Apple's Touch ID already bypassed with established 'fake finger' technique

1235717

Comments

  • Reply 81 of 330

    It's not defective, in fact, it's a replacement device! How convenient!

    ;-)

  • Reply 82 of 330
    rogifanrogifan Posts: 10,669member
    ramrod wrote: »
    Again, what about the gloves in the winter time? Yeah, didn't think you cared to address that issue. Hmm.....
    Dude I live in Minnesota and have not had any issues with my iPhone. I actually own gloves that work with the iPhone and unless its really cold and I'm outside there aren't that many situations where I need to use my phone with gloves on.
  • Reply 82 of 330
    Fake finger hack looks pretty fake.
  • Reply 84 of 330
    Thank you hackers of the world, it is better to know the system's weakness now then later. I will use this information to adjust how I use this technology. For example I will only train only one finger, the thief will have to lift and model all 10 fingers to ensure success.

    Security can also be increased by requiring multiple scan on the individual finger to unlock. The system is configured for ease of operation. During training, the touch sensor is mapping out the entire print but only require a small area to unlock. By requiring a second scan of an area perhaps on the tip of your finger, not normally left behind, will make the system more secure but harder to use.
  • Reply 85 of 330
    Quote:

    Originally Posted by Ramrod View Post

     

     

    Sorry to hear you don't know how to wipe your screen or that your friends can't come up with a complex pattern. And sorry to hear you blame the locking mechanism because the idiotic user didn't know how to connect the dots. Wow! Like I said, Denial is a helluva drug.

    In the end I say don't worry what me or others think about this ridiculous gimmick. The inconvenience of having to constantly take your gloves off is enough reason to not want to use it. Come this winter, anyone with a GS4 can happily swipe in their pattern lock and never have to take be inconvenienced with taking off their gloves. Samsung was smart enough to know this. Apple? Not so much.


     

    Oh my.. Stop with the glove point, we've already both agreed on it, so shut up, just being a condescending prick now.

     


    You point out that I don't know how to wipe a device clean? Are you mentally challenged?


    I've done it with cleaners, micro-fibre cloths, shirts, pants, everything. And nothing has worked, so that point falls..


     


    They had very complex patterns, but clearly you don't think so, which is fine by me...


    "DENIAL IS A HELLUVA DRUG"... LOL. Yeah, you bloody hypocrite. You call be being in denial, yet when I point out perfectly logical points, you just say I'm in denial simply because you are? Get over yourself. That reflection ain't pretty.


     


    You point out that Samsung thinks of things.. Yeah, so true. Like how they thought a 2500 MAh battery is enough for a 5.3 HD screen? Or how a dual core with a gig of RAM is enough for Android. Or how about those screen issues? Yeah, certainly SAMSUNG is the CLEAR CUT winner in QUALITY. Lol, please, get off AI. Clearly all you've done is join simply because you wanted to point out a finger unlock pattern is better. Yes, it is better is some cases, and it's worse in some cases... like with EVERYTHING.
  • Reply 86 of 330
    Quote:
    Originally Posted by Rogifan View Post





    Dude I live in Minnesota and have not had any issues with my iPhone. I actually own gloves that work with the iPhone and unless its really cold and I'm outside there aren't that many situations where I need to use my phone with gloves on.

     

    Honestly? Do you live in a bubble? WTF? Just because you're fine with not using gloves in the winter doesn't mean the rest of us are. The overwhelming population in North America alone (forget the rest of the world for a second) wears gloves in the winter. 

    And YES there are gloves out there that work with TOUCHSREENS (not just iPhones), but these gloves don't work with the Touch ID. That's what the discussion is. Are you so bent on wanting everyone to love the Touch ID that you could not see this point? One more time now, the point of mentioning gloves was to point out they do not work with the TOUCH ID. Can't believe I had to actually point this out. Dang!
  • Reply 87 of 330
    Quote:
    Originally Posted by tort View Post

    Clearly all you've done is join simply because you wanted to point out a finger unlock pattern is better. Yes, it is better is some cases, and it's worse in some cases... like with EVERYTHING.

     

    Says the person who just joined AI. HAHAHAHAAAA. 

    Dang, denial is a helluva drug.

  • Reply 88 of 330
    Quote:
    Originally Posted by Ramrod View Post

     

    Sorry, best and easiest way is the pattern unlock that android uses. Apple should have put more money towards a better user experience, bigger and better screen, and better hardware overall. The fingerprint lock is useless in winter. What a hassle to keep taking off gloves to unlock my phone. I like what Nokia and Samsung did with the touchscreens that work with gloves. Get on it Apple. Stop these stupid gimmicks.


     

    Well, fingerprints are convenient but you don't have to use your fingers,  You understand that you can use any part of your body, even parts that are illegal to expose in public in most countries.  Although I guess using those parts might keep the Germans from lifting the print where they are used. LOL. <img class=" src="http://forums-files.appleinsider.com/images/smilies//lol.gif" /> 

  • Reply 89 of 330

    If this video is proof that the iPhone Touch ID was cracked, then this video actually demonstrates that the Touch ID wasn't cracked at all.

    How so?

    If you know which finger to use and you know your own 4 digit pass code, have you really cracked the Touch ID?

    No.

    The person used his own lifted fingerprint without restarting the phone; and he knew which fingerprint to use.

    The Touch ID requires a 4 digit pass code after restarting.

    http://support.apple.com/kb/HT5949?viewlocale=en_US

    Security safeguards

    Every fingerprint is unique, so it is rare that even a small section of two separate fingerprints are alike enough to register as a match for Touch ID. The probability of this happening is 1 in 50,000 for one enrolled finger. This is much better than the 1 in 10,000 odds of guessing a typical 4-digit passcode. Although some passcodes, like "1234", may be more easily guessed, there is no such thing as an easily guessable fingerprint pattern. Instead, the 1 in 50,000 probability means it requires trying up to 50,000 different fingerprints until potentially finding a random match. But Touch ID only allows five unsuccessful fingerprint match attempts before you must enter your passcode, and you cannot proceed until doing so.

    To configure Touch ID, you must first set up a passcode. Touch ID is designed to minimize the input of your passcode; but your passcode will be needed for additional security validation, such as:


    • After restarting your iPhone 5s

    • When more than 48 hours have elapsed from the last time you unlocked your iPhone 5s

    • To enter the Passcode & Fingerprint setting

    Since security is only as secure as its weakest point, you can choose to increase the security of a 4-digit passcode by using a complex alphanumeric passcode. To do this, go to Settings > General > Passcode & Fingerprint and turn Simple Passcode off. This will allow you to create a longer, more complex passcode that is inherently more secure. Security is further strengthened by using a mixture of uppercase and lowercase letters, numbers, and symbols."

    ----------------------------------------

    If Apple had never revealed how the Touch ID process worked, the individual would not have figured out that he can scan his own fingerprint, elevate the ridges onto a surface, place the surface on another finger, and then use the other finger's "living tissue" beneath the "fake epidermal fingerprint layer", to activate the Touch ID with his own 4-digit pass code.

    The staged video simply demonstrates that the technology works as advertised, in that the scanner read the correct fingerprint pattern, and that the overlay was placed on the finger of a living person.

    According to this article, the ONLY way a fingerprint pattern was replicated was with a DIRECT FINGER TO GLASS PLATE 2400 DPI HIGH RESOLUTION SCAN ON A FLATBED SCANNER.

    Which means that he couldn't lift a fingerprint directly off of the iPhone 5s itself, because the light from the scanner would have refracted when coming into contact with the sapphire crystal glass.

    In other words, take a mirror, and place a clear fingerprint on it, and scan the mirror.

    Light reflected on itself would wash out the image the same way you photograph a white wall with flash.

    The bottom line is that the individual didn't crack the Touch ID with his own fingerprint and 4 digit pass code; and he couldn't crack the Touch ID because the scanner worked as advertised.

