Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Much more secure

For those that don't know, the 4-digit password on the iPhone can be broken in several seconds using hacker tools. There was a Macrumors article on this a year or more ago. Therefore, this fingerprint sensor is WAY better. Much less considering that someone can watch over your shoulder to get your puny 4-digit code.

When I get the phone I'm going to make a very secure alphanumeric password and hopefully never have to use it because I'll block with my finger.

It is too bad that developers won't be able to utilize the fingerprint yet. Seems like a missed opportunity. Maybe there will be an API in iOS 8?...
 
Thanks to MacRumors for the live blog yesterday I was following during my lunch break. Well my take on it is that you choose the level of security that goes to hiding your personal identity is on ones self's ability. There trying to reassure that your prints are only localized on your processor, and your identification isn't at more of a risk than last year? Right...sure, and there won't be people trying to find ways around it? To busy staring at there new colored iPhone 5Ss. New adopters more and more repercussions, nah it's just how business works. I understand that it's all word play, so to think your wall is impenetrable as an individual is really a huge understatement. That's just that nothing is 100%, but it's the risk you take by moving forward with new ideas and technology. Example mobile banking and processing of deposit statements. It's just the middle man that always concerns me, no not the NSA. (Since fingerprints are already being obtained with new driver license or ID at your neard by DMV) "wouldn't be able to reverse engineer someone's fingerprint." I'm talking about IOS, and how software can be implemented to reverse engineer everything maybe even a reset of a print scan without having to wipe your phones data. Right because we can reverse engineer fingerprints...

This post also reminded me of these circumstances.

http://www.zdnet.com/apple-ios-in-app-purchases-hacked-everything-is-free-video-7000000877/

http://www.letsunlockiphone.com/beagleboard-exploit-mactans-charger-iphone-hacking/

It's being hyped up. I love reading other people's opinions. Overall I'm liking the new Touch ID sensor feature. Hopefully it's just as solid as the Safire ring around the iPhone 5s.
 
This will make is much safer to unlock my phone while I'm driving so that I can respond to a text.
 
For those that don't know, the 4-digit password on the iPhone can be broken in several seconds using hacker tools. There was a Macrumors article on this a year or more ago.

Not with current devices, and not in "several seconds". In current devices, it is impossible for anyone except Apple to get around the "ten attempts and you're locked out" (nobody except Apple can replace the software that is responsible for unlocking the phone). And testing any key combination takes about 1/10th of a second, so it will take about 10 minutes, not several seconds.

Therefore, this fingerprint sensor is WAY better. Much less considering that someone can watch over your shoulder to get your puny 4-digit code.

Definitely much better than not using any passcode at all because you can't be bothered (about 50% of users according to Apple).
 
iPhone 5S co-designed with NSA in Israel

Why worry about cracking the phone to get to the fingerprint images or data? Just order the prints/data from NSA. They get it effortless from their dear friends at Apple, who will never admit they work together and to what extend...

:D
 
The sensor is capacitive touch. A severed thumb almost certainly will not activate it properly.

The problem with most sensors and their software, is that they must allow a wide variation range, in order to recognize the real user, whether their finger is moist, dry, hot, cold, has scratches, lotion, etc.

That range has been used in the past to demonstrate how to spoof fingerprint sensors (including capacitive) using fairly ordinary materials. (Play Doh, Gummi Bears, etc.)

Apparently a severed finger will work on a regular capacitive sensor for about 15 minutes, and possibly much longer if you figure out the right fluid to pump through it. (Actually, I guess some blood from the victim would do.)

Now, this one is an RF (also often called AC/active capacitance) type, which measures both signal intensity and phase change as it passes through the finger. Not sure yet how easy it is to fool, but would guess it's pretty similar. Will keep looking for more info.

(As I noted in another post, AuthenTec has some patents on using other electrical tests to make sure the variation isn't too much. So they might be less prone to simple spoofing.)
 
Last edited:
People's insecurity with this feature in my mind is quite valid. Especially considering how bad things have gotten with the NSA. But that leads me to a very interesting point. Doesn't the government already have your fingerprint anyway? If you look at your birth certificate, there is indeed an image of your fingerprint (and foot) on it. And obviously, they must scan your certificate for the sake of archiving for many proposes (like back tracking a fingerprint in a crime scene investigation).

It's never a bad thing to keep your guard up, but I don't really think this one matters much considering. That's my take on it anyway.
 
Dear Apple, I'm sorry because I realise it's not really your fault, but I don't trust that the NSA haven't nobbled you, and nothing you have said so far leads me to… um think different, as it were.

Introducing the iPhone 5S! Brought to you in partnership with the NSA.

My reaction to the video was a positive feeling about their clever and earnest privacy cornerstone they've come up, but then you guys reminded me that's all BS. You brought me back to reality. The state of things that has been revealed to us this summer makes anything possible. Our government has erected a fortress of silence, classifying their crimes and threatening jail (and who knows, maybe threatening humiliation via nsa data) for anybody that fails to keep their crimes secret.

Anything could be compromised by anybody. rogue agents can sell the back doors. Maybe even the dreaded Chinese-Inserting-back-doors-in-hardware threat, that our government likes to talk about, is happening, as the nsa lies about doing it themselves. Anybody could be doing it. I'm not making a case that there's any way to stop it. it would just be nice if we weren't being forced by our government to literally fund the effort.

From what I've read, they've built a system of weaknesses into our worldwide system to maintain trust on the Internet, a big part of our lives. My guess is that this system is no well-considered and controlled tool to fight terrorism. it's capabilities will be and are a tool for those caught up in the immense and barely concealed raging power struggle that is a world of governments with centralized limitless power. If they catch a couple terrorists, it's just a bonus to some extent. half the stories about who they've stopped or caught are probably half-lies anyway, now that we know for sure they routinely lie. I'm more convinced than ever that like 80% of these governments' real activities, expenditures, and results only serve this struggle- the struggle by the key people that make up these institutions, to gain power and hold onto it. that includes their reach into the 'private sector'; their cohorts throughput nearly all industry and the paths of and fighting for skewed benefits (skewed to the connected, not the needy) that trickle down from government mandate through all walks of life. It's not a conspiracy or rocket science, it's a bedrock of their motivation for getting involved. What if our collectively inbred and imagined need for very large amounts of central planning is simply wishful thinking and arrogance and/or an intrinsic affect of our place in the power struggle everybody has created. We're moving toward this reality: it's a mad dash for the power we've packed into Washington and you're a sucker and you're going to lose if you don't play the game, and play as hard as you can. Look at political reality in China.

I fear we may be at the mercy of the least desirable attributes of nerds and cops. they've teamed up.

also, I gonna get a 5s. I love the Touch ID. I love apple. I wish Steve was still around.

sorry, I'm probably breaking forum rules/ranting. I promise to chill out.
 
Last edited:
It's called Metadata.

whether it stores that actual raw image or the metada, it makes no difference. The actual raw image could be scanned and stored in an encrypted image file or the metadata could be stored in an encrypted image file. It is still obtainable from you know who. The way that fingerprint images are stored is not the actual image. The fingerprint scanner takes a picture of the fingerprint. Then through and fast algorithm (may be a hash function) convert that image to unique (?) hash output. You don't know what algorithm Apple has used. But do you think that Apple would not hesitate to release it to the NSA the first time the NSA barks at them?
 
I've been fingerprinted once, and it was only a thumbprint at a bank to cash a check about 10 years ago. I'm very concerned about the NSA stuff, even though I am a law abiding, tax paying citizen. I don't like it one-eye-ota.

I was crushed to see Apple's name on the original PRISM documents. They've always taken security a lot more seriously than other companies in my opinion. They were the last on the timeline and I'm sure they held out as long as they could, but were forced to comply after a lot of legal fighting. At least I hope that was the case.

Anyway, this helps alleviate my concerns regarding the fingerprint reader.
 
I think the key thing to remember here is that they are not storing an image of your finger in the traditional senses of a graphical picture that could be used to frame a person in a crime scene. Rather, I suspect that they are measuring the differences in capacitance along the ridges of ones finger and storing the mapped capacitance values as the biometric key. Even if this mapped capacitance data was released to NSA it would be very difficult from them to track it back to an image of a fingerprint.
 
I would have to troll on your post and get banned. Your post is crazy.
If you are so concerned about time lost whilst unlocking the phone then why are you on macrumors chatting about it. I'm sure that lost you way more time.

Facepalm is NOT enough in this case!

Now he can spend the time macrumors chatting rather than unlocking his phone! :apple:
 
All I know is that it takes 4-5 seconds to home button + slide to unlock + passcode and even longer if you are using alpha numeric password.

Personally I unlock my phone ~50 times per day.

Saving ~4 seconds between slide to unlock and passcode is roughly ~200 seconds per day saved unlocking my phone or ~3 minutes. 3 minutes per day equates to roughly ~18 hours per year or more than $5,000 worth of lost productivity unlocking my phone.

That alone makes this touch sensor worth while.

It took you 2 minutes to type this out. That's about 30 screen unlock for you. And if you respond it's another 15 unlocks. Wow!
 
What a ridiculous claim. If you're storing enough about the fingerprint to do reliable identification, then you are for all intents and purposes storing the fingerprint itself.
 
Entering four digit pin takes about a second (and works 100% accurately). That's probably about on par with the sensor when sensor matches your fingerprint quickly. Since the sensor will not be able to match the fingerprint quickly all the time, in some cases it will take longer. On average sensor will probably cost you money.

The four-digit password isn't really comparable. The time to crack a four digit password is infinitesimally short compared to whatever the encrypted equivalent of the fingerprint ID is. So, you'd have to compare it to, say, a completely random string of 20 or more characters... which is not uncommon for me to use on other devices. So I'd have to consider the cost-benefit on that basis, and not as it compares to the time it takes to enter four, probably nonrandom, entirely numerical digits.
 
Dangerous idea ... will TouchID be admissible in court ? Can they use it as proof that someone made a phone call (or other action) ?

----------

What a ridiculous claim. If you're storing enough about the fingerprint to do reliable identification, then you are for all intents and purposes storing the fingerprint itself.

Not true ... the data is hashed. Can you rebuild a full ISO from a sha1 checksum ? Nope.
 
What's pathetic is 99% of the paranoid nut jobs and Android, Samsung Apple haters still won't believe this! :rolleyes:
 
so your prints are on the phone screen/home button.. someone can dust it and make a copy clone and makes a 3D print out of it and wala your key has been copied :eek:
 
Dangerous idea ... will TouchID be admissible in court ? Can they use it as proof that someone made a phone call (or other action) ?

I can unlook my phone, put it on a table, someone steals it. Still unlocked. No protection. It isn't proof that I made a phone call.
 
Can someone please enlighten me on why people are so fussy about the NSA getting fingerprint data? What can they do with that information? It's not like they can even sell it to marketers. :confused:

O.K. Suppose the NSA using PRISIM and XKeyScore (and using their recently proported ability to hack HTTPS noted I was frequenting sites of interest and they want to find out how I am. They can identify my phone MIN and my apple ID, but ice been very carefully and never linked my device or Apple ID or other on-line acounts with my real name.

With a finger print they can trace it back to criminal record, immergation, firearm ownership files that the Us ir other governments hold.
 
I can unlook my phone, put it on a table, someone steals it. Still unlocked. No protection. It isn't proof that I made a phone call.

But it's proof that you were in a location where said phone call was placed. Plenty of people have concerns about the 5th amendment when it comes to this.

And can we stop with this idiotic "your fingerprints are all over your phone!" nonsense? A tech company can put in a backdoor for a digital finger print, can't do the same for the ones on your screen. Also I'd like to address the "Disney takes your finger prints" argument. That's great if they do. Let them tell the NSA whenever I enter and leave Disney world. Collecting a fingerprint to gain entrance to a theme park and collecting a fingerprint to make a phone call/search the internet/send an email are two different things.

IMO all these "nut jobs" are valid in their concerns. Google Edward Snowden to find out why.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.