlg1547 · 2013-09-22 08:08 · Score: 1
  
  This is independent of the 4th amendment. If they had a court order and you had an unhackable phone, they could be legally able to throw you in the slammer for obstruction but unable to get into your phone. Conversely, they could hack your phone with or without the cooperation of Apple and/or your WSP and be breaking the law when they do it.
25. Re:Easy! by Jeremiah+Cornelius · 2013-09-22 08:09 · Score: 5, Insightful
  
  sounds really trivial to break. I can see all kinds of kids doing this.
  Known vector. Gummy-bear attack.
  The core issue is that you leave copies of your authenticator EVERYWHERE. It's as if you dropped 85% accurate copies of your smartcard on every item you touched - with random 15% damage to the material - and a card reader designed for 15% error in reads.
  Any such scheme is going to be subject to this kind of impersonation or gaming. This is why biometrics are always a bad ID choice. Also, the A/D conversion is low-entropy, among other problems.
  There's a false assumption, that because I can uniquely identify another person with 99.999% accuracy, based on your sound, shape and appearance, that therefore this is the best way a machine should do so. It is a falsehood that is reinforced by a misleading intuitive perception. The core issue concerns the questions related to what constitutes "identity" and an "authentication factor" in systems. Neither of these correlate to actual persons or their real-world characteristics in a unique and meaningful way, that is not also subject to spoofing, injecting or revocation DoS.
  
  --
  "Flyin' in just a sweet place,
  Never been known to fail..."
26. Re:Easy! by Baloroth · 2013-09-22 08:09 · Score: 1
  
  It's a capacitative scanner. It's not a photo scanner.
  Yes, but it's a capacitive scanner that reads a pattern. That pattern happens to be the fingerprint, which can also be read with a photo scanner (epidermal and sub-epidermal tissues have the same pattern). So, if you can get a high-quality photocopy of the print, you can reproduce the pattern the capacitive scanner reads. The trick is finding the right materials and method to do so, which is apparently not hard.
  
  --
  "None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
27. Re:Easy! by angel'o'sphere · 2013-09-22 08:10 · Score: 1
  
  Did you even read the summary?
  Anonymous hacker? The summary clearly states it was hacked by guys and girls from the CCC.
  If you don't know who and what that is: google is your friend
  
  --
  Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
28. Re:Easy! by davester666 · 2013-09-22 08:12 · Score: 1
  
  Um, no, presumably because you ALSO know the passcode, which will also unlock it, and will then permit you to either update the original finger scan or change to a new finger scan as you wish.
  
  --
  Sleep your way to a whiter smile...date a dentist!
29. Re:Easy! by angel'o'sphere · 2013-09-22 08:14 · Score: 1
  
  You forget the fact that the CCC used milk and latex to simulate human skin, to trick the capacitors.
  A very old technique btw.
  
  --
  Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
30. Re:Easy! by Intrepid+imaginaut · 2013-09-22 08:16 · Score: 1
  
  It seems fairly clear that your idea of what the scanner does and what it actually does are at some pretty serious odds, my friend.
31. Re:Easy! by murdocj · 2013-09-22 08:16 · Score: 2
  
  If you try to brute-force the pin doesn't the machine wipe the data? At least my ITouch claims that it will do so after 10 bad tries.
32. Re:Easy! by paiute · 2013-09-22 08:19 · Score: 1
  
  Remember that a hacker won't know which of 5 fingers the owner uses, so that's another layer of security
  Use a toe and the NSA won't be able to break in.
  
  --
  If Slashdot were chemistry it would look like this:Cadaverine
33. Re:Easy! by Zorpheus · 2013-09-22 08:21 · Score: 1
  
  Never heard that the CCC belongs to Anonymous.
34. Re:Easy! by Intrepid+imaginaut · 2013-09-22 08:28 · Score: 1
  
  Why would I bother, fifty people already have. Go argue with them.
35. Re:Easy! by Intrepid+imaginaut · 2013-09-22 08:35 · Score: 1
  
  Keep on spinning, champ. Mods, my recommendation is to obliviate this shill, government, corporate, it matters not in the slightest.
36. Re:Easy! by angel'o'sphere · 2013-09-22 08:46 · Score: 1
  
  The pseudonym of the hacker in question is 'starbug', he is active in the hacking scene since a decade at least.
  OTOH I wonder why you need the name? Why don't you read how he did it and build up your own mind how plausible that is?
  
  --
  Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
37. Re:Easy! by angel'o'sphere · 2013-09-22 08:49 · Score: 1
  
  The capacitor is not scanning the image, it only "verifies" if the "thing" on the sensor "might be" a finger or something else.
  
  --
  Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
38. Re:Easy! by Jane+Q.+Public · 2013-09-22 08:53 · Score: 1
  
  "Yes it was an interesting episode of Mythbusters. SEVEN years ago."
  Yep. Seven years ago. BUT... if it can be defeated exactly the same way (which according to the report, it was), then even with all that improved technology, THEY'RE STILL NOT ANY BETTER THAN THEY WERE THEN.
  
  That was, in fact, my point. It doesn't matter how much new technology you throw at it. If it doesn't work better, you wasted all that money.
  
  And while we may not have proof, if they were lying, we'll find out. Personally, I think they were just telling it like it is. We'll know soon enough.
39. Re:Easy! by lachlan76 · 2013-09-22 08:53 · Score: 2
  
  IIRC, toner has graphite in it, which is probably what makes this work.
40. Re:Easy! by Anonymous Coward · 2013-09-22 08:53 · Score: 1
  
  And to think that concern might have been tinfoil hattery only a short while ago.
  I avoid these problems by simply wrapping my phone in tin foil. The battery life has been a bit lousy and no one's called me yet, but I haven't had any security breaches that I can tell.
41. Re:Easy! by Jane+Q.+Public · 2013-09-22 08:58 · Score: 1
  
  "And how exactly is the capacitative image of the finger copied? Hint: photocopiers don't copy capacitative images. Neither input nor output."
  The photocopier doesn't have to copy the "capacitive image". It only needs to copy the ridge pattern. That pattern is then made into a "capacitive image" via the latex mold + moisture.
  
  "Some people seem to think that tricks that worked on Mythbusters 7 years ago work on entirely different technology today."
  And according to the report, that's exactly what it did. They didn't JUST use photocopies in the Mythbusters episode, remember. They also used ballistic gel, which has a "capacitive image" similar to skin.
  
  And the more-expensive unit on the door lock they defeated 7 years ago DID use capacitance as part of its scan. This is hardly "new" technology. Apparently, according to TFA, it's merely slightly higher resolution.
42. Re:Easy! by girlintraining · 2013-09-22 08:59 · Score: 1, Insightful
  
  But this shows that Apple was less than honest in their claims about pulse detection, and sub-surface tissue detection.
  Apple has been less than honest about just about every aspect of their product from design, to production, to sale. But even if iphones are designed by teenagers and young adults in china in super factories that house workers on site, make them work 16 hour days for years on end for pennies, and drive so many to suicide that they have installed suicide nets around every building, people keep buying them because they're trendy. Nobody cares if Apple lies to them, as long as people keep believing that owning Apple products is a status symbol.
  
  --
  #fuckbeta #iamslashdot #dicemustdie
43. Re:Easy! by Jason+Levine · 2013-09-22 09:00 · Score: 1
  
  I said this too when the "fingerprint scanner" broke. The response I got was that the Mythbusters episode was from 2006 and this technology obviously read subdermal layers, etc, etc, etc. Imagine my surprise (by which I mean the lack thereof) that the device can be beaten with techniques the Mythbusters employed seven years ago.
  
  --
  My sci-fi novel, Ghost Thief, is now available from Amazon.com.
44. Re:Easy! by GuldKalle · 2013-09-22 09:05 · Score: 1
  
  Why do you need that name any more than you need the name of the Apple engineers who designed the scanner?
  
  --
  What?
45. Re:Easy! by gl4ss · 2013-09-22 09:07 · Score: 1
  
  actually no.. why do you think they moisten it? it's not a "photo" as such.
  thing is, apple sold the sensor as if did some ultasonicsmashmonic 3d mapping of your finger when in reality it's just a ring of capacitive sensors..
  
  --
  world was created 5 seconds before this post as it is.
46. Re:Easy! by msauve · 2013-09-22 09:12 · Score: 3, Informative
  
  "the CCC used milk and latex to simulate human skin, to trick the capacitors. A very old technique btw."
  
  They used latex milk (i.e. liquid latex rubber), not "milk and latex."
  
  --
  "National Security is the chief cause of national insecurity." - Celine's First Law
47. Re:Easy! by K.+S.+Kyosuke · 2013-09-22 09:16 · Score: 1
  
  You're just pulling the wool over our eyes, aren't you?
  
  --
  Ezekiel 23:20
48. Re:Easy! by fuzzyfuzzyfungus · 2013-09-22 09:17 · Score: 2
  
  "So how do you imagine you copy a capacitative image on a photocopier?"
  
  You don't; but a photocopier/laser-printer is a dirt-cheap way of depositing a high precision thermoplastic structure on top of a sheet of transparency plastic(ie. creating a fingerprint mold) at which point you just brush on a layer of the actual approximately-human-capacitance material you are using to make the fake print.
  
  That's all the photocopier does. If you can get away with very flat, low-temperature, molds, laser printing is a precise and cheap way to make them.
49. Re:Easy! by mysidia · 2013-09-22 09:21 · Score: 5, Funny
  
  you mean, besides just holding your hand against the sensor? As, if they have your phone, they probably also have you...
  How about you jailbreak the phone, and use a PIN to unlock it normally, BUT you customize the reader, so if certain of your fingers get held against the sensor --- it triggers a "disable power off function" and "start wipe device" command.
50. Re:Easy! by mysidia · 2013-09-22 09:24 · Score: 1, Insightful
  
  But this shows that Apple was less than honest in their claims about pulse detection, and sub-surface tissue detection.
  Maybe not In the video; the guy using the plastic strip to trick the device is holding the plastic strip over the same finger that can legitimately unlock the device.
  To me... this raises the question; is the phone seeing his live finger through the plastic strip?
  Is there anything unique about the tissue being detected; that might actually result in this not working If he had put a non-legitimate finger behind the fake strip instead of a legitimate registered finger?
51. Re:Easy! by Savage-Rabbit · 2013-09-22 09:34 · Score: 5, Insightful
  
  sounds really trivial to break. I can see all kinds of kids doing this.
  Known vector. Gummy-bear attack.
  The core issue is that you leave copies of your authenticator EVERYWHERE. It's as if you dropped 85% accurate copies of your smartcard on every item you touched - with random 15% damage to the material - and a card reader designed for 15% error in reads.
  Any such scheme is going to be subject to this kind of impersonation or gaming. This is why biometrics are always a bad ID choice. Also, the A/D conversion is low-entropy, among other problems.
  There's a false assumption, that because I can uniquely identify another person with 99.999% accuracy, based on your sound, shape and appearance, that therefore this is the best way a machine should do so. It is a falsehood that is reinforced by a misleading intuitive perception. The core issue concerns the questions related to what constitutes "identity" and an "authentication factor" in systems. Neither of these correlate to actual persons or their real-world characteristics in a unique and meaningful way, that is not also subject to spoofing, injecting or revocation DoS.
  Let's say you get your grubby hands on an iPhone 5S and are immediately overcome by an irresistible urge to crack it open.
  1) Getting the victim to pose his finger for a 2400dpi photo is not an option so you'd have to bag the device and dust it for prints since you'll probably need to make the prints more visible. I suppose you could get the hang of that in about half an hour if you are a novice with a print dusting sets you bought online.
  2) Find a good thumb print. There is no guarantee that the print on the button sensor surface is any good nor is there a certainty that there is a usable print anywhere on the phone. I suppose you could monitor your victim and steal some of his drinking glasses and coffee cups but that means 'trivial' goes out the window right there.
  3) For the sake of argument let's say you get 1 and 2 right and find a good print on the sensor surface or somewhere else on the phone, eliminating the need to poke around stealing coffee cups and drinking glasses. You now have still have to do what it says in the article and the photo processing, printing and latex covering that sounds like quite a bit more than 10 minutes of work, especially if you have never done it before.
  That does not sound exactly trivial to me. Trivial is faking your way past Google's face recognition-login feature with a picture of the phone's owner. You could conceivably do that by borrowing his phone, snapping a picture of him with your iPad and using the image in the iPad to log into his phone... Ooops! somebody already went and did that and it looks like a 20 second operation. Going through the above procedure to defeat the fingerprint scanner takes what? A hour? The average pick-pocket would probably not bother and the time it takes to crack phones this way with no guarantee of reward would make it un-economcal for criminal bands to crack phones on a large scale (in the hope of finding account numbers or dirty pictures for a blackmailing, ... or whatever) which means that this is way better security than no passcode at all. If you are carrying data valuable enough to make it worth while to go through this exercise to retrieve it you should put a 20 character password on your iPhone or consider putting the data on an IronKey in stead. And yes I know the NSA can probably pull this off in 10 minutes or less but if you have the NSA after you:
  a) They probably have more efficient ways to get into your device than stealing it and hacking it by lifting your greasy fingerprints.
  b) You have bigger things to worry about than somebody reading your e-mail... like getting snatched and sent to a secret jail for a course of water-boarding, or being on the shortlist for a drone strike.
  
  --
  Only to idiots, are orders laws.
  -- Henning von Tresckow
52. Re:Easy! by berj · 2013-09-22 09:35 · Score: 2
  
  That is an optional setting, yes.
53. Re:Easy! by Anonymous Coward · 2013-09-22 09:41 · Score: 3, Informative
  
  You should watch it once more, probably.
  He trains it on his index finger and then unlocks it with a print on his middle finger.
54. Re:Easy! by AmiMoJo · 2013-09-22 09:46 · Score: 1
  
  Also beats pattern or password unlocks, which can be 'beaten' by just a bit of careful spying.
  It's trivial to make sure no-one observes your password. It's nearly impossible to make sure no-one obtains your fingerprints.
  
  --
  const int one = 65536; (Silvermoon, Texture.cs)
  SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
55. Re:Easy! by Jeremiah+Cornelius · 2013-09-22 09:51 · Score: 2
  
  Trivial will be running a crack on the limited number of hashes that can be generated by the phone's sampler for fingerprint images.
  The problem with this is not where it has started, as a simple PIN replacement for iPhones. It is where this is headed, now that Apple has used their marketing position to deliver Biometric authentication as a security technology in the mainstream.
  People who are good at technology problem-solving are often equipped with exactly wrong type of mental orientation for examining implication or cross-disciplinary context. So? You get a reasonable PIN replacement for your iPhone, that reduces auto-collisions by people unlocking their phones while driving. Nice.
  You also get this as a cure-all for the password problem, as an option on every device you interact with, over the next 4 years. I don't care if it is thumbprint, retina-scan or gut-biome that is measured. This will lower security and introduce as-yet-unforseen compromises.
  I'd paint the lens on this thing, with black enamel.
  
  --
  "Flyin' in just a sweet place,
  Never been known to fail..."
56. Re:Easy! by JaredOfEuropa · 2013-09-22 09:53 · Score: 1
  
  The actual scanner is under the home button, which is pretty durable. Putting the scanner there is a great idea, since you will already have your finger there when you wake up the phone.
  
  --
  If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
57. Re:Easy! by AmiMoJo · 2013-09-22 09:53 · Score: 3, Insightful
  
  Anyone targeting data stored on a phone would come armed with a Faraday cage bag. You can buy them commercially, designed for "law enforcement" with the goal of preventing remote wipes. Some even come with a cable entry grommet so you can keep the phone powered and data-rape it without removing it from the bag, just in case the user enabled full device encryption.
  
  --
  const int one = 65536; (Silvermoon, Texture.cs)
  SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
58. Re:Easy! by AmiMoJo · 2013-09-22 09:55 · Score: 1
  
  So you can wipe anyone's iOS device by deliberately entering the wrong PIN 10 times?
  
  --
  const int one = 65536; (Silvermoon, Texture.cs)
  SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
59. Re:Easy! by asmkm22 · 2013-09-22 10:12 · Score: 1
  
  I'm much more interested in what all those Slashdot people have to say, who were outright dismissing any possibility of the device being hacked like this because it doesn't scan just the fingerprint, or is a capacitive scanner, or whatever.
60. Re:Easy! by Savage-Rabbit · 2013-09-22 10:19 · Score: 1
  
  Trivial will be running a crack on the limited number of hashes that can be generated by the phone's sampler for fingerprint images.
  The problem with this is not where it has started, as a simple PIN replacement for iPhones. It is where this is headed, now that Apple has used their marketing position to deliver Biometric authentication as a security technology in the mainstream.
  People who are good at technology problem-solving are often equipped with exactly wrong type of mental orientation for examining implication or cross-disciplinary context. So? You get a reasonable PIN replacement for your iPhone, that reduces auto-collisions by people unlocking their phones while driving. Nice.
  You also get this as a cure-all for the password problem, as an option on every device you interact with, over the next 4 years. I don't care if it is thumbprint, retina-scan or gut-biome that is measured. This will lower security and introduce as-yet-unforseen compromises.
  I'd paint the lens on this thing, with black enamel.
  Firstly I refer you to my previous post:
  a) They [the NSA/Russan Mafia/hackers-with-a-200-IQ] probably have more efficient ways to get into your device than stealing it and hacking it by lifting your greasy fingerprints.
  Secondly: I also think think that messing about with the limited number of hashes that can be generated by the phone's sampler for fingerprint images is either going to defeat the vast majority of run-of-the-mill phone thieves or be time consuming enough for them not to bother. They will just fence the device to somebody who will eventually wipe it and sell it on Ebay, and that still makes this scanner better than having no passcode at all. This sensor is not intended to keep out hackers or some intelligence agency, it is intended to make phones that would otherwise have no passcode too time consuming to crack for the average thief to bother with it.
  I have some of concerns about this technology but somebody running a crack on the fingerprint hashes or cracking the sensor with latex copies of my prints are all scenarios that are father down my list than, for example, the NSA twisting Apple's arm to force them to hand over biometric information so that US intelligence services can use it for nefarious purposes (and that is not at the top of the list of things that worry me either).
  
  --
  Only to idiots, are orders laws.
  -- Henning von Tresckow
61. Re:Easy! by dinfinity · 2013-09-22 10:26 · Score: 1
  
  Sure, for people who only ever unlock their phone in their parent's basement, it is.
62. Re:Easy! by narcc · 2013-09-22 10:27 · Score: 1
  
  That's "latex milk", which is not the same as milk and latex.
  The article also suggests that they used white wood glue, which people are more likely to have around the house. (Adding a bit of glycerin to the glue seems to be an optional step.)
  
  --
  Required reading for internet skeptics
63. Re:Easy! by dinfinity · 2013-09-22 10:34 · Score: 1
  
  It's pretty early to be calling it, but the technically extremely simple home button apparently stops functioning properly more than seldom. Googling 'broken home button' provides some evidence for that.
  Just the fact alone that dirt could enter through the home button should raise the concern that the fingerprint scanner could be affected.
64. Re:Easy! by phluid61 · 2013-09-22 10:41 · Score: 2
  
  Related "story", popped up in the few days. http://9to5mac.com/2013/09/21/touch-id-on-iphone-5s-can-be-used-with-more-than-just-your-fingers/ Fingers and toes aren't the end of it.
65. Re:Easy! by maccodemonkey · 2013-09-22 10:50 · Score: 2
  
  Anyone targeting data stored on a phone would come armed with a Faraday cage bag. You can buy them commercially, designed for "law enforcement" with the goal of preventing remote wipes. Some even come with a cable entry grommet so you can keep the phone powered and data-rape it without removing it from the bag, just in case the user enabled full device encryption.
  Of course any Slashdotter knows that once someone has local access anything stored locally is basically crackable anyway. So if one had information they really wanted secure it would likely be on a remote server anyway, which a device can't get to in a Faraday cage.
  That's also what makes the passcode and fingerprinting debate a bit silly. If someone like the government physically had your device, they need neither the passcode or the fingerprint. They have the abilities to dissect the device and pull any info off, encryption or not.
66. Re:Easy! by tgibbs · 2013-09-22 11:44 · Score: 1
  
  But has he previously trained it to recognize his middle finger?
67. Re:Easy! by ganjadude · 2013-09-22 11:48 · Score: 1
  
  true, and although you are making a funny i have to assume that a good 80-90% of the population will have their right thumb as the correct finger, based on the way people hold their phones. there will be a few who think they are smart and use a pinky, and then you got us left handed people (when can I buy a good fucking mouse?!?!?!!!) but the majority will be a right thumb
  
  --
  have you seen my sig? there are many others like it but none that are the same
68. Re:Easy! by Dare+nMc · 2013-09-22 12:10 · Score: 1
  
  If I recall correctly ink jet ink is required to be both conductive, and have magnetic properties. So it does seam like a capacitive sensor would be fully capable of reading a pattern printed by some inkjet printers. So that leaves the question of how sensitive is apples pattern matching software...
69. Re:Easy! by CBM · 2013-09-22 12:14 · Score: 1
  
  Yep. A briefing by the designing company, AuthenTec, found here,
  http://www.zvetcobiometrics.com/Documents/Trueprinttechnology.ppt
  shows that even though the sensing technology is different than static capacitance, it still basically reads your fingerprint pattern (see slide 12).
  It probably does measure the blood vessels - the blood vessels within the derma portion of the skin that makes up your fingerprints.
70. Re:Easy! by prowler1 · 2013-09-22 12:19 · Score: 1
  
  Remember that a hacker won't know which of 5 fingers the owner uses, so that's another layer of security
  Actually, many people have up to ten fingers. Personally, I use my big toe.
  But this shows that Apple was less than honest in their claims about pulse detection, and sub-surface tissue detection.
  I am not sure where you live that has a large number of mutants who have 'up to ten fingers'. Where I live, most people have 8 fingers and two thumbs.
71. Re:Easy! by CBM · 2013-09-22 12:20 · Score: 1
  
  You keep saying "it's a capacitive scanner" like that's some magical technology. Skin is partially conductive and has capacitance. The same for the derma layers under the epidermis. If you can take a picture of someone's fingerprint pattern (epidermis), that will most likely reflect the dermis pattern underneath (which is where the "blood vessels" are).
  AuthentTec's own PR slides show how this works. (http://www.zvetcobiometrics.com/Documents/Trueprinttechnology.ppt)
  I'm convinced the advantage of AuthenTec's technology is not that it senses the pattern of blood vessels in your finger (other than the blood vessels indicate where the dermis is), but rather that the signals can penetrate the sapphire protection layer more easily, as well as the outer layers of scarred or abraded epidermis.
72. Re:Easy! by Khyber · 2013-09-22 12:41 · Score: 1
  
  Toner has iron particles, which makes it capacitive.
  
  --
  Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
73. Re:Easy! by SpaceLifeForm · 2013-09-22 12:41 · Score: 1
  
  Or the other 15 digits. Maybe a toeprint is the way to go.
  
  --
  You are being MICROattacked, from various angles, in a SOFT manner.
74. Re:Easy! by Joining+Yet+Again · 2013-09-22 12:42 · Score: 4, Informative
  
  You made a mistake and you're behaving stupidly, posting the same misunderstanding over and over again on this thread. As far as I can tell, you're an Apple fan and you're annoyed that they were so obviously caught with their pants down, so you're deliberately (you've been corrected multiple times) lying about how capacitive fingerprint scanning works.
  You have two choices now:
  i) Let it go and apologise, and appear reasonable in the eyes of fellow Slashdotters - every business and individual sometimes makes a mistake, including you;
  ii) Continue stomping your feet like a dull child, losing all remaining respect you have on this site, and causing other people to remember back to this thread where you lost it every time they see a post from you.
  Which will it be, BasilBrush? I know you'll have read this, so it's now up to you.
75. Re:Easy! by Macdude · 2013-09-22 12:46 · Score: 1
  
  Maybe not In the video; the guy using the plastic strip to trick the device is holding the plastic strip over the same finger that can legitimately unlock the device.
  Go re-watch the video and pay attention this time... He used his index finger to lock the phone and his middle finger to unlock it using the "plastic strip".
  
  --
  "Grab them by the pussy" -- President of the United States of America
76. Re: Easy! by Khyber · 2013-09-22 13:00 · Score: 4, Interesting
  
  Reproducible to a T, though I used a different method.
  1. Get boyfriend to lock his new iPhone with his fingerprint.
  2. Lift said fingerprint from his fresh drinking glass with tape and a light dusting of coarse graphite powder before applying tape.
  3. Make fingerprint better viewable by optical scanners by dusting with extremely fine graphite powder after transfer to white paper.
  4. Scan and print on copier using capacitive iron-wax toner.
  5. Fingerprint security? Same bullshit from the beginning 2000s, with the exact same fucking flaws.
  I was bypassing this exact same crap with the exact same method on IBM ThinkPads and HP NC/NX model Business-class notebooks years ago.
  
  --
  Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
77. Re:Easy! by mjpaci · 2013-09-22 13:09 · Score: 2
  
  Wouldn't your fingerprint be on the glass of the iPhone in the first place? Like, maybe, on the button itself?
78. Re:Easy! by codegen · 2013-09-22 13:20 · Score: 1
  
  In the video; the guy using the plastic strip to trick the device is holding the plastic strip over the same finger that can legitimately unlock the device.
  I think you need to watch the video again. He registers his pointer finger and uses plastic strip on his middle finger.
  
  --
  Atlas stands on the earth and carries the celestial sphere on his shoulders.
79. Re:Easy! by smash · 2013-09-22 13:29 · Score: 2
  
  Of course, its never going to be 100% secure. However if someone has stolen your device and had enough time to go through the process of faffing around making a fingerprint to ulnlock it, presumably you've already wiped it with find my iphone. If someone has physical control of your device, all bets are off.
  However, as an unlock to prevent against casual snooping, the fingerprint scanner is convenient, and much less hassle than a passcode. Perhaps having the phone fall-back to passcode security after an hour or two is a good idea, and relegate fingerprint scan to a quick unlock, for a limited duration after you've locked the phone.
  
  --
  I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
80. Re:Easy! by murdocj · 2013-09-22 13:31 · Score: 1
  
  Yes, if the option is set, a thief can't brute force the password.
81. Re:Easy! by smash · 2013-09-22 13:39 · Score: 1
  
  Yes. This is why you have all your photos, calendar, email, contacts, etc synced off-device. If you've got all your stuff stored only on a highly pocketable, highly breakable device you're an idiot.
  
  --
  I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
82. Re:Easy! by Khyber · 2013-09-22 13:48 · Score: 1
  
  "As photocopiers don't tend to deal in capacitative imaging, neither input nor output, I'm dubious."
  Plenty of laser printers use a capacitive iron-wax toner.
  I've got blocks of the stuff that respond wonderfully to a magnet and can set off the capacitance-based anti-theft scanners at the entrances to many stores.
  
  --
  Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
83. Re:Easy! by Macgrrl · 2013-09-22 13:54 · Score: 1
  
  To the best of my recollection, the only magnetic printing medium is MICR which is generally a type of toner with a small percentage of iron in it. It was most commonly used for printing cheques to be read by magnetic readers before OCR got as good as it has.
  
  --
  Sara
  Designer, Gamer, Macgrrl in an XP World
84. Re:Easy! by LordLimecat · 2013-09-22 14:06 · Score: 1
  
  Of course any Slashdotter knows that once someone has local access anything stored locally is basically crackable anyway
  No, we know that if someone has local access to a device, you must consider the device compromised.
  That is COMPLETELY DIFFERENT than "being crackable"-- a seized harddrive that has been Truecrypted isnt going to do much good to a national agency.
85. Re:Easy! by formfeed · 2013-09-22 14:08 · Score: 5, Interesting
  
  Based on their respective histories, a sensible person would probably trust CCC over Apple.
  Yes, I agree. No idea why this was modded "troll". There is a decent history to show that.
  CCC:
  Did this before. They lifted the fingerprints of the German minister of Interior from a water glass and turned it into a little stamp so you can place him now at any crime scene. (The hack was actually to show just how idiotic government use of biometric data is).
  Apple:
  I of course don't want to say anything negative against this good company, but some people might say that they have a history of over-hyping things.
86. Re:Easy! by mjwx · 2013-09-22 14:15 · Score: 1
  
  Still beats no passcode at all against a casual attacker
  Also beats pattern or password unlocks, which can be 'beaten' by just a bit of careful spying.
  Actually, no it doesn't.
  
  You literally need to be looking right over their shoulder to observe a pattern unlock.
  
  --
  Calling someone a "hater" only means you can not rationally rebut their argument.
87. Re:Easy! by jpatters · 2013-09-22 14:18 · Score: 1
  
  You know what a government is going to do if they have you and your phone? Take your finger, and press it to your phone, which legally they can compel (or physically force) you to do. All this talk about "Oh, what if the government has your fingerprint on file?" Please. That's overthinking it.
  Too bad you can't designate one of your fingerprints as a duress fingerprint, which would cause the phone to wipe itself.
  
  --
  "Remember, there never were pineapple-almond cookies here."
88. Re:Easy! by smash · 2013-09-22 14:26 · Score: 1
  
  Alternatively, combine the fingerprint scan with facial recognition (yes, with a blink) and/or spoken word - all of those things are relatively convenient to provide for the owner, but very much inconvenient to try and steal as a combination for an attacker.
  
  --
  I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
89. Re:Easy! by grantspassalan · 2013-09-22 14:42 · Score: 1
  
  Once the cops have you and the phone it is physically and legally much easier for them to force you to touch your finger to that sensor than it is to force you to reveal your password. They don't even have to use the rubber hose decryption method on you.
  
  --
  A sufficiently advanced simulation is indistinguishable from reality.
90. Re:Easy! by Dare+nMc · 2013-09-22 15:02 · Score: 2
  
  Inkjet printing
  " The charged droplets pass through an electrostatic field and are directed (deflected) by electrostatic deflection plates to print on the receptor material (substrate)"
91. Re:Easy! by Bite+The+Pillow · 2013-09-22 15:07 · Score: 1
  
  You lose your phone, and the hacker won't know which of the 70 billion fingers in the world unlocks the phone, so that's another layer of security.
  Even if it's 20 people in a room, that's a big unknown. A phone on the subway in New York is going to be a lost cause.
  It's not effective against someone who has access to both your phone and your fingerprints. But it is better than nothing for some cases, and faster than a pin.
  Just checked my phone - without any special preparation it has no fingerprints on it (checked with tape too, not just visibly). Some phones might have fingerprints, but it's not guaranteed. In a purse or pocket, it's more likely to get smudged.
92. Re:Easy! by VortexCortex · 2013-09-22 15:38 · Score: 1
  
  sounds really trivial to break. I can see all kinds of kids doing this.
  Known vector. Gummy-bear attack.
  The core issue is that you leave copies of your authenticator EVERYWHERE.
  You act like it's so easy to just lift the fingerprints. Come on, they'd have to break into my parent's basement first.
93. Re:Easy! by puto · 2013-09-22 15:43 · Score: 1
  
  Cause Apple engineers did not design the scanner.
  
  --
  The Revolution Will Not Be Televised
94. Re:Easy! by Solandri · 2013-09-22 15:52 · Score: 1
  
  Also beats pattern or password unlocks, which can be 'beaten' by just a bit of careful spying.
  A pattern or password will secure your data on the device if an unscrupulous person happens to find it on the bar stool where you left it. Your fingerprints unfortunately are likely to be all over the device, and thus represent less security in this scenario.
95. Re:Easy! by swillden · 2013-09-22 16:15 · Score: 1
  
  Apple's little toy is just another fingerprint sensor (albeit a more attractive one than the usual little stripe-thing)
  The little stripe thing would actually have been a little more secure. It's fairly hard to make latex or gummi fingers that can be slid across a stripe sensor without being either too stiff to present the ridges properly, or so flexible that the friction deforms the patterns. It's still possible, just a little harder.
  In general, unattended fingerprint validation should never be viewed as a security measure. It's a good fast and easy identification tool where you want to tell the device who you are (from among a smallish set of candidates), but don't need security. A good example (that I actually worked on) is nurse access to patient records. All of the nurses working the floor have access, and security comes from not allowing unauthorized people access to the machine, not from authentication, but for HIPAA compliance it's necessary to record who accesses the record. For practical reasons access needs to be fast. For practical reasons, it also has to work when the nurse is wearing gloves, so the system is unworkable, but it's still a good example of an appropriate application of fingerprint scanning.
  Another appropriate application is as an authenticator in high-security environments where security does matter, enough that someone is there to watch you scan your finger, and to ensure that you're not playing any fake finger tricks.
  If your security needs are somewhere in between, then fingerprint authentication is not the solution you're looking for. For many iPhone users, this is a perfectly reasonable compromise between no security (which is what they would otherwise choose) and convenience. For anyone who would otherwise feel the need to put a passcode on their phone, the fingerprint authentication is probably not a good choice.
  
  --
  Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
96. Re:Easy! by swillden · 2013-09-22 16:22 · Score: 5, Interesting
  
  It's a capacitative scanner. Whether you like it or not, that's not imaging the surface layer of skin, but the complexity of what's behind it.
  You're correct that it doesn't image the surface layer, but wrong about it getting what's behind the skin. Capacitive sensors obtain an image of, essentially, the back side of the skin. The ridges are there, but no other subdermal structure is visible, and the ridges are the same ones visible on the surface, so a surface image (e.g. a skin-oil negative), provides a fine panel from which to construct a usable fake finger.
  FWIW, I used to build biometric authentication systems, especially fingerprint stuff. I did security analyses of fingerprint scanners (optical and capacitive) for Visa, wrote the Linux kernel driver for the AuthenTec scanner, and a bunch of other stuff over 10-year period. I've never designed them and don't claim to fully understand the physics (though I've consulted extensively with people who do), but I've worked with them, a lot, and I know very well what they do and do not do.
  
  --
  Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
97. Re:Easy! by tlhIngan · 2013-09-22 17:23 · Score: 2
  
  It's a bit much for casual purposes; but it effectively demonstrates that Apple's little toy is just another fingerprint sensor (albeit a more attractive one than the usual little stripe-thing) with no more resistance to an under-a-hundred-bucks, probably a few bucks per print, in quantity, attacks than any of the others.
  Still beats no passcode at all against a casual attacker; but it sounds like the CCC technique works just fine with digital reproductions (ie, you don't need the original thumbprint to use as a mold, or develop with cyanoacrylate vapor, or anything like that) so it's fuck up once, have your fingerprint on file for however long it stays roughly the same, which is never terribly encouraging.
  Actually, the take away is that the fingerprint sensor is unreliable. So unreliable that a 4-digit PIN trumps the fingerprint reader. Yes, I said trumps because your PIN is more important to the OS. If you reboot the phone, you need the PIN - the fingerprint will NOT unlock it. If you don't use the fingerprint reader for 48 hours, you need the PIN.
  The only benefit the fingerprint reader has is that people who won't use PINs because they're so inconvenient to use (having to enter it all the time) that they leave their phone at the default swipe to unlock. Which apparently is around 50% of smartphone users out there. The reader simply upgrades their security a tiny bit since it's now PIN-locked rather than people leaving it open.
  And for those who already use PINs, they can upgrade to full complex passcodes (or passphrases), but not have to deal with entering their 100 character long phrase every time they need to send a text.
  It's like how laptop fingerprint readers work - when it worked on my laptop, I locked my laptop all the time when I left it. But since it broke, I don't lock it all the time.
  People seem to think it's unbreakable, yet on the iPhone and on any laptop, it's used to bypass the password. But if you have the password, you don't need the fingerprint. Except Apple's implementation is slightly more secure because it requires using the alternative unlock mechanism.
  Here, the fingerprint reader is quicker to unlock your phone than Android's face unlock (which is equally insecure).
98. Re:Easy! by tibman · 2013-09-22 17:50 · Score: 1
  
  He uses a different finger. He teaches the phone his index finger and tricks it with his middle finger.
  
  --
  http://soylentnews.org/~tibman
99. Re:Easy! by xQx · 2013-09-22 17:54 · Score: 1
  
  I don't know if it's different in the USA, but this in the UK and Australia failing to produce your unlock-code to LEO's will have you held for a while on trumped-up charges, then (potentially) forced to hand it over by a court-order.
  As for security from the average criminal, passcodes (and thumb-unlock) can be very easily broken with a hammer or wrench (http://xkcd.com/538/).
  The real risk of this revelation is the covert unlocking of a phone, but as GGP inferred - lifting, printing and forging fingerprints is beyond most would-be thieves.
  Which reminds me of the scene in Demolition Man where Wesley Snipes exploits a flaw in an iris scanner to walk out of prison... I suppose it's not newsworthy to claim that you've bypassed the iPhone thumb-print scanner with a pair of bolt cutters...
100. Re:Easy! by mrxak · 2013-09-22 17:59 · Score: 3, Insightful
  
  It's trivial to change your password, if it's ever compromised. It's not so easy to change your fingerprints.
  
  --
  -mrxak
  Onions Will Kill You
101. Re:Easy! by lgw · 2013-09-22 18:21 · Score: 1
  
  I don't even lock my phone. If you have anything you care about on a phone ...
  
  --
  Socialism: a lie told by totalitarians and believed by fools.
102. Re:Easy! by Jeremiah+Cornelius · 2013-09-22 18:35 · Score: 1
  
  You act like it's so easy to just lift the fingerprints. Come on, they'd have to break into my parent's basement first.
  Yes! And lift them from your +5 Vorpal Blade!
  
  --
  "Flyin' in just a sweet place,
  Never been known to fail..."
103. Re:Easy! by MrMickS · 2013-09-22 18:49 · Score: 2
  
  Just like the "unlock gesture" in the new Windows stuff, this is a replacement for a 4 digit PIN, not for a real password. This break seems harder and more time consuming than brute forcing a 4 digit PIN, so it's fine.
  Anyone who actually cares will have forensic tools that will just immediately present the data anyhow - for any consumer device, physical access is access to the data, eventually.
  It's a little more than that. Once unlocked the fingerprint can be used to authorise the iTunes and App stores ... not that that does you much more than allow you to download stuff to your stolen phone at present. Maybe Apple were aware of the limitation and that's why they've withheld access to the TouchID API from developers. It would be different if you could authorise real world purchases with it.
  
  --
  You may think me a tired, old, cynic. I'd have to disagree about the tired bit.
104. Re:Easy! by dave420 · 2013-09-22 20:48 · Score: 1
  
  Translation of your post: "I don't know what any of these words mean, I just assume I do, and that makes it magical and secure to me".
  The photocopier doesn't have to read the capacitance of the fingerprint, just the structure of what will eventually be made into a capacitative form. As capacitative scanners still read the structure of fingerprints, this clearly isn't a problem. The photocopier reads the fingerprint, and the structure of the fingerprint is then printed in a way that creates a capacitance-compatible image of the fingerprint.
  This has already been pointed out to you many times, but you seem to simply not want to hear it. Shame.
105. Re:Easy! by RivenAleem · 2013-09-22 21:03 · Score: 1
  
  Yes, Apple should have a system whereby the users steps on the phone and the accelerometer detects from their posture, who they are. Rigorous jumping up and down should be involved.
106. Re:Easy! by Makawity · 2013-09-22 21:05 · Score: 1
  
  Actually, many people have up to ten fingers. Personally, I use my big toe.
  
  RMS, is that you?
107. Re:Easy! by narcc · 2013-09-22 21:37 · Score: 1
  
  Or you could just look at the smudges on the screen. Google will tell you all about that.
  
  --
  Required reading for internet skeptics
108. Re:Easy! by dinfinity · 2013-09-22 21:47 · Score: 1
  
  Zoom. Lens.
109. Re:Easy! by dinfinity · 2013-09-22 21:48 · Score: 1
  
  Depends on the pattern. If you use a pattern that resembles the normal swiping gestures, or the more complex solution of patterns (almost) repeating on themselves, the smudges attack vector becomes pretty useless.
110. Re:Easy! by dinfinity · 2013-09-22 21:56 · Score: 1
  
  This is a good point. A malicious colleague or classmate could extract your fingerprints at some time and then be able to unlock all your future (fingerprint scanning) devices without you ever knowing.
  I'm not sure whether that trumps the daily annoyance of having to be secretive about entering passcodes or patterns, though. As stressed many times here, it's not meant to hold up to people with a long-term intent of breaking in to your device, but more to 'friends' who could easily sneak a peek at private messages.
111. Re:Easy! by dinfinity · 2013-09-22 22:11 · Score: 1
  
  I get your point. I was inspecting my own phone to see whether there were usable prints on it and what the best place to look for them would be.
  Then I realized that on a phone with a fingerprint scanner, the best place to look for usable prints would be on the fingerprint scanner (/home button!).
  I guess the best approach would then be to use the fingerprints on the fingers that you use the least for operating the device, like the ones from your ring finger.
112. Re:Easy! by Bongo · 2013-09-22 23:29 · Score: 1
  
  Ah Grasshopper, you have perfected the subtle art of typing out an eight digit passcode, but only making contact on the screen with four.
113. Re:Easy! by Bongo · 2013-09-22 23:34 · Score: 1
  
  I have an idea, why not require 8 digits (fingers not numbers) to be pressed in an unique sequence. Then it'll only be marginally (hugely) more annoying than typing a numeric code. Gah.
  I guess this is the TimeMachine of passwords — only an improvement for those who never otherwise bother with it.
114. Re:Easy! by epSos-de · 2013-09-22 23:39 · Score: 1
  
  They have been doing this before iPhone 5. Their bast hack was the collection of fingerprints from high grade politicians, from restaurant glasses. One of their magazines published the fingerprints and explained how to print them with printers and strap them on thin latex gloves. It was a protest act against fingerprints in passport, but the politics did not listen.
  
  --
  ~ Best man at your service.
115. Re:Easy! by eric_herm · 2013-09-23 00:31 · Score: 1
  
  No, Apple trained the phone to give the middle finger, not to recognize it.
116. Re:Easy! by Abroun · 2013-09-23 00:44 · Score: 1
  
  But you can register several fingers, in case you lose or forget one.
117. Re:Easy! by parkinglot777 · 2013-09-23 00:46 · Score: 1
  
  5 only? How many people in the real world have 5 fingers? As far as I remember, the Simpsons have 8 which is still more than 5!
118. Re:Easy! by Izrun · 2013-09-23 01:26 · Score: 1
  
  Could be real, but this could just as easily be fake. He could have programmed that finger with that implant ahead of time. We see him program a different finger and have no proof or evidence that this was the only finger saved. It could be reading the finger behind the implant which was already set up to unlock the phone. Need lots more evidence before I could believe such a simple hack would work.
  
  --
  -Izrun
119. Re:Easy! by BitZtream · 2013-09-23 01:28 · Score: 1
  
  And that doesn't mean it requires iron or anything else in particular. Electrostatic force can be used on ... well just about anything, including plain water. You're not talking about moving a train, you're talking about moving atomized droplets of liquid. Doesn't take much force to do so.
  
  --
  Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
120. Re: Easy! by BitZtream · 2013-09-23 01:32 · Score: 1
  
  So you're saying you're using a reverse image of the finger print and its working? Thats what you're claiming in these steps, or you're leaving out the last part in your attempt to look like you're a bad ass hacker.
  You kind of ignore the fact that your print isn't the right orientation, you're printing a mold, not the fingerprint itself.
  Nice try though.
  
  --
  Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
121. Re:Easy! by smash · 2013-09-23 01:35 · Score: 1
  
  ... you lock your phone and do application level security/encryption. you also do remote wipe if it goes missing. mine has copies of keepass and 1password on it.
  
  --
  I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
122. Re:Easy! by BitZtream · 2013-09-23 01:39 · Score: 1
  
  I guess this is the TimeMachine of passwords — only an improvement for those who never otherwise bother with it.
  Is this supposed to be some kind of half assed passive-agressive insult?
  You're trying to make it out like TimeMachine isn't what EVERY OS should come with built in? Its arguably the best snapshot backup system for end users thats ever been made.
  Like wise, you're trying to make it out like users who can suddenly use a 'harder to hack than reading your PIN while you type it' security features, isn't worth bothering with even though it will make it so normal people suddenly stop leaving their phone laying around unlocked for anyone to dick with?
  You're just trying to hard to be anti-apple, or you're utterly ignorant of how the world around you works. Not really sure which.
  
  --
  Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
123. Re:Easy! by BitZtream · 2013-09-23 01:40 · Score: 1
  
  If the sensor is embedded in the button, dirt may be able to enter the device, but that doesn't mean it can enter the sealed button/scanner.
  
  --
  Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
124. Re:Easy! by ilsaloving · 2013-09-23 01:44 · Score: 1
  
  Pfff... everyone knows that the most important aspect is to increase your range of possible values as much as possible. That's why I always use my 4th toe for these sorts of things.
  As an added bonus, my flexability is amazing!
125. Re:Easy! by Aaden42 · 2013-09-23 02:05 · Score: 1
  
  You don’t even need to disable power off. With the encrypted storage used since the 3GS, you just zero the 128 bit flash device key in the device’s crypto chip & reboot. The rest of the encrypted flash is nothing but entropy at that point. Should only take a few seconds to complete. This is what the “Find My Phone” remote wipe feature does.
  That said... From a security standpoint I’d actually prefer the boot loader & rest of the pre-boot environment be impervious to jailbreaks. If it can be jailbroken, then attackers don’t mess around with the PIN unlock at all. Just subvert the boot environment to boot & decrypt the flash normally, then allow unfettered access to flash contents. No PIN nor print required.
126. Re:Easy! by Aaden42 · 2013-09-23 02:17 · Score: 3, Informative
  
  Alas, that’s not settled case law in the US. Results are mixed at Federal district level, and there’s no settling ruling by SCOTUS. Depending on the jurisdiction you’re in, some have ruled that compelling a password is self incrimination whereas others have ruled that it’s the same as compelling the combination to a safe (which *is* settled to *not* be self incrimination).
  The logic goes something like this: Revealing that you know the code reveals that the “container” (safe, phone, etc.) belongs to you. That might be incriminating, but if they can prove via other means that the container belongs to you (easy for a cell phone - check CellCo records), then you’re not incriminating yourself by revealing that you know the code since they already know it belongs to you. Revealing the code proves nothing that they don’t already know. Since the code itself is now not incrimination (only the contents that are revealed by it), you can be compelled to provide the code or rot in a cell until you do.
  Some jurisdictions have been a bit more reasonable in realizing that the contents of a cell phone are likely to be more intimate and thus more deserving of additional protections than bank records sitting in a safe, but that’s not universal at all yet.
127. Re: Easy! by Aaden42 · 2013-09-23 02:27 · Score: 1
  
  I don’t see any chance that this would aid Apple in assisting with lawful unlock requests. Apple has the signing keys that allow them to load any code on any device they please. Assuming they are cooperating with LEO on unlocking cellphones, I would expect that they provide a specifically signed piece of (essentially) malware on a per-phone basis. They would provide code along with the signing tokens necessary to install the code “normally” on a particular device without requiring any jailbreak or other circumvention. That code could then unlock the flash-level encryption and provide a forensically sounds dump of the entire device contents without actually booting anything on the device. Essentially it would be a DFU boot loader that decrypts and puts the phone into “Target Disk Mode” to then be copied off for later analysis. No code present on the device beyond the initial mask ROM recovery bootloader would need to be executed, so any effort to make the phone self-destruct would fail.
  Alternatively, Apple might just provide signed tokens for a hash to arbitrary code provided to them by LEO, thereby allowing such a forensics package to be installed on a particular phone without Apple having any knowledge of the payload.
  Or for the extremely^W only slightly paranoid, Apple may have provided or (LEO may have obtained by less-than-overt channels) the private keys allowing them to sign any arbitrary code for any iDevice ever created.
128. Re:Easy! by noh8rz10 · 2013-09-23 03:11 · Score: 1
  
  Yeah but he probably registered his middle finger print at an earlier time. The phone can recognize up to 5 fingers. Sucker born every minute...
129. Re: Easy! by Khyber · 2013-09-23 03:19 · Score: 1, Informative
  
  You don't know how the fingerprint scanner works, so obviously you don't have a clue how my attack works.
  Hint: IRON-WAX TONER
  Go back to school and re-learn what materials can create capacitance fields. Take the iPhone apart and see it's the exact fucking same scanner you'll find on any cheap-ass laptop, a capacitance fingerprint scanner - the same fucking ones available on any laptop. Then go learn how a laser printer works, and maybe then you'll have enough education to know how my attack works.
  Or you can shut the fuck up and let people that have done forensic work with the police, such as myself, speak.
  
  --
  Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
130. Re:Easy! by MickLinux · 2013-09-23 04:53 · Score: 1
  
  Umm, correct me if I'm wrong, but latex milk can be had out of any dandelion stem.
  
  --
  Correct Horse Battery Staple: 72 bits of entropy. Enter "Correct H" into google. When it generates the phrase, that's
131. Re:Easy! by cyber-vandal · 2013-09-23 04:58 · Score: 1
  
  So marketing departments don't lie and queuing for nearly 5 days to get a phone isn't really stupid? I'd love to live in your delusional little world.
132. Re:Easy! by Jeremiah+Cornelius · 2013-09-23 05:08 · Score: 1
  
  But it's too big to fit the reader...
  
  --
  "Flyin' in just a sweet place,
  Never been known to fail..."
133. Re:Easy! by lgw · 2013-09-23 05:09 · Score: 1
  
  My desktop at home boots to a desktop, not a login screen. Anything I actually care about is in a Truecrypt volume, but I rarely need to access that. Everything else simply needs no security. My phone is like that without the Truecrypt volume - I don't need to bank from my phone, really.
  
  --
  Socialism: a lie told by totalitarians and believed by fools.
134. Re:Easy! by lgw · 2013-09-23 05:13 · Score: 1
  
  Heck, even if real-world purchases were possible to some small daily limit, I'd be happy with fingerprint or really no security at all. If my wallet is stolen, there's no security on the cash and trivial security on the credit cards, but each has a reasonable limit on my actual losses (and together it's still less than the price of a smart phone in the first place).
  
  --
  Socialism: a lie told by totalitarians and believed by fools.
135. Re:Easy! by dinfinity · 2013-09-23 05:51 · Score: 1
  
  Yet apparently it does in the current models.
136. Re:Easy! by MachineShedFred · 2013-09-23 07:16 · Score: 1
  
  I'd paint the lens on this thing, with black enamel.
  Instead of ruining the resale value of the device, you can always just not enroll your fingerprint.
  
  --
  Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
137. Re:Easy! by Jeremiah+Cornelius · 2013-09-23 07:44 · Score: 1
  
  Resale value.
  I have been through 4 previous generations - without ever having seen a buck come in.
  I give them away, or trade them up. I don't foresee a change in this pattern.
  
  --
  "Flyin' in just a sweet place,
  Never been known to fail..."
138. Re:Easy! by Aqualung812 · 2013-09-23 08:24 · Score: 1
  
  IIRC, getting to try number 10 takes a LONG time. I think getting to try number 6 or 7 was a few hours apart.
  
  --
  Grammer Nazis - I mod you "troll" unless you actually add something on-topic. Yes, I know I have mispellings in my sig.
139. Re:Easy! by mysidia · 2013-09-23 13:12 · Score: 1
  
  You don’t even need to disable power off. With the encrypted storage used since the 3GS, you just zero the 128 bit flash device key in the device’s crypto chip & reboot. The rest of the encrypted flash is nothing but entropy at that point.
  It's only 128-bit, so it's conceivable; they could download the entropy, and be able to brute force it in 50 years or so.
140. Re:Easy! by Bongo · 2013-09-23 20:41 · Score: 1
  
  yes, i just framed my comment more for the people who are criticising it. as we both say, if it is usable and easy and just works, that a lot better for many people. we aren't all geeks obsessing over how biometrics are a bad idea.
  i have the same face all my life, and that goes on my passport. omg what a security vulnerability (sarc)
  i love most of apple design but i also know to most people here that means squat.
141. Re: Easy! by philip.paradis · 2013-09-23 21:57 · Score: 1
  
  Let's just set aside the fact that inverting and/or flipping images isn't exactly rocket science, as it takes at most three clicks of a mouse to perform such operations. The simple fact is the GP is right; this is essentially the same technique I used eight years ago to defeat a fingerprint scanner. The technique works quite well, and has been employed using many a beer glass in the past for CID purposes.
  In an attempt to reassure yourself that you're somehow smarter than those around you, you kind of ignore the fact that there are people here who have actually done what is being described. Nice try, though. Sweet dreams, cupcake.
  
  --
  Write failed: Broken pipe
142. Re:Easy! by jp10558 · 2013-09-24 00:39 · Score: 1
  
  Hmmm, I see two things. One, if compelling a combination is not a 5th amendment violation, then compelling a password probably isn't either. I'm a big fan of not inventing new laws because someone added "on a computer" to an existing situation. I think it's hard to claim an encryption password is very different from a safe combination.
  
  --
  Opera, Proxomitron-Grypen,GPG 0x0A1C6EE3
143. Re:Easy! by sydneyfong · 2013-09-24 04:51 · Score: 1
  
  It reminds me of this joke (which I heard my father who's a physician)
  
  There was a chief physician at a renowned medical college who was said to always start the first round of the year for medical students by teaching them on the 'singular imporant principle of medicine'. He would begin by talking about diabetes mellitus: "Diabetes is a Greek name, but the Romans noticed that the bees like the urine of diabetics, so they added the word 'mellitus' which means sweet as honey. As you know, you may find sugar in the urine of a diabetic..."
  He then held up a fresh sample of urine just taken from a patient and held up like a trophy, with the students staring at the straw-colored fluid as if they've never seen such a thing before. The physician then suddenly dipped his finger boldly into the urine, and licked his finger with the tip of his tongue. As if tasting wine, he opened and closed his lips rapidly. Could he perhaps detect a faint taste of sugar?
  The sample was passed on for the students to try; they all dipped a finger into the fluid, and then licked their finger.
  "Now you have learned the first principle of diagnosis, I mean the power of observation" said the physician grinning. "You see," he continued triumphantly, "I dipped my MIDDLE finger into the urine, but licked my INDEX finger, not like all you."
  http://www.wydo.org/content/medicines-first-principle
  
  --
  Don't quote me on this.
144. Re:Easy! by Catbeller · 2013-09-25 03:47 · Score: 1
  
  "The idea is to get the phone, put some evidence on it, and THEN arrest you. :-)"
  Odd that few people notice this little loophole. Since the integrity of police is unassailable in court, the obvious trick for police, or any other malicious party, is to just toss some kiddie porn on the phone, alter the logs, and then "find" it and ruin your life. Or force you to give up someone else with truthful or perjured testimony. Or, say, give the man standing outside your car all your cash or you get dragged in. Oh, the fun they'll have!
  And how would we ever know people are being framed? Their complaints? This is a perfect way to take anyone down. Anytime. If it isn't being done yet - it will be.
If true by djupedal · 2013-09-22 07:01 · Score: 3, Funny

new iPhone owner's should get their money back. This was supposed to be updated tech that resisted decade's old spoofing.
1. Re:If true by Pinky's+Brain · 2013-09-22 07:11 · Score: 1
  
  Maybe the original authentec technology was just too bulky and form won over function?
2. Re:If true by Lehk228 · 2013-09-22 07:16 · Score: 5, Interesting
  
  fingerprint identification is fundamentally and irredeemably broken. no other authentication method leaves copies of itself all over the place.
  
  everything else is an arms race between verifying it is a finger and pretending to be a finger.
  