  • Reply 90 of 330
    Quote:

    Originally Posted by Ramrod View Post

     

     

    Says the person who just joined AI. HAHAHAHAAAA. 

    Dang, denial is a helluva drug.


     

    Want to know why I joined AI? Because I wanted to show to the world the debunking of this stupid german video.

     


    You may as well copyright that freaking saying, or maybe you are on drugs, you just keep repeating it. Also, another point is that you haven't even attacked any of my points, seem like we agree on my terms. Thanks for bringing along the stupid android joyride that is Ramrod.


     


    Now, get out child, you don't belong here. Maybe one of those fandroid sites will do you well, just like AI does it's own Apple fanatics well.
  • Reply 91 of 330
    rogifanrogifan Posts: 10,669member
    ramrod wrote: »
    Honestly? Do you live in a bubble? WTF? Just because you're fine with not using gloves in the winter doesn't mean the rest of us are. The overwhelming population in North America alone (forget the rest of the world for a second) wears gloves in the winter. 
    And YES there are gloves out there that work with TOUCHSREENS (not just iPhones), but these gloves don't work with the Touch ID. That's what the discussion is. Are you so bent on wanting everyone to love the Touch ID that you could not see this point? One more time now, the point of mentioning gloves was to point out they do not work with the TOUCH ID. Can't believe I had to actually point this out. Dang!
    Well if that becomes such a problem for people in cold climates then turn touch id off and go back to passcode. It's not like Apple ever claimed touch id would work with gloves. And I hardly think its a reason not to implement it. I would guess the vast majority of people use their iPhone without gloves.
  • Reply 92 of 330

    OMG!! My Bank website is only password protected! Guess my all money is gonna disappear soon! /s

  • Reply 93 of 330
    Quote:
    Originally Posted by tort View Post

     

     

    Want to know why I joined AI? Because I wanted to show to the world the debunking of this stupid german video.

     


    Now, get out child, you don't belong here. Maybe one of those fandroid sites will do you well, just like AI does it's own Apple fanatics well.


     

    I don't give a shlt why you joined. lol. Seriously kid, don't get so upset because the Touch ID was bypassed. You sound like you're about to bust a nut.  You can still buy an iPhone and nobody will care either way. Just don't ever wear gloves. lol.

    One more for the road, say it with me now, Denial Is A Helluva Drug;) 

  • Reply 94 of 330
    Quote:

    Originally Posted by Rogifan View Post

     
    Quote:

    Originally Posted by Ramrod View Post



    Honestly? Do you live in a bubble? WTF? Just because you're fine with not using gloves in the winter doesn't mean the rest of us are. The overwhelming population in North America alone (forget the rest of the world for a second) wears gloves in the winter. 

    And YES there are gloves out there that work with TOUCHSREENS (not just iPhones), but these gloves don't work with the Touch ID. That's what the discussion is. Are you so bent on wanting everyone to love the Touch ID that you could not see this point? One more time now, the point of mentioning gloves was to point out they do not work with the TOUCH ID. Can't believe I had to actually point this out. Dang!


    Well if that becomes such a problem for people in cold climates then turn touch id off and go back to passcode. It's not like Apple ever claimed touch id would work with gloves. And I hardly think its a reason not to implement it. I would guess the vast majority of people use their iPhone without gloves.

    "It's not like Apple ever claimed touch id would work with gloves", no but they DO claim that it is highly secure, which now seems to be uncertain at best, and untrue at worst.

  • Reply 95 of 330
    Quote:
    Originally Posted by Ramrod View Post

     

    Sorry, best and easiest way is the pattern unlock that android uses. Apple should have put more money towards a better user experience, bigger and better screen, and better hardware overall. The fingerprint lock is useless in winter. What a hassle to keep taking off gloves to unlock my phone. I like what Nokia and Samsung did with the touchscreens that work with gloves. Get on it Apple. Stop these stupid gimmicks.


     

    Sorry, but when it is too cold, a normal person's first priority is to find a warm place is what I have heard. And I don't think even homeless people are always outdoors during winter. Its all good trying to find some silly anti-sentiment from a corner, but we will have to apply all these factors into real world scenarios. Let us be practical. TouchID not allowing gloves is your complaint? Really?

  • Reply 96 of 330
    Quote:

    Originally Posted by Ramrod View Post

     

     

    I don't give a shlt why you joined. lol. Seriously kid, don't get so upset because the Touch ID was bypassed. You sound like you're about to bust a nut.  You can still buy an iPhone and nobody will care either way. Just don't ever wear gloves. lol.

    One more for the road, say it with me now, Denial Is A Helluva Drug;) 


     

    If you don't care about why I joined AI.. then why are you laughing at me for saying you only joined to point out an Android feature on an Apple website...

    My debunking clearly states this video was a serious con, and it seems you were fooled by it. Don't be intimidated by such people. And I don't ever wear gloves.. so that point is useless to me.. Damn you're conceited ;)
  • Reply 97 of 330
    rogifanrogifan Posts: 10,669member
    taniwha wrote: »
    "It's not like Apple ever claimed touch id would work with gloves", no but they DO claim that it is highly secure, which now seems to be uncertain at best, and untrue at worst.
    How is it untrue? No one has accessed the secure enclave inside the A7 chip. This "hack" appears to have been done in a controlled environment and hasn't been replicated or independently verified by anyone. Also there doesn't appear to be an unedited video from start to finish showing how this was accomplished. Sorry for now I trust Apple's word over some YouTube video that hasn't been independently verified and replicated.
  • Reply 98 of 330


    While the process is somewhat complex, the thinking behind it is straightforward. In this case, a high-resolution 2400 dpi photo of a user's fingerprint was harvested from a glass surface using graphite dust or cyanoacrylate (the main ingredient in Super Glue) and a camera. The resulting image was cleaned up and inverted with photo editing software, then laser printed at 1200 dpi onto a transparent sheet.



    To create the fake fingerprint, pink latex milk or white wood glue is laid over the printout and allowed to set. Once cured, the dummy can be peeled off the transparency, breathed on to produce a thin layer of moisture, and applied to a finger. This will grant access to a Touch ID protected device, CCC claims. 


     

    “Hey. Hey, Ted. Can I get a picture of your fingerprints? What for? Oh, I… Uh… I have a fetish. Yeah, that’s it. I have a fetish for fingerprints. Both thumbs… work it, baby… Thanks. You wouldn’t happen to have any latex milk on you, either, would you? And can I hop on your laptop for a few minutes? You still have Photoshop on there, right?

     

    Originally Posted by MacHarry de View Post

    OK,is it possible to return the new iPhone 5s to Apple until this hard issue is solved?

     

    Cue (look at that, I used it correctly) hundreds of paid Samsungers spewing that all over every Apple site.

     

    Originally Posted by Ramrod View Post

    Says the person who just joined AI.


     

     

    Are you really in any sort of position to be pulling this (perpetually meaningless) card?

  • Reply 99 of 330

    Great analysis. And adding:

    1) Fingerprints add to, and/or enhance, existing security. 

    2) CCC says fingerprints are not part of 'oppression' - such bizarre claims, and the lack of the end-to-end process video, make me suspicious.

    3) Seriously, Are people buying the 5S for the fingerprinting? I'll bet the top motivators are: A) superior imaging technology; B) Prestige/Style/Coolness; C) Better Faster processing.

  • Reply 100 of 330
    gatorguygatorguy Posts: 24,213member
    rogifan wrote: »
    How is it untrue? No one has accessed the secure enclave inside the A7 chip. This "hack" appears to have been done in a controlled environment and hasn't been replicated or independently verified by anyone. Also there doesn't appear to be an unedited video from start to finish showing how this was accomplished. Sorry for now I trust Apple's word over some YouTube video that hasn't been independently verified and replicated.

    One of the security directors at DefCon claims to have replicated the process already.
Sign In or Register to comment.