Hacker News Reader

Comment by otoburb | Hacker News Reader

If your iphone is locked, how about a log of the thumbprints that attempt to open the phone sent to an escrow account that only Apple and you can open with shared passwords?

The existence of the feature would hopefully act as one more trivial inconvenience to deter more thieves.

View on HN

I don't think the TouchID sensor captures or stores actual images of fingerprints in a way that is accessible to applications.

On the one hand, that is somewhat reassuring for happy paths. For this particular use-case, that's a bummer.

It would probably be a significant security flaw.

Imagine you press it but for whatever reason it doesn't register. Now your "incorrect" fingerprint is flying over the internet. With a bit of retouching or guessing your original fingerprint can now be recovered.

...not that your fingerprints aren't all over your phone anyways...

Only a hash of the fingerprint is stored on the device.

Wow, this is a pretty great idea. However, I feel it would be difficult to track the thief down with only a fingerprint. Also someone is going to complain about the privacy/security implisecurity of sending fingerprint data through the internet.

Agreed, but ideally logging would only commence after the phone is locked via Find My iPhone.

Unfortunately every fingerprint reader outputs a unique hash per fingerprint, which is why if you break it you can loose all of your data. So even with a thiefs hash's you'd still need the thief to prove it was them.

I'm being a bit pedantic about the "every fingerprint reader" mention and am assuming that mention also includes non-Apple devices. HTC and Samsung phones have, in the past, stored fingerprint images in an accessible location. What's worse was that the fingerprint image would be refreshed with every swipe/finger touch!

[1]: https://www.theguardian.com/technology/2015/aug/10/htc-finge...

[2]: http://betanews.com/2015/08/11/htc-and-samsung-phones-storin...

This is an incredible idea that would add serious value to customers, which is precisely why the product managers (most of whom are complete idiots and totally oblivious) will completely and totally ignore it.

Reply on news.ycombinator.com