  --
  Snowden and Manning are heroes.
3. Re:If true by ewibble · 2013-09-22 08:14 · Score: 1
  
  What about DNA? (you would probably have to compromise the scanner, but you certainly leave it lying around) Facial recognition if you have cameras around. Frankly all biometrics are fundamentally flawed because once they are compromised you can't change them. Ok plastic surgery may be one way to change your face.
4. Re:If true by girlintraining · 2013-09-22 08:18 · Score: 2
  
  fingerprint identification is fundamentally and irredeemably broken. no other authentication method leaves copies of itself all over the place.
  Sigh. Biometrics can of course be defeated as long as the sensor is stupidly simple. And big surprise... a mass-produced mobile device built at the absolute lowest cost they can get away with... can be defeated. But biometrics was never meant to replace existing authentication measures, but to augment them. Three factor authentication is still the best way of securing a device, location, etc. One factor authentication like what's demonstrated here... is ... well ... not very smart.
  
  --
  #fuckbeta #iamslashdot #dicemustdie
5. Re:If true by gnupun · 2013-09-22 09:11 · Score: 1
  
  fingerprint identification is fundamentally and irredeemably broken. no other authentication method leaves copies of itself all over the place.
  
  So the people who designed TouchID are dumb or they simply don't care about security.
6. Re:If true by Lehk228 · 2013-09-22 10:38 · Score: 1
  
  as far as i know DNA is not being used anywhere for authentication, if it were, it would be almost as bad as fingerprints the only edge it would have is the large technological barrier to manipulating and duplicating it
  
  --
  Snowden and Manning are heroes.
7. Re:If true by narcc · 2013-09-22 10:42 · Score: 1
  
  Conspiracy time. Okay.
  So ... what would convince you? A few independent reproductions? Those could be faked the same way!
  Apple admitting that the hack works? Just PR to save face / get people to stop talking about it. It's really super secure like they said earlier!
  Trying the hack yourself? Perhaps you're in on the conspiracy as well -- and you don't even know it!
  
  --
  Required reading for internet skeptics
8. Re:If true by ewibble · 2013-09-22 11:16 · Score: 1
  
  You are probably right about DNA, the tests are probably too slow, and expensive to run right now. (falling fast http://singularityhub.com/2011/03/05/costs-of-dna-sequencing-falling-fast-look-at-these-graphs/) But other biometrics, Voice it's not inconceivable that you could record the password and play it back. Even generate the words of your choice with enough recording, maybe not now (I don't know) but it doesn't seem impossible (with low cost equipment). Retna scan well Ok maybe you need to shine a lazer into your eye (again I don't really know). But if it became common place would you really want to using the same eye to log into your porn site as your bank?
9. Re:If true by gagol · 2013-09-22 13:12 · Score: 2
  
  A security scheme that depends on a non-changeable password that you leave physical copies around everytime you touch something bare hand... what could go wrong?
  
  --
  Tomorrow is another day...
10. Re:If true by grantspassalan · 2013-09-22 15:19 · Score: 1
  
  This fingerprint authentication system was never intended to be a substitute for an 18 digit random character password. It is simply a convenience for the owner of an iPhone to be able to lock it and unlock it without even looking at the screen. Security and convenience have always been and will always be a trade-off. Apple designed this fingerprint scanner primarily for the convenience of the user, not as ironclad security against skilled hackers or the NSA.
  
  --
  A sufficiently advanced simulation is indistinguishable from reality.
Am I missing something? by TheRealMindChild · 2013-09-22 07:02 · Score: 1

Isn't this the same attack vector that can be used with any finger print scanner?

--

"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
1. Re:Am I missing something? by fuzzyfuzzyfungus · 2013-09-22 07:09 · Score: 4, Insightful
  
  Pre-release hype was that Insanely Great Magic Innovation or something used OMG capacitance to magically foil the classic attacks. I don't think that Apple was dumb enough to promise any such thing; but their drooling fans certainly did.
2. Re:Am I missing something? by Anonymous Coward · 2013-09-22 07:16 · Score: 2, Interesting
  
  Isn't this the same attack vector that can be used with any finger print scanner?
  There are a number of things to check to make sure that the fingerprint actually belongs to a human:
  - Pulse
  - Temperatur
  - Conductivity (probably worked around by moisturizing the printed fingerprint)
  But at the end of the day, fingerprints are just too easy to fake and not a good method of authentication.
3. Re:Am I missing something? by ShanghaiBill · 2013-09-22 07:30 · Score: 1
  
  Isn't this the same attack vector that can be used with any finger print scanner?
  No. Many modern fingerprint scanners check for a pulse, and/or detect subsurface structures that do not show up in a lifted print. Apple claimed that this scanner did both of these checks, but apparently they were lying, and it actually does neither.
4. Re:Am I missing something? by Desler · 2013-09-22 07:49 · Score: 5, Insightful
  
  Has anyone else verified that the suppose hack really does work? Isn't a bit premature to claim Apple is lying off a single youtube video?
5. Re: Am I missing something? by EGSonikku · 2013-09-22 07:51 · Score: 2
  
  Pattern lock is hardly secure considering they can see the smudge on your screen. And the NSA has said they can easily get into any Android device.
  TouchID is still harder to trick than that. It's meant to deter common thieves, not James Bond. If the government has your phone they can easily compel you to unlock it or use existing forensic tools combined with warrants to your cellular provider.
  
  --
  - "Scientia non habet inimicum nisp ignorantem"
6. Re:Am I missing something? by gtall · 2013-09-22 07:57 · Score: 1
  
  I thought I'd repeat what Desier said since there was no reason to piss on his karma:
  "Has anyone else verified that the suppose hack really does work? Isn't a bit premature to claim Apple is lying off a single youtube video?"
7. Re:Am I missing something? by tysonedwards · 2013-09-22 08:03 · Score: 1, Troll
  
  Yes, Apple has been confirmed lying due to a gelatin finger being able to program the TouchID sensor to begin with. No blood vessels, well below the temperature of a human body, and certainly no pulse.
  
  If their technology looked for these things, than a gelatin finger couldn't be used... ever.
  
  --
  Thirty four characters live here.
8. Re:Am I missing something? by frozentier · 2013-09-22 08:15 · Score: 1
  
  "Has anyone else verified that the suppose hack really does work? Isn't a bit premature to claim Apple is lying off a single youtube video?"
  No, but everyone is acting as if you can't fake a youtube video, so this claim must be enough for them.
9. Re: Am I missing something? by tysonedwards · 2013-09-22 09:13 · Score: 1
  
  Except previous to CCC's proof of concept, there were a number of videos of people programming non-fingers for TouchID, including solely a piece of gelatin, not a thin layer of anything sitting in front of a finger. While the gelatin mold was not reported as a match when compared to a person's true finger, it could be used to program he sensor as itself and re-auth successfully. Hence, Apple doesnt look for blood vessels, temperature or heart beat... Just capacitance.
  
  --
  Thirty four characters live here.
10. Re:Am I missing something? by shadowrat · 2013-09-22 09:44 · Score: 3, Informative
  
  Pre-release hype was that Insanely Great Magic Innovation or something used OMG capacitance to magically foil the classic attacks. I don't think that Apple was dumb enough to promise any such thing; but their drooling fans certainly did.
  i don't recall exactly what Tim Cook promised, but i think he was hyping the convenience over the robustness of protection. I think they claimed the advanced technology would enable it to respond quickly, and it provided more protection than no passcode. That seems in line with these findings.
11. Re:Am I missing something? by fuzzyfuzzyfungus · 2013-09-22 11:21 · Score: 1
  
  Yeah, Apple (sensibly) didn't overpromise anything; but the fan-press was talking about the thing like it was some fundamental reimagining of the concept of biometrics, which seems to have been what led to the interest in dusting off a mostly-not-news technique, tweaking it slightly, and shooting them down.
  
  Enterprise-focused stuff gets released with fingerprint readers all the time, and nobody cares enough to do a demo because there are no fanboys talking it up.
12. Re:Am I missing something? by mvdwege · 2013-09-22 16:58 · Score: 2
  
  Let me correct that for you: a youtube video endorsed by known experts in these kind of hacks. Versus lots of fanboi speculation on the superiority of Apple tech and vague marketing claims from Apple.
  
  --
  "I know I will be modded down for this": where's the option '-1, Asking for it'?
13. Re:Am I missing something? by deadweight · 2013-09-23 00:57 · Score: 1
  
  I bought an old surplus Thinkpad for my 12 year old. It uses a fingerprint scanner to log in. Big Fn Deal - this is an OLD idea that was hacked into oblivion years ago. It is cool for 7th graders though ;)
Re:It's all relative. by noh8rz10 · 2013-09-22 07:13 · Score: 1

Especially when 90% of pins are 0000, and 9% are 1234
More secure. by noh8rz10 · 2013-09-22 07:20 · Score: 3, Funny

Maybe the best use of touch Id is as a complement to a code. Something you know, something you have, something you are. They have 2 out of 3, and with their Siri they could add voice too. "My voice is my passport. Verify"
1. Re:More secure. by rthille · 2013-09-22 08:34 · Score: 1
  
  I don't know why they don't let you use the camera. I should be able to unlock my phone by holding it up so the camera can see my face. Maybe from a couple of angles, or a swipe around from one side to the other...
  
  --
  Awesome furniture, accessories and cabinetry in Santa Rosa, CA: http://humanity-home.com/
2. Re:More secure. by green1 · 2013-09-22 09:51 · Score: 5, Insightful
  
  You mean like the android face unlock that can be defeated by a photo of the user? (at least you don't leave your photo on the glass surface of the phone when you put it down...)
  Let's face it though, unless companies are willing to spend a fair amount more on these biometric sensors, they'll always be trivial to hack, there are good fingerprint readers (that actually don't use the prints, but subdermal tissue) but they cost a lot more than the ones taht are defeated in such trivial ways..
  I'm still looking for the retraction from all those people who posted to the original fingerprint reader on iphone thread last week saying this wasn't a simple fingerprint reader on the iphones and wouldn't be susceptible to this form of attack...
3. Re:More secure. by noh8rz10 · 2013-09-22 10:05 · Score: 1
  
  Let's face it though, unless companies are willing to spend a fair amount more on these biometric sensors, they'll always be trivial to hack
  ok, but how about hacking 1) 4 digit code 2) fingerprint 3) photo 4) voice recognition? that's pretty secure.
4. Re:More secure. by green1 · 2013-09-22 10:53 · Score: 2
  
  it's relatively secure, and completely unreasonable to expect someone to use every time they access the phone.
  The nice part about the fingerprint scanner isn't the security offered (because we've just seen that it isn't that secure) it's the convenience of not having to enter a pin every time you use the device while still retaining some small measure of security. But then again, Apple is (to my knowledge) only the second major cell phone manufacturer to implement this technology, so it may improve with time.
  This is targetted as a way to get people to use some form of security instead of none. And the best way to do that is to make the security as unobtrusive as possible. (even if not as secure as more intrusive methods)
5. Re: More secure. by GrahamJ · 2013-09-22 12:17 · Score: 2
  
  The iPhone one does use sub dermal tissue scanning.
6. Re: More secure. by green1 · 2013-09-22 13:23 · Score: 4, Insightful
  
  well so far we have a marketing droid saying it does, and a documented hack proving otherwise. If you have better proof I'd suggest you post it because right now your case is pretty weak.
7. Re: More secure. by green1 · 2013-09-22 13:27 · Score: 1
  
  except that, just like the fingerprint scanner on the iphone, the face unlock feature on android has also been hacked. I don't remember the details, maybe they had a way to fake the blink? Biometric authentication is either cheap and inefective, or expensive and... somewhat effective... there are no cheap and effective biometrics yet. That may change, but we just aren't there yet.
8. Re:More secure. by rthille · 2013-09-22 14:37 · Score: 1
  
  No, not just a photo, but rather a video/series of photos from different angles, so you'd need a fairly realistic 3-D bust of the person's face.
  
  --
  Awesome furniture, accessories and cabinetry in Santa Rosa, CA: http://humanity-home.com/
9. Re:More secure. by rthille · 2013-09-22 14:40 · Score: 2
  
  Also, the phone could use the accelerometer to determine it's movement and compare it to the expected change in photos given the 3D model of your face stored in the phone.
  
  --
  Awesome furniture, accessories and cabinetry in Santa Rosa, CA: http://humanity-home.com/
10. Re:More secure. by petsounds · 2013-09-22 16:23 · Score: 2
  
  Apple specifically claims their reader IS of the subdermal variety, so I was quite to see this tactic be successful. Hard to believe they would outright lie about that part, as it would be blatant false advertising.
11. Re:More secure. by monzie · 2013-09-22 20:21 · Score: 2
  
  subdermal != foolproof. As has been deomnstrated by CCC now. In fact, it has been repeatedly demonstrated ( by CCC and others ) that we should stop relying on fingerprints ti uniquely identfy an individual. If we do continue to do this - we only make our own identity more vulnerable to theft.
12. Re: More secure. by GrahamJ · 2013-09-23 02:57 · Score: 1
  
  Sub dermal scanning doesn't mean what you think it means. It doesn't mean it scans blood vessels or anything other than the print pattern itself, only that it can get below the surface to see the print even if it's damaged or dirty (and that's what the marketing droids said). If you provide it a clean print as this hack does, the fact that it can "see" below dirt and damage doesn't come into play.
13. Re:More secure. by slash.jit · 2013-09-23 07:38 · Score: 1
  
  They would have to put a flash in front if it has to work in dark
14. Re:More secure. by DMUTPeregrine · 2013-09-23 12:41 · Score: 1
  
  Fingerprints (and other biometrics) can't be changed. They're a terrible replacement for passwords, but a reasonable replacement for usernames.
  
