Hacker News Reader

Comment by Holbein | Hacker News Reader

Thanks for the link!

Apple sent out at least 1 update to TouchID as part of a regular iOS update. In my view, from a few miles up, the fact that you can update TouchID doesn't install a lot of confidence in this tech. Apple can change its workings, and it can also interface with TouchID from outside in order to update it.

Would you care to elaborate why you're still sure that Apple (or the NSA) couldn't change TouchID to send my fingerprints to an outside server?

View on HN

Do you have a link to the touchID update? Because there's touchID the software, and touchID the hardware. The software interfaces with the actual circuitry but can still only basically say "can you please encrypt this?" and "can you please decrypt this", in addition to saying "hey was that fingerprint valid?" - that's it.

Even the OS-level software doesn't have access to fingerprint data. Heck, even the physical WIRES that connect touchID to the secure enclave in the A7 chip are encrypted, so someone couldn't just hookup to the circuit board and read your fingerprints.

Sure:

http://support.apple.com/kb/DL1736

"Further improvements to Touch ID fingerprint recognition".

TouchID was updated in system updates 7.0.1, 7.1 and 7.11:

https://en.wikipedia.org/wiki/IOS_7#7.0.1

Why does it scare you that they put out an update to change how they work with what is essentially irreversible hashes of the original high resolution scan of your fingerprints?

Because those hashes, when leaked to an outside party with a big database of fingerprints (say, the NSA), can be easily be combined to find matches in that database and identify somebody. Hashes don't solve all the problems, cmelbye, the identifying info is still there!

If the NSA gets access to your phone, there are hundreds of easier ways to identify who you are than having to go through the schlep of reconstructing your fingerprint.

You did not understand me correctly. The problem is that this can be done remotely, over the air, even when you're not in the US.

Reply on news.ycombinator.com