iPhone Why don't Apple make Touch ID a public API?

Because, just by SAYING that third party apps will now be able to USE the fingerprint scanning capability with their own apps, will have people erroneously jumping to the conclusion that they will have some sort of access to the encrypted data associated with it.

Apple is already being extremely cautious about it with their own software/hardware. No reason to freak people out more at this point before it is even available.

Trust will come with time and then we will see...

Because it's Apple

Also because it is quasi beta. Apple can experiment using it's own money (store) but to open it up out the gate and find it has problems would be a nightmare.

Probably see an API next year if it passes all tests.

What do 3rd party apps need API for if apple does iCloud Keychain properly? If Apple connects keychain to FP scanner right, this could revolutionize how we authenticate ourselves. No need for 3rd party apps to be involved at all. I don't trust apple 100% but do trust them more than some low tier app dev.

It'll come with iCloud keychain. All your passwords will be stored in the keychain and accessing it will be a system level authentication. Keychain was removed from the GM without explanation but its probably because Apple wants to introduce it with Mavericks so that they're cross compatible. Generating a random complex password in keychain on your iPhone is useless if you cant then log into websites on your Mac.

It's a brand new feature that could not possibly be tested on the scale required to make sure it's secure enough to open it up in an API. Worst thing that happens right now is someone can unlock your phone or make a ton of iTunes purchases. Remember the bugs in Maps last year? Well, imagine such a bug with Touch ID.

they said not yet... so wait.

Carlanga said:

they said not yet... so wait.

Click to expand...

Exactly. No way would I put credit card numbers and the like on the keychain until apple is dead certain it's perfect.

If they get the keychain/ FP scanner done right, I'll upgrade my 5 to the 5s just for that right there. Until then, I'm fine watching them make progress.

Mrg02d said:

Exactly. No way would I put credit card numbers and the like on the keychain until apple is dead certain it's perfect.

If they get the keychain/ FP scanner done right, I'll upgrade my 5 to the 5s just for that right there. Until then, I'm fine watching them make progress.

Click to expand...

FWIW the keychain doesn't store the security code on the back of the card, so it's pretty useless to anyone who gets the details.

Let's rephrase the question - why would a third party app need access to the Touch ID API?

If you assume (and granted it is an assumption, but a pretty solid one) that any app user who would want to authenticate with Touch ID is already using Touch ID for controlling access. That means if the phone is unlocked, it is already authenticated.

For most purposes, that's sufficient. Anyone who can unlock the phone has full use of the apps and stored passwords on that phone, so the Touch ID acts as the "master lock" for the whole device.

For some high-security applications, I can imagine asking the user to re-authenticate would probably be useful - banking/finance, corporate networks, etc. - but even then, the best that I imagine that an API would give them is the Apple ID of the authenticating user. Tying that to a real person's identity would have to be done somehow. Not impossible, of course, but one more thing to deal with.

Lord Hamsa said:

Let's rephrase the question - why would a third party app need access to the Touch ID API?

If you assume (and granted it is an assumption, but a pretty solid one) that any app user who would want to authenticate with Touch ID is already using Touch ID for controlling access. That means if the phone is unlocked, it is already authenticated.

For most purposes, that's sufficient. Anyone who can unlock the phone has full use of the apps and stored passwords on that phone, so the Touch ID acts as the "master lock" for the whole device.

Click to expand...

Well, I can think of some reasons:

1) For our app, we provide document security. Many of our clients have a BYOD policy so IT departments may not be able to secure the device, but they can secure our app specifically.
IT technically don't care if your Angry Birds score gets out, as long as they have some peace of mind that the documents are secure.

2) The app has it's own 'soft lock' (app lock separate from the entire device lock), and we could use this to authenticate the soft lock.

3) We could use this for two-factor authentication - A manual typed in password combined with a fingerprint scan

4) restricting device sharing - A password set on the server can be used on multiple devices, but as the fingerprint scan is only stored locally, it therefore only unlocks one device (presumably you could apply a security policy on the device to stop them adding their fingerprint to another device)
(We actually authenticate the device already, but this could be a more secure way to do it)

Lord Hamsa said:

Let's rephrase the question - why would a third party app need access to the Touch ID API?

If you assume (and granted it is an assumption, but a pretty solid one) that any app user who would want to authenticate with Touch ID is already using Touch ID for controlling access. That means if the phone is unlocked, it is already authenticated.

For most purposes, that's sufficient. Anyone who can unlock the phone has full use of the apps and stored passwords on that phone, so the Touch ID acts as the "master lock" for the whole device.

For some high-security applications, I can imagine asking the user to re-authenticate would probably be useful - banking/finance, corporate networks, etc. - but even then, the best that I imagine that an API would give them is the Apple ID of the authenticating user. Tying that to a real person's identity would have to be done somehow. Not impossible, of course, but one more thing to deal with.

Click to expand...

What about apps that store passwords...would be nice if they let me use my fingerprint instead of entering a password to get into the app.

There are a ton of apps that require a secondary password to get in...don't you use a banking app?

I think for similar reasons copy/paste took so long - they need to have security and consistency across applications and starting with their own stable of apps is probably hard work enough for the time being.

This is a good read on Touch ID. It explains how secure it really is and that the only data that is relayed to apps is a simple "yes" or "no". In time Touch ID will be fully deployed, however we will need to wait for other key elements to fall into place first.

http://9to5mac.com/2013/09/17/why-touch-id-is-bigger-news-than-any-of-us-appreciated/

Here's an interesting read...
http://9to5mac.com/2013/09/17/why-t...c-MacAllDay+(9+to+5+Mac+-+Apple+Intelligence)

WhackyNinja said:

Because it's Apple

Click to expand...

Here is an excellent article that really gives insight. Apple is playing this out perfectly...

http://www.quora.com/Apple-Secure-Enclave/What-is-Apple’s-new-Secure-Enclave-and-why-is-it-important