Free Republic
Browse · Search
General/Chat
Topics · Post Article

To: Kennard
What do you say to those that say that dual- or multi-factor authentication is still necessary?

For the same reason the guy who succeeded in your link does. . . it is very complex to get a fake fingerprint that has sufficient underlying detail to work. . . and it still has to be on a living finger. It WILL NOT WORK with just a photo. He states it is a very complex procedure for it to work. . . he says:

The attack requires skill, patience, and a really good copy of someone’s fingerprint — any old smudge won’t work. Furthermore, the process to turn that print into a useable copy is sufficiently complex that it’s highly unlikely to be a threat for anything other than a targeted attack by a sophisticated individual.

Why I hacked TouchID (again) and still think it’s awesome

I posted about this hack back when it came out. . . and it was completely discussed on the forums. The amount of equipment necessary to get a good fake fingerprint, essentially requiring using a superglue vapor transfer technique to lift a fingerprint that will get the underlying ridge detail, makes this a non-starter hacking method. The equipment to do that costs in the multiple thousands of dollars.

Being able to steal someone's phone and then access their TouchID is NOT going to happen by using an easy to acquire fingerprint copy.

18 posted on 12/29/2014 11:01:32 PM PST by Swordmaker (This tag line is a Microsoft insult free zone... but if the insults to Mac users contnue...)
[ Post Reply | Private Reply | To 17 | View Replies ]


To: Swordmaker
From the blogger:

As it stands, TouchID remains an effective security control that is more than adequate for its primary purpose: unlocking your phone.

Even Apple's own Authentec multi-spectrum imaging technology is not used in the iPhone 6.

For access to non-critical data, the current technology is adequate. For valuable and sensitive data, such as access to bank and brokerage accounts, trade secrets and important confidential business information, additional security is necessary: either dual-factor biometric or, ideally, passwords, still the reining champion of security.

A decade or so ago it would have seemed expensive and cumbersome for thieves to rig grocery store credit card readers so that they could sit outside and pick up RF transmissions, yet that crime is now widespread.

20 posted on 12/29/2014 11:57:40 PM PST by Praxeologue
[ Post Reply | Private Reply | To 18 | View Replies ]

Free Republic
Browse · Search
General/Chat
Topics · Post Article


FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson