Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Strike out the Touch ID.


Care to explain why? I know it's possible to clone someone's fingerprint, but that's doable in nearly clinical settings, where you have a very,very clear image of the fingerprint in the first place - a phone stolen out of a pocket or handbag is not going to have them.


The demonstration by starbug, who won the bounty for cracking TouchID, was made using a fingerprint taken from the screen.

https://vimeo.com/75324765


It's not too complicated, see starbugs latest talk:

https://media.ccc.de/browse/congress/2014/31c3_-_6450_-_de_-...

(Download MP4 and use a desktop player, it contains an English translation)


In that talk he even describes, how they got the fingerprint from the German Secretary of Defense from a photograph taken in a distance of 3m at a press conference.


If your fingerprint is your password, it's much easier for authorities to get it. It becomes essentially impossible to refuse to divulge your password.

If you're only concerned about thieves, sure, TouchID is probably fine.


You need the passcode on reboot of the device anyway. I'd rather have a strong passcode and Touch ID than a weak passcode that's easily broken. A strong password and no Touch ID is almost completely unusable.


Without the touch ID, a long password is too inconvenient.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: