Touch ID: Unsecure? (Due to passcode)

[Paddle1]

You can still slide to unlock at any time, the sensor is optional.

 

[syd430]

I feel the first few replies completely miss the point. I know that when I heard about it requiring a password as a backup, I was thinking the same thing as OP - this is not a security feature in any sense of the word. Bringing the passcode prompt up is a very trivial process and I think that OP is correct in saying that this will encourage people to set easier passwords.

Here's a little idea that Apple could implement in order to avoid this issue: Instead of requiring a password, a button on the lock screen appears (similar to emergency calls) that allows the user to call a dedicated Apple hotline where someone asks a few identity questions to restore access, in the extremely rare event that your finger has been chopped off (or for whatever reason it's not registering). Yes I probably haven't thought this through properly, but it's just to point out that alternatives are possible.

 

[bripab007]

Touch ID will do two things:

1) force people who for years never set a passcode because it was too much of a hassle to now use a far more secure method (Touch ID) as well as setting a likely simple passcode backup

2) encourage people who for years had a simple passcode to now set a far more complex passcode as their Touch ID backup, as they correctly realize it'll only be very rarely they're forced to enter it.

Both situations net a more secure user base.

 

[SatManager]

If the Attorney Generals in some of the states get there way, Apple and Samsung will be forced to implement security features that will force the user to use longer passcodes or passwords to decrease the desirability of stealing cell phones. Along with software and hardware security features implemented by Apple in iOS7 that will lock down the iPhone so that only the registered user (the Apple ID user) can release the phone to another person. This would decrease the value of the phone to parts only.

I would think that this is one reason that Apple has developed the increased security features introduced in iOS 7 and on the iPhone 5S. This would get ahead of any enforcement actions that the Attorney Generals may wish to direct through lawsuits against Apple and leave Samsung and Google open to legal action if their technical solution is inferior to Apple's.

 

[Stuke00]

I'm sure I must be missing something here, and perhaps someone can point me in the right direction, but doesn't the passcode make Touch ID insecure?

----------------

Apple have stated that when setting up your fingerprint, you also need to setup a passcode. The passcode is requested when the device has not been used for 48 hours, or if the device has been restarted, and in theory is designed to time-limit hackers finding a way to circumvent the fingerprint scanner.

I'm confused though.. most users would set a 4-digit passcode because it's easy to remember - Also I don't know about you, but I'm likely to reset my phone or not use it for three days only once every 4-6 months, and therefore more reason to set an easy to remember passcode.

So if someone steals my phone, rather than crack my fingerprint (long, unique, randomly generated value), they instead just need to turn the phone off and on again, and get presented with a 4-digit code to crack??

-------------------------

Of course at this point Touch ID isn't in the wild so this is just speculation at this point, but perhaps the passcode unlock only gives limited access to information? Or stores contents differently?

If though, a hacker just needs to crack a 4-digit code rather than my fingerprint, then Touch ID is a convenience, not a security measure.

So, can anyone please help correct me on this? I'm sure this function must be more secure than I've described, but I'm not sure how!

Thanks

----------

p.s. for those who are interested in the architecture of Touch ID, this article has more on the encryption and chipsets used to make the magic happen:

http://www.quora.com/Apple-Secure-Enclave/What-is-Apple’s-new-Secure-Enclave-and-why-is-it-important

You can't use a passcode to purchase iTunes or App Store items. Really makes it no different than any other iPhone has a failback option to unlock your device.