Hacker News Reader

Comment by chinathrow | Hacker News Reader

Even if it's fake, it should simply transmit fingerprint data to the CPU and not more.

What am I missing here?

The possibility of a skimmer or data modifier.

Ie, I add a logger to your sensor, get all of your data, then make a sensor that translates my fingerprint to look like your fingerprint (or just always sends your fingerprint)

Why the need for a logger/skimmer?

Touch ID has been proven to be vulnerable to fingerprint clones for years.

https://www.youtube.com/watch?v=HM8b8d8kSNQ

Edit: Yes, not broken but also not 100% secure.

Why make it easier?

It _is_ easy if you have the fingerprint of someone.

That's not broken.

What threat model do you work under that an attacker would have physical access to the device long enough to replace an entire sensor, but would not have the resources to just take your fingerprints off the physical device?

you mean like taking a photocopy of your finger, licking it, sticking to fingerprint reader and getting a perfect bypass because biometrics is a JOKE and marketing bullet point?

> What am I missing here?

The concept of Secure Enclave, for one.

"The fingerprint sensor is active only when the capacitive steel ring that surrounds the Home button detects the touch of a finger, which triggers the advanced imaging array to scan the finger and send the scan to the Secure Enclave"

Right? So I still can't see why a 3rd party touch ID sensor can't speak the protocol towards the secure enclave. Can you enlighten me on this?

Edit (rate limited) for answer below: Is your argument still valid if you can already can use a dummy finger to unlock your phone as per various CCC videos demonstrated?

If you allow a 3rd party Touch ID sensor to send fingerprint data, you could compromise a powered on iPhone by connecting a malicious Touch ID sensor to it and sending spoofed fingerprints to unlock it.

Isn't the fingerprint data (hash, whatever) stored in the secure enclave? If you're sending spoofed fingerprints, you'd trigger the firmware 5 attempts lockout and need a password.

Reply on news.ycombinator.com