  --
  Not a sentence!
15. Re:More secure. by green1 · 2013-09-24 05:25 · Score: 1
  
  Face Unlock on Android has been hacked with a photo. If you're talking about how it should be done, that's a different matter. Of course the more angles it needs, or the more faces you have to make (blink, smile, frown, whatever) to make it work, the more difficult it is to use, and the less likely people will bother, especially when it sounds like it's not much more secure (or maybe less so) then a PIN to start with (and therefore must also be much easier/quicker to use to justify the lower security)
16. Re:More secure. by rthille · 2013-09-24 07:11 · Score: 1
  
  Yeah, or turn the screen bright white... but the software would have to 'work harder' (and probably make it less secure) with wildly variable lighting.
  
  --
  Awesome furniture, accessories and cabinetry in Santa Rosa, CA: http://humanity-home.com/
Risk to Security Algorithm by retroworks · 2013-09-22 07:23 · Score: 3, Interesting

Interesting. We do have to remind ourselves that security needs to be proportionate to risk. The first rule is value, or what the potential for loss is. I want a really really difficult password for my credit card account, I get angry when a newspaper login requests the same password algorithm (how much should I care if someone reads the news site using my login account?) The second factor is proximity. If you steal the president's laptop from off the president's desk, you should face unheard of security. If the president's digital needle lies anonymously at the bottom of a city haystack, the statistical risk shrinks. The fingerprint app, like Android's code generator, seems like an appropriate level of security for a lost or stolen cell phone.

--
Gently reply
1. Re:Risk to Security Algorithm by je+ne+sais+quoi · 2013-09-22 07:44 · Score: 2
  
  We do have to remind ourselves that security needs to be proportionate to risk.
  Exactly. You can make your phone the most secure thing in the world, requiring a randomized string of alphanumerics umpteen characters long that you recite from memory, but you've also made it utterly impractical to use.
  
  One thing I noticed about this method is that they didn't get their fingerprints from the iphone itself, on the site they got them from a glass bottle. There's a lot of residue from fingerprints on my screen and a lot of potential fingerprints, but some of them are smudged from where I moved my finger, but I'd like to see if someone can use prints from an actual phone, everything else requires that the attacker have physical access to places you've been, but by far the most likely scenario where this will be useful will be to keep people out if I leave my phone somewhere unintentionally.
  
  --
  Gentlemen! You can't fight in here, this is the war room!
So, don't use the same finger for by The+Cisco+Kid · 2013-09-22 07:25 · Score: 3, Interesting

the security sender that you use for the touchscreen..
How hard is that?
In fact I'm surprised that wouldn't already be part of the advice for users of this.
Either that or require a swipe from two different fingers, in a specified order.
1. Re:So, don't use the same finger for by Above · 2013-09-22 07:39 · Score: 1
  
  I bet most people unlock with a thumb, but use an index finger on the screen.
2. Re:So, don't use the same finger for by Misagon · 2013-09-22 07:49 · Score: 1
  
  I bet that most people type with both thumbs in landscape mode.
  
  --
  "We mustn't be caught by surprise by our own advancing technology" -- Aldous Huxley
3. Re:So, don't use the same finger for by xombo · 2013-09-22 07:52 · Score: 1
  
  You can pick up the thumb from other sources.
4. Re:So, don't use the same finger for by Intrepid+imaginaut · 2013-09-22 08:26 · Score: 1
  
  The real problem is that they're holding it wrong.
5. Re:So, don't use the same finger for by lgftsa · 2013-09-22 09:30 · Score: 2
  
  eBay?
6. Re:So, don't use the same finger for by quacking+duck · 2013-09-22 10:28 · Score: 1
  
  I bet most people unlock with a thumb, but use an index finger on the screen.
  While true, one of the supposed reasons/excuses the iPhone screen remains that small is one-handed operation, i.e. when held normally by an adult with average-sized hands, their thumb can extend and reach almost every part of the touchscreen.
7. Re:So, don't use the same finger for by EnsilZah · 2013-09-22 11:29 · Score: 1
  
  I bet by the time Microsoft copies this for their phone they'll require three fingers.
  They could call it the Three Finger Salute.
8. Re:So, don't use the same finger for by RussR42 · 2013-09-22 19:44 · Score: 1
  
  You want a thumb? I can get you a thumb, believe me. There are ways, Dude. You don't wanna know about it, believe me. Hell, I can get you a thumb by 3 o'clock this afternoon... with nail polish. These fucking amateurs...
I have a solution! by Anonymous Coward · 2013-09-22 07:25 · Score: 5, Funny

Instead of using a fingerprint, use a Nipple print!
Re:Time? by EmagGeek · 2013-09-22 07:26 · Score: 1

You can only remote-wipe the phone if the phone is on a network that allows it to phone home.
Hype? For a new product? No way!!! by Kohath · 2013-09-22 07:28 · Score: 2

New products are never hyped. That would be dishonest. Gadget slogans are all like:
- "We like it well enough, but you should make up your own mind."
- "We tried to improve it over last year's model. We think we succeeded -- at least partially."
- "It has some benefits for some people. It has some drawbacks for some other people. Be careful buying it to make sure it's good for you."
It's the new Internet-forum-approved marketing trend! Internet forum whining and moralizing about dubious gadget hype finally won everyone over!
social engineering time by Jeremy+Erwin · 2013-09-22 07:30 · Score: 5, Funny

You know what? I really love the sound of your voice. ... And there's this one word. I've always loved the sound of this word. ... I would really like to hear you say the word ..."passport".
1. Re:social engineering time by iluvcapra · 2013-09-22 07:50 · Score: 1
  
  "Shall I phone you or nudge you?"
  
  --
  Don't blame me, I voted for Baltar.
2. Re:social engineering time by Starteck81 · 2013-09-22 08:17 · Score: 1
  
  You know what? I really love the sound of your voice. ... And there's this one word. I've always loved the sound of this word. ... I would really like to hear you say the word ..."passport".
  Hi, my name is Werner Brandes. My voice is my passport. Verify Me.
  
  --
  "There are four boxes to be used in defense of liberty: soap, ballot, jury, and ammo. Please use in that order." -Ed H
3. Re:social engineering time by brainproxy · 2013-09-22 11:47 · Score: 1
  
  Cootys Rat-Semen
4. Re:social engineering time by slash.jit · 2013-09-23 07:38 · Score: 1
  
  Siri: I would need some more information to verify it is really you. Please provide your date of birth and last 4 digits of your SSN number.
Re:It's all relative. by Kohath · 2013-09-22 07:30 · Score: 1

Because no one could ever guess a pin from fingerprint smears on a phone surface.
Easier for law enforcement by AaronW · 2013-09-22 07:33 · Score: 1

I'm sure law enforcement loves this. While they may not be able to force someone to give up their password, getting a fingerprint is easy.

--
This post is encrypted twice with ROT-13. Documenting or attempting to crack this encryption is illegal.
1. Re:Easier for law enforcement by xeio87 · 2013-09-22 07:52 · Score: 1
  
  If you think it's at all difficult to break a 4 digit pin code I hope you don't leave evidence on your phone.
  But we all use 12+ character alphanumeric passwords for our phones right...?
2. Re:Easier for law enforcement by Desler · 2013-09-22 07:54 · Score: 2
  
  You realize that law enforcement can already gain access to a password locked phone already, right? Why would they bother with recreating a latex fingerprint over just using the software they already have to unlock them?
So what they proved is... by NoKaOi · 2013-09-22 07:34 · Score: 4, Funny

...the iPhone's fingerprint scanner works well. I was expecting it to be a gimmick that would give more false negatives or false positives than real results. That these guys had to use the same methods they would use for a high-quality expensive fingerprint scanner, and that those methods actually worked, tells me the iPhone's fingerprint scanner has potential.
Re:It's all relative. by Zero__Kelvin · 2013-09-22 07:35 · Score: 1

How much effort do you think it takes to try to enter a PIN up to 1000 times?

--
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
So what? by lennier1 · 2013-09-22 07:36 · Score: 1

Sounds like the standard procedure to fake consumer-grade readers.
Re:Different fingers by 93+Escort+Wagon · 2013-09-22 07:39 · Score: 2

I wondered that as well. It would have been more conclusive if he'd had a second person come in and use the fake to unlock the phone.

--
#DeleteChrome
Not exactly new by TejWC · 2013-09-22 07:40 · Score: 4, Insightful

I remember Mythbusters doing something similar with a multi thousand dollar computer secruity system.
1. Re:Not exactly new by Jason+Levine · 2013-09-22 09:03 · Score: 2
  
  So seven years ago, the Mythbusters defeated a high end alarm system using simple techniques. Now you can buy a smartphone for much less that contains that technology - still able to be defeated by the same methods. The march of technology!
  
  --
  My sci-fi novel, Ghost Thief, is now available from Amazon.com.
Re:Different fingers by Anonymous Coward · 2013-09-22 07:42 · Score: 1

Even that wouldn't have proven anything, since you can program in as many fingerprints as you wish into the phone. They need to demonstrate that the finger with the "fake" fingerprint (or whatever they use to hold the fake fingerprint to the sensor) won't unlock the phone on its own.
Gee by msobkow · 2013-09-22 07:43 · Score: 3, Funny

Something you leave lying around on everything you touch is a poor key for security.
Who'd a thunk it?

--
I do not fail; I succeed at finding out what does not work.
1. Re:Gee by Desler · 2013-09-22 07:55 · Score: 1
  
  It's far better than the people who don't even set a 4 digit pin.
Fingerprint scanners are rarely secure by ThunderBird89 · 2013-09-22 07:44 · Score: 2

Surprise, surprise. Fingerprint identification is rarely secure, some implementations can even be tricked using gummy bears. Really secure ones usually have rather steep costs and bulky supporting hardware associated (usually to check for blood flow to ensure the finger is a live one). Anything in a laptop or smartphone has no chance at real security whatsoever.
But guess what? This probably wasn't an exercise in security, but ease-of-use: being able to unlock your phone with a touch is easier than slide-to-unlock or passcodes. And it was a good exercise (not to mention fun when it was discovered that the software can even interpret a cat's pawprint). It was successful. So what if it can be broken easily, almost all of fingerprinting is the same.

--
Hyperbole: I use it liberally!
1. Re:Fingerprint scanners are rarely secure by __aaltlg1547 · 2013-09-22 08:14 · Score: 1
  
  Surprise, surprise. Fingerprint identification is rarely secure, some implementations can even be tricked using gummy bears.
  
  Well, sure, but gummy bears are like R2D2 made out of sugar.
using common household materials by xombo · 2013-09-22 07:44 · Score: 1

Am I the only person these days without a slide printer? Jeez.
Re:Different fingers by Zero__Kelvin · 2013-09-22 07:49 · Score: 5, Insightful

No. It wouldn't matter. No matter what they did there would always be the next thing they could have just done. How do we know that the phone wasn't programmed to unlock with the second guys fingerprint? How do we know they didn't edit the video? etc, ad infinitum. What makes it highly believable is none of that. It is the reputation of the Chaos Computer Club that makes it believable. They aren't about to sacrifice a reputation it took them more than 30 years to build, especially for essentially no gain. If it was an unknown group I'd say maybe they are looking for 15 minutes of fame. But this is the CCC we are talking about here.

--
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Re:It's all relative. by Desler · 2013-09-22 07:51 · Score: 1

About 2 minutes with physical access.
Re:Hype? For a new product? No way!!! by Nerdfest · 2013-09-22 07:52 · Score: 1

Not for Apple. Your list doesn't contain any of the following: amazing, insanely, or magical.
Re:It's all relative. by Zero__Kelvin · 2013-09-22 07:55 · Score: 1

Think again, and consider learning to read maybe:

FTA:

" I’ve clarified two aspects of this story below. First, Micro Systemation’s XRY tool often requires more than two minutes to crack the iPhone’s password. The two minutes I originally cited were a reference to the time shown in the video (now removed by Micro Systemation) below. Given that, as I originally wrote, the phone in the video used the simplest possible password (0000), the process often takes far longer." - Emphasis Added

--
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
You're missing the point. by EGSonikku · 2013-09-22 07:59 · Score: 5, Insightful

Fingerprints are good because they replace ZERO security. Most people don't PIN lock their phones. Finger Print lock is too convenient not to use.
It is meant as a deterrent to common thieves, and works well as such. A robber isn't going to grab your phone, ask for a nice clear print, and then run home to his laser printer and latex (and you could remote wipe the device in the mean time anyway).
If its the government you're worried about...well, if they have physical access to your device they probably have you in custody and can compel you to unlock it anyway, or just use existing forensic tools and warrants to get what they want. Even then we're talking about the unlikely scenario of you being arrested and having anything more interesting on your phone than funny cat pictures.
I'm trying to imagine a "real world" scenario where TouchID is less secure than a 4 digit passcode or no security at all...and I got nothing.

--
- "Scientia non habet inimicum nisp ignorantem"
1. Re:You're missing the point. by jones_supa · 2013-09-22 08:28 · Score: 5, Insightful
  
  Fingerprints are good because they replace ZERO security.
  Mod parent up. So often geeks think that if they can find some fancy way to overcome a security feature, it somehow automatically makes it completely useless.
2. Re:You're missing the point. by AmiMoJo · 2013-09-22 08:58 · Score: 2
  
  For a casual user what you say is mostly correct, but that isn't how it was marketed. They claimed it was some kind of super sensor that required a pulse and was immune to simple copying methods. Claimed you could rely on it for security.
  If they had just been honest from the start it would have been fine.
  I'm trying to imagine a "real world" scenario where TouchID is less secure than a 4 digit passcode or no security at all...and I got nothing.
  Anyone who might be targeted, say a business user with potentially valuable information on their phone, would be better off with a pass code. A code is easy to obscure when entering it, fingerprints are basically impossible to protect unless you carefully wipe everything you touch down or wear gloves all the time.
  
  --
  const int one = 65536; (Silvermoon, Texture.cs)
  SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
3. Re:You're missing the point. by Anonymous Coward · 2013-09-22 10:31 · Score: 1, Insightful
  
  but...that IS EXACTLY how they marketed it...they said "half of the users of smartphones don't even set a passcode" and also Schiller said "for somebody who opens his phone dozens of times a day this is a game changer" meaning it increases productivity for business users. they never said it was a good solution for al-qaeda operatives and drug traffickers.
4. Re:You're missing the point. by narcc · 2013-09-22 11:01 · Score: 1
  
  Most folks have zero worry about our "shadow" government arresting them
  Exactly, most of us figured out years ago that the NWO shadow government are mere puppets controlled by the lizard men in the hollow earth. That's who they, and Apple, really fear.
  They're the reason that TouchID was hacked so easily. The version Apple though they were manufacturing was secretly replaced while in transit. They're all a bunch of Android fanboys, after all.
  
  --
  Required reading for internet skeptics
5. Re:You're missing the point. by Overzeetop · 2013-09-22 11:26 · Score: 3, Funny
  
  Well, some lucky kid *didn't* lock the android phone that fell out of his pocket while rip-roaring drunk, so that when I picked it up off the side of the road I could get in and send him an email that I'd found it. Sure, I could have just popped the SIM and sent it back to Verizon, but it would have taken weeks or days, not 2 hours, for the guy to get his phone back.
  I don't PIN lock my phone because I'm lazy, I do it so my family can use my phone easily. I definitely wouldn't use the fingerprint recognition if I had it.
  
  --
  Is it just my observation, or are there way too many stupid people in the world?
6. Re:You're missing the point. by tgibbs · 2013-09-22 11:50 · Score: 1
  
  Yes, I currently don't use a passcode at all, because it is too inconvenient. So I'm not particularly concerned with whether the fingerprint sensor can be broken by somebody who has managed to get hold of my fingerprint and go through the rather elaborate process described--it's still going to be better than no security at all.
7. Re:You're missing the point. by greggman · 2013-09-22 12:57 · Score: 1
  
  And you're also missing the point. The point is it's a false sense of security. Steal the phone, pull the prints off the phone, unlock the phone, start stealing accounts/data. The user thinks his phone is secure but it's not. False security is worse than no security because it makes the user falsely think he's secure and so he's likely to act less cautiously. Where as if he doesn't secure his phone at least he knows he didn't secure it.
8. Re: You're missing the point. by GrahamJ · 2013-09-22 12:59 · Score: 1
  
  If it was an iPhone you could have just waited for him to show up at your door.
9. Re: You're missing the point. by GrahamJ · 2013-09-22 13:02 · Score: 1
  
  They claimed that it is a capacitive sensor that can see below the outer dermal layers, avoiding problems like cuts and dirt. And that claim is correct.
10. Re:You're missing the point. by Above · 2013-09-22 13:35 · Score: 1
  
  Correct. This is sort of like doing a review of an ordinary home door lock, smashing it with a police battering ram, and then declaring it useless.
  The TouchID sensor is there to make things convenient enough that those who do not use a pass code now will use one. That's actually a huge leap forward, since it means a casual thief can't quickly get into your e-mail or contacts before ditching the phone. All it really has to do is slow someone down enough that you have time to get to a computer, invoke find my iphone, and remote lock it or even remote wipe it so people don't get your data.
11. Re:You're missing the point. by mjhans · 2013-09-22 14:40 · Score: 1
  
  Obligatory xkcd: http://xkcd.com/538/
12. Re:You're missing the point. by Just+Some+Guy · 2013-09-22 16:27 · Score: 4, Insightful
  
  And for power users, fingerprint plus passcode is more secure than just one or the other. I'd love to see a setting like "require both fingerprint and passcode to initially unlock the phone. Lock the phone immediately when it goes to sleep, but allow it to be unlocked with either passcode or fingerprint for up to five minutes."
  I'd set this in a heartbeat. Basically, it'd be more secure than any current options when initially unlocking the phone. It'd also be more convenient than the "require a passcode immediately when the phone goes to sleep" setting, and more secure than the "don't require a password for the next x minutes" settings. This is how I'd like the system to work.
  
  --
  Dewey, what part of this looks like authorities should be involved?
13. Re:You're missing the point. by swillden · 2013-09-22 16:28 · Score: 2
  
  Fingerprints are good because they replace ZERO security. Most people don't PIN lock their phones. Finger Print lock is too convenient not to use.
  This is correct.
  I've been explaining on /. (and elsewhere) for years that fingerprint authentication is useless except in high-security applications where someone validates the scan is done properly... but that it's highly useful for identification applications, where all you need is a very low assurance that the person being scanned is who they appear to be.
  The key is to make sure that users understand that the fingerprint scanner is a security upgrade for those who would use NO security, but significantly less secure than using a passcode. So people who would use a passcode should probably continue. People who just swipe to unlock should consider using the fingerprint scanner.
  
  --
  Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
14. Re:You're missing the point. by bingoUV · 2013-09-22 17:27 · Score: 1
  
  Well, I used to not enable pin/pattern/password security on my phone because of the high hassle to security ratio, for an admittedly less sensitive device. Motorola Atrix 4G's fingerprint feature made me use it for the low hassle to security ratio.
  The "fancy"ness of the security system lies in hassle to security ratio. Whether it is used or not depends on sensitivity of the item. E.g. a very good security feature on my burger where no one but I can eat it may not get used, even though it is trivial to use and incredibly secure. For industrial security, one is ready to tolerate quite a bit of hassle for some real security. Most consumer level electronic items lie somewhere in between.
  
  --
  Bingo Dictionary - Pragmatist, n. A myopic idealist.
15. Re:You're missing the point. by HnT · 2013-09-22 22:14 · Score: 1
  
  Well, wouldn't they have lots and lots of your prints ALL over the iPhone?
  
  --
  "Only one thing is impossible for God: To find any sense in any copyright law on the planet." - Mark Twain
16. Re:You're missing the point. by Threni · 2013-09-22 23:45 · Score: 1
  
  Can't you use a pattern? Almost as easy as a swipe, and better than nothing.
17. Re:You're missing the point. by Threni · 2013-09-22 23:55 · Score: 1
  
  > This is sort of like doing a review of an ordinary home door lock, smashing it with a
  > police battering ram, and then declaring it useless.
  That's a rather bad analogy. (Although this IS slashdot, where low quality analogies go to die).
  It's like reviewing a door lock where the lock can never be changed, even if you know that someone else has your key, and where you leave copies of your key everywhere everyday which can be trivially recovered by anyone with the motivation, a little time and basic resources.
18. Re:You're missing the point. by jittles · 2013-09-23 02:10 · Score: 1
  
  Fingerprints are good because they replace ZERO security. Most people don't PIN lock their phones. Finger Print lock is too convenient not to use.
  It is meant as a deterrent to common thieves, and works well as such. A robber isn't going to grab your phone, ask for a nice clear print, and then run home to his laser printer and latex (and you could remote wipe the device in the mean time anyway).
  If its the government you're worried about...well, if they have physical access to your device they probably have you in custody and can compel you to unlock it anyway, or just use existing forensic tools and warrants to get what they want. Even then we're talking about the unlikely scenario of you being arrested and having anything more interesting on your phone than funny cat pictures.
  I'm trying to imagine a "real world" scenario where TouchID is less secure than a 4 digit passcode or no security at all...and I got nothing.
  The biggest problem is that my wife will no longer be able to unlock my phone and use it whenever she wants. Of course, blow-up dolls have trouble using capacitive touchscreens to begin with...
Blah blah blah... by doggo · 2013-09-22 08:06 · Score: 3, Insightful

Sure they can break it. If they have your fingerprint to photograph. Assuming this is a lost or robbed phone, where will they get your fingerprint? From the phone? Maybe. Maybe not.
Apple's solution is good enough for civilian security on a phone, as long as you're not oblivious and pay attention to your surroundings while walking in unfamiliar areas so you don't get mugged, and don't lose phones regularly, or store very sensitive information on your phone.
Oh good... by rkww · 2013-09-22 08:07 · Score: 4, Funny

Oh good, now I can make a back-up fingerprint in case I lose my finger...
Re:So what? by ceoyoyo · 2013-09-22 08:09 · Score: 1

Phones aren't a good defense against a targeted or determined attacker. If I really want to know what's on yours, I'll steal it and read the flash chips.
Simpler strategy by __aaltlg1547 · 2013-09-22 08:10 · Score: 2

Lift the fingerprint from the touch sensor of your iPhone. There's no need to have another source for the fingerprint.
1. Re:Simpler strategy by Golden_Rider · 2013-09-22 09:01 · Score: 1
  
  Lift the fingerprint from the touch sensor of your iPhone. There's no need to have another source for the fingerprint.
  Actually true. The usual fingerprint sensors (the small sensor you swipe your finger over) were "safer" in that regard - on the iphone sensor, you can get the fingerprint you need right where you will use it: on the sensor. Still, considering you could also get the same fingerprint from all over the rest of the phone, it's not really a huge security hole.
2. Re:Simpler strategy by tgibbs · 2013-09-22 11:54 · Score: 1
  
  My phone is covered with overlapping, often smeared, fingerprints. I'm sure than an expert could isolate a good copy, but it wouldn't be a trivial task.
3. Re:Simpler strategy by __aaltlg1547 · 2013-09-22 12:09 · Score: 2
  
  No, but it neatly identifies which fingerprint to use.
Re:It's all relative. by LynnwoodRooster · 2013-09-22 08:15 · Score: 1

Approximately one order of magnitude more effort than your estimate... ;)

--
Browsing at +1 - no ACs, I ignore their posts. So refreshing!
Re:It's all relative. by Zero__Kelvin · 2013-09-22 08:22 · Score: 1

Oops. I missed a zero there. Ironic given my SlashID I suppose ;-)

--
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Re:Use the other less popular limb by frozentier · 2013-09-22 08:24 · Score: 1

Fingerprints are left behind all the time so it would be trivial for someone to obtain.
That depends on the situation. If you find a phone lying on a bus seat and decide you're keeping it, then unless you lift the print from the phone itself you are just shit out of luck. If you don't even know who the phone belongs to, you're not going to be able to get a print. Also if you steal a phone, say out of a woman's open purse, you aren't going to be able to get prints from anywhere other than the phone, either. What are you going to do, find out where she lives, break into her house, find a dirty glass and lift a print from it? It's not like people are going to keep government secrets on their phone. If you do, you're dumb as a box of bricks. Phone security is there to keep credit card numbers from casual thieves in the event that you lose your phone. If the cops or the government have you in custody and are trying to get into your phone, you've got much bigger things to worry about.
Re:Different fingers by 93+Escort+Wagon · 2013-09-22 08:49 · Score: 1

I don't have a 5S - can it be easily shown that there are no fingerprints stored in it yet? If so, I'd think one could fairly convincingly demonstrate, using two people, that this exploit works.

--
#DeleteChrome
Re:Different fingers by Zero__Kelvin · 2013-09-22 09:11 · Score: 1

I take it you don't know anything about Apple or the CCC.

--
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Re:Not to mention the NSA... by Anonymous Coward · 2013-09-22 09:12 · Score: 1

I believe fingerprint hashes as read by TouchID and the likes are rather far from an actual fingerprint, not to mention that your fingerprints are not very useful to NSA and would be much easier to obtain through other means, more direct and closer to government - e.g., driver licenses require your finger prints in some states.
But, hey, gotta have an obligatory NSA conspiracy comment up here, right?
The CCC have history with over hyped biometrics by M0HCN · 2013-09-22 09:18 · Score: 2

As the German interior minister Wolfgang Schäuble discovered in 2008 when he got all hot for biometric ID cards, the CCC lifted his prints and published the required data as well as a latex print in a little bag in the magazine... The idea went away.
I would be inclined to believe the CCC in this matter, they have form for calling out over hyped biometrics.
Regards, Dan.
More work than the other way by Anonymous Coward · 2013-09-22 09:21 · Score: 1

About 5 years ago, a group of teens in an Australian school defeated a fingerprint login scanner. There were scanners at each computer in the class, and fingerprints were used to take attendance. Gummy bear applied to finger, flipped over, placed over reader. School staff knew things were wrong when 30 students were logged in, but only 6 were there.
Phone and drink? by internet-redstar · 2013-09-22 09:36 · Score: 1

Lifting fingerprints of glasses is easy. Maybe even directly of the glass of the phone itself. Yet a glass in a bar might be even better... So now they are going to steal BOTH the phone AND the drink?
Duh... by Lumpy · 2013-09-22 09:45 · Score: 2

All fingerprint scanners are utter failures. Anyone that has dealt with them for the past 5 years has known this.
The fingerprint system in it is to keep friends from grabbing your phone and posting photos of their junk as you.

--
Do not look at laser with remaining good eye.
Re: Different fingers by Zero__Kelvin · 2013-09-22 09:48 · Score: 1

No. Not the who. The beatles.

--
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Re:Different fingers by ColdWetDog · 2013-09-22 09:58 · Score: 1

How do you know it was the Chaos Computer Club, eh?

--
Faster! Faster! Faster would be better!
Re:Different fingers by Anonymous Coward · 2013-09-22 10:26 · Score: 1

His vision of Apple is warped by years of die-hard fanboyism. Pay him no mind. No one actually takes BasilBrush seriously when it has to do with Apple anymore.
Re:Different fingers by Zero__Kelvin · 2013-09-22 10:26 · Score: 2

It's on their website. I also don't question if Apple really is the one that sells the .

--
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Re:Different fingers by quacking+duck · 2013-09-22 10:39 · Score: 1

No. It wouldn't matter. No matter what they did there would always be the next thing they could have just done. How do we know that the phone wasn't programmed to unlock with the second guys fingerprint? How do we know they didn't edit the video? etc, ad infinitum. What makes it highly believable is none of that. It is the reputation of the Chaos Computer Club that makes it believable. They aren't about to sacrifice a reputation it took them more than 30 years to build, especially for essentially no gain. If it was an unknown group I'd say maybe they are looking for 15 minutes of fame. But this is the CCC we are talking about here.
A nice and convincing argument. I've said something similar about the "faked" moon landings: never mind all the science-y explanations, if the Soviet Union didn't raise all hell and denounce the USA for faking the landings, then the landings were not faked by the USA.
Re:Different fingers by Zero__Kelvin · 2013-09-22 10:46 · Score: 1

There is actually not a single similarity in your argument. The most glaring difference being the fact that the CCC and Apple are in no manner way shape or form in any kind of competition. They aren't adversaries. Never have been. Never will be.

--
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Re:Different fingers by quacking+duck · 2013-09-22 11:29 · Score: 1

It seems you missed that I was supporting your argument with an analogy, which of course isn't exact.
1) no matter what evidence is given, the disbelievers will demand more proof that it wasn't faked, "ad infinitum."
2) Irrespective of all other evidence, the reputation of the challenger (no need to be a market competitor) is all the supporting evidence needed.
The difference obviously is that the CCC's reputation bolsters their actions/claims, whereas the reputation of the USSR as the USA's chief adversary and the circumstances of the Cold War bolsters their inaction and lack of claim.
Re:You're missing the point (and so are you) by tgibbs · 2013-09-22 11:53 · Score: 1

I'd certainly like some more security on my iPhone, but not so much that I'm willing to type in a code every time I pull it out. I'll certainly use the fingerprint sensor.
Re:Different fingers by Zero__Kelvin · 2013-09-22 12:14 · Score: 1

"It seems you missed that I was supporting your argument with an analogy, which of course isn't exact."
Well, I certainly wasn't sure if you were serious or facetious. Part of that may be that one rarely sees the kind of agreement you have exhibited on Slashdot ;-)

That being said, I truly don't see any real similarity. Adversary/Non-Adversary Didn't Speak Out/Spoke Out Science as Proof/Website as Proof. I think you would agree that there are some pretty glaring differences there. Your SlashID is low enough to know that on Slashdot such differences are likely to attract the trolls like little children thrown under a bridge, even though I accept that you had no attention of opening up that opportunity for them.

--
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Different fingers by pikine · 2013-09-22 12:19 · Score: 1

The guy in the video used his index finger for identification, and the middle finger for wearing the mold.

--
I once had a signature.
All of your prints belong to us... by Bearhouse · 2013-09-22 12:31 · Score: 1

Well, I'm surprised that the tinfoil-hatted aren't all over this one.
Serious point, what happens when big gov or a carefully crafted malware apps gets all iPhone users prints?
No device is 'secure', guys & gals by SternisheFan · 2013-09-22 12:39 · Score: 3, Insightful

About 2 years ago I had an 'Ask Slashdot' submission accepted, and I was asking the /. community about security on my android phone. My concerns were about 'forced Blue tooth hacks', WiFi security, etc. A couple hundred comments generated, most all of them very derisive of the possibility that these devices were not secure, except for one or two commenters who agreed that, yes, there are ways that the phone can be accessed. Today we know far more about the backdoors on all types of phones, computers, routers, NSA... etc. Then, it turns out, most all the commenters here were..., wrong, or at least 'ill-informed', shall I say?
I beleive I stated then that I'd heard you should never say anything in an email, text or voice call that you wouldn't want to be repeated back in an open courtroom. Today, to expect any perfect type of security from any form of electronic device would be quite a stupid thought, especially from any people who keep up on current events.
I take no joy here now in the fact that my suspicions of two years ago were all valid and vindicated. Having said that, fellow /.'ers, who had my 'karma' demoted back then because of my 'Ask Slashdot' submission, I just want to say here....
I told you so!
Time will tell by GrahamJ · 2013-09-22 12:55 · Score: 1

Let's hope your local iPhone thief takes longer to lift a print and fabricate a latex finger than it takes you to lock or wipe the phone with Find My Phone.
Re:Different fingers by smash · 2013-09-22 13:36 · Score: 1

Neat. We do of course recall that the iphone can be set up to recognise multiple fingers?

--
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
Keep things in perspective by KevinGilbert · 2013-09-22 13:39 · Score: 1

I think the article on TechCrunch provides much better perspective on this issue. http://m.techcrunch.com/2013/09/22/hackers-bypass-apples-touch-id-with-lifted-fingerprint/
1. Re:Keep things in perspective by mvdwege · 2013-09-22 17:06 · Score: 1
  
  Yeah, one that completely exonerates Apple, while making the CCC process seem complicated. Never mind that a large number of computer users have most of the tools to do this already, and that the rest of us can just go out and buy them right off the street.
  Nooo, as long as the article defends the honour of Apple, it's a better perspective. Right.
  
  --
  "I know I will be modded down for this": where's the option '-1, Asking for it'?
Re:It's all relative. by grantspassalan · 2013-09-22 15:26 · Score: 1

Using the last four digits of your girlfriend's phone number would be slightly better!

--
A sufficiently advanced simulation is indistinguishable from reality.
But getting hack to work is expensive. by MtViewGuy · 2013-09-22 15:28 · Score: 1

However, the process of getting the hack to work wasn't a cheap solution--the process to make it that far was a complicated and expensive process, far beyond the skills of most people. They're going to have to show how it works to Apple engineers to prove the process is repeatable.
Re:Different fingers by grantspassalan · 2013-09-22 15:42 · Score: 2

I do not think that Apple is too worried about this, because they did not intend to make this for ironclad security, but simply for convenience of the user. The fingerprint scanner however does have potential for higher security by having an application, such as the sign in for a bank to require two or three fingerprints in the correct order. That would take security several orders of magnitude higher than a easy to guess password.

--
A sufficiently advanced simulation is indistinguishable from reality.
total miss by Tom · 2013-09-22 20:39 · Score: 3, Insightful

Of course a fingerprint sensor can be fooled. It doesn't take a video to prove that the sky is blue, you know?
What everyone misses is two important points. These are the days I'm glad I got out of the security industry because quite frankly, while lots of people are brilliant at the technology, most people are complete failures at the psychology of security.
First, a lot of people have no lock at all on their iPhones today. None. You can pick it up, slide to unlock and you're in. The fingerprint sensor will prevent the casual attacker, especially the one who doesn't want you noticing your phone is missing (people leave their phones on their tables when going to the bathroom, something that puzzles me but it happens).
Second, even an attacker dedicated and knowledgable enough to get your prints from somewhere and then build a fake finger will be slowed down enough to give you time for things like noticing your phone is missing, doing a remote wipe or changing your passwords.
Third, everyone is crying that fingerprints aren't good for "casual security" like your phone and should be reserved for serious stuff. You fools got that exactly backwards. Because fingerprints are so easily faked, never, ever use them for anything serious. But for your phone, it's perfect. It's easy to use, you can't forget it, and it's unique enough that you don't have to worry about everyone else also having 1-2-3-4 as their super-secret password.
Security is never about perfection, it is always about having the adequate security for your purpose and threat scenario. For 99% of people, having a fingerprint sensor is good enough and so easy to use that contrary to all the "good" security (that nobody enables), it will actually get used.
So for all I care, the real-world-stupid geniuses can continue theoretical discussions about theoretical security that nobody really uses, while the real-world normal people have just been given something that will jump their security level up from basically nothing to at least something. That's a massive improvement.

--
Assorted stuff I do sometimes: Lemuria.org
The technology is broken by Kazoo+the+Clown · 2013-09-22 21:48 · Score: 1

Apple is going to end up killing off the fingerprint security industry singlehanded, just like they did handwriting recognition a few years back. It's another one of these technologies that sounds good at first, but in practice just doesn't quite hold up. Parents shouldn't use it to keep their kids out of their phone for example, because there are available fingerprints to acquire all over the house. http://pacsec.jp/psj06/psj06krissler-e.pdf
Psh.. amateurs by GrBear · 2013-09-23 01:42 · Score: 1

That's why I use my nipple instead.
http://kotaku.com/lock-your-new-iphone-with-nipples-apparently-1360743607
Use it to our advantage by Catbeller · 2013-09-23 03:20 · Score: 1

Make a fake print. Or use someone else's print.
Use it to authenticate your iPhone.
Imagine the fun questions you can ask if someone shows up to ask about your fake print. Like, how do you know, and how do you have my actual prints...
Fun!
Combination by phorm · 2013-09-23 05:53 · Score: 1

I was thinking the same thing. Basically
a) Have a master backup in case the regular passcode fails
b) Require a regular passcode+fingerprint
With both the above, (b) defeats your average thief who is likely just going to shoulder-surf your password, while also defeating those who might reproduce your thumbprint but don't have the matching passcode
(a) is needed in case something goes wrong with the fingerprint, but won't be entered in normal situations so is less vulnerable to shoulder-surfing.
Any lock is better than none by thehumble1 · 2013-09-23 06:14 · Score: 1

Apple still gets points because their position is correct: if this makes 20% more people put an actual lock on their phone, it's a win for everyone. This isn't about how you can possible get around it, it's about the fact that 40-60% of phones have no security on them and let you go straight to sensitive information, just like carrying your filing cabinet around with you unlocked and small enough to be forgotten anywhere. Any lock is better than no lock and the reality is that 99.9% of the time that these fingerprint locks are found on a "found" or stolen phone, the person finding the phone isn't going to get through the security. By making the lock a high-visibility feature of the 5s it increases the percentage of phones that are going to be secured . . . probably. . . okay, possibly.
Solution by slash.jit · 2013-09-23 07:26 · Score: 1

Solution is very simple.. Instead of just swiping one finger use can swipe multiple fingers in a pattern and that would be the password. So to unlock users would have to swipe the fingers in the same patterns as the password.
So this will be like a password of fingerprints where each print would be a characters... oh wait.
Re:Different fingers by Richy_T · 2013-09-23 08:24 · Score: 1

Without the requirement that they be from the same person. So if you think they might be cheating with one person, they could just as easily cheat if you brought in another.
Unless you're suggesting that they trained it on this extra finger and then forgot. Which isn't beyond the realms of possibility but unlikely I would have thought.
Next Samsung Add by slash.jit · 2013-09-23 08:33 · Score: 1

Guy with 5S walking in streets
Thief: Give me your iPhone and wallet or I will shoot you
Guy: Here take it all and leave me alone
Thief: Shit! this is the one with fingerprint lock. Takes out his knife and says "Why so Serious?"
1. Re:Next Samsung Add by aristotle-dude · 2013-09-23 10:48 · Score: 1
  
  Guy with 5S walking in streets
  Thief: Give me your iPhone and wallet or I will shoot you Guy: Here take it all and leave me alone Thief: Shit! this is the one with fingerprint lock. Takes out his knife and says "Why so Serious?"
  Guy: Grows a pair, takes out serrated edge of house keys, rips thief's jugular a new one or jabs key into thief's eyes or stabs thief in the ballsack and says, "Why so serious?".
  
  --
  Jesus was a compassionate social conservative who called individuals to sin no more.
2. Re:Next Samsung Add by Catbeller · 2013-09-25 04:31 · Score: 1
  
  He shoots you fifteen times. You die.
  Would you like to play again? Y/N
3. Re:Next Samsung Add by aristotle-dude · 2013-09-28 18:18 · Score: 1
  
  He shoots you fifteen times. You die. Would you like to play again? Y/N
  With a gun that might or might not exist? I only saw mention of a knife. How is this guy going to shoot anyone if he is blind, has a gushing wound from his throat ripped open or with a perforated ball sack assuming he even has one? Thieves are generally cowards and only prey on the weak.
  Chances are that the thief will run if you appear too crazy to risk messing with. Don't put out the scent of fear and weakness and nobody will touch you.
  
  --
  Jesus was a compassionate social conservative who called individuals to sin no more.
It seems that CCC proved Apple's point. by raque · 2013-09-23 18:20 · Score: 1

CCC has proved that a targeted attack where the attacker has access to the person and the iPhone and a sophisticated skill set can overcome the finger print sensor on an iPhone 5s. So if I'm walking down the street and some thief takes my iPhone 5s I'm good to go. Walk into any Apple store or Internet Cafe, log in to my iCloud account and wipe the thing. Even if they knew how to do preform this hack, it would still take hours.
I can't tell you the number of times that I've had people watch me in dumb struck amazement as I switched out their ram in a few minutes. A new hard-drive in a ATX case is a ten minute job. I already have the tools and the knowledge. My point being these simple skills are not common, what CCC does is very uncommon even in the DIY crowd. A common person can expect to pay hundreds of dollars buying all of the tools needed and then days or weeks practicing to be able to do this hack.
Sorry, this proves that the fingerprint sensor is a good idea in it's context.
Edumacated folk overthink security. Forest/Trees by Catbeller · 2013-09-25 04:29 · Score: 1

Scenario:
You walk down the street with iPhone in hand.
Man walks casually up to you. Points gun at you. "Take out your phone," he says. "Now, unlock it."
You try to fake it. He repeats, "Finger on button - UNLOCK IT NOW."
You unlock it. He takes the phone, shuts off all verification procedures, now that he is "you".
Smacks you in the face until you hit the ground and walks away.
Fingerprint verification defeated. He sells the phone.
Too much knowledge sometimes prevents people from seeing the obvious flaws because they keep doubling down on their own cleverness. See: computerized election systems and the flaws no one sees, for sad examples