Jump to content

Touch ID

From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by Jimw338 (talk | contribs) at 21:09, 3 July 2017 (→Security and privacy: archiveurl). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

iPhone 5S home button with integrated Touch ID feature

Touch ID is a fingerprint recognition feature, designed and released by Apple Inc., and is currently standard on the iPhone since iPhone 5S, as well as iPads since the iPad Air 2 and the MacBook Pro. In 2015, Apple introduced the faster second generation Touch ID beginning with the iPhone 6S, and later to the MacBook Pro in 2016.

Touch ID allows users to unlock Apple devices, make purchases in the various Apple digital media stores (the iTunes Store, the App Store, and the iBooks Store), and authenticate Apple Pay online or in apps. On announcing the feature, Apple stated that fingerprint information is stored locally in a secure enclave on the Apple A7 and later chips, and is not stored in the cloud, making it very difficult for users to externally access the fingerprint information.

File:TouchID.png
Touch ID Logo

History

The first mobile phone with a fingerprint scanner was the Toshiba G500 and G900 in 2007.[1] In 2012, Apple acquired AuthenTec, a company focused on fingerprint reading and identification management software, for $356 million.[2] The acquisition led commentators to expect a fingerprint reading feature.[2][3] Following leaks and speculation in early September,[4][5] the iPhone 5S was unveiled on September 10, 2013, was the first phone on a major US carrier since the Atrix to feature the technology.[6] Apple's Vice President of Marketing, Phil Schiller, announced the feature at Apple's iPhone media event and spent several minutes (the major portion of the conference) discussing the feature.

Following Apple's introduction in 2013, other smartphone makers included fingerprint scanning in their high-end phones during 2014 and 2015,[7] starting with the Samsung Galaxy S5. Beginning with Android 6.0 (Android Marshmallow, released October 2015), fingerprint scanner support is integrated into the operating system like Touch ID is in iOS.

Wells Fargo analyst Maynard Um predicted on September 4, 2013, that a fingerprint sensor in the iPhone 5S would help mobile commerce and boost adoption in the corporate environment.[8] "As consumers increasingly rely on mobile devices to transact and store personal data, a reliable device-side authentication solution may become a necessity," Um said.[8]

With the unveiling of the iPhone 6 and 6 Plus at a keynote event on September 9, 2014, Touch ID was expanded from being used to unlock the device and authenticating App Store purchases to also authenticating Apple Pay. The iPhone 6S incorporates a second-generation Touch ID sensor that is up to twice as fast as the first-generation sensor found in the 5S, 6, and SE phones. As of June 2017, the iPhone 6S, 6S Plus, 7, and 7 Plus, 2016 MacBook Pro and iPad Pro 10.5 and 12.9 (second generation) are the only Apple devices which use the second generation sensor. The new Touch ID unlocks almost instantly and posed an issue as it unlocks too fast to read notifications on the lock screen. This is remedied with the iOS 10 update in which a user must press the home button to have the home screen appear, however this can be changed in the iOS settings to where users can just rest their finger on the sensor to unlock the user's device and go directly to the home screen, similar to previous versions of iOS. Solely placing a finger on the sensor will only unlock the iPhone unless said setting is enabled, and no notifications are currently being displayed on the lock screen.

USAA has released their figures and as of the end of 2015 over one-million members were using Apple's Touch ID technology, utilizing their fingerprint to securely log on to the USAA Mobile Application on Apple's iPhones and iPads.[19]

Generations

Generation Model
1
2

Hardware

Components of Touch ID.

Touch ID is built into the home button, which is built of laser-cut[9] sapphire crystal, which does not scratch easily (scratching would prevent Touch ID from working).[10] It features a stainless steel detection ring to detect the user's finger without pressing it. The feature does not work without contact with this ring. There is no longer a rounded square icon in the home button, nor is it concave.

The sensor uses capacitive touch to detect the user's fingerprint.[10] The sensor has a thickness of 170 µm, with 500 pixels per inch resolution. The user's finger can be oriented in any direction and it will still be read.[2] Apple says it can read sub-epidermal skin layers,[11] and it will be easy to set up and will improve with every use.[9] The sensor passes a small current through one's finger to create a "fingerprint map" of the user's dermis. Up to 5 fingerprint maps can be stored in the Secure Enclave.

Security and privacy

Touch ID can be bypassed using passcodes,[12] thus on account of it presenting a new different way for access to the device, it represents a net security decrease for an individual device. Apple claims that average user security is increased however because users who formerly had no passcode at all will now use Touch ID.

Fingerprint data is claimed to be stored on the secure enclave inside the Apple A7, A8, A8X, A9, A9X or A10 Fusion processors of an iOS device, and not on Apple servers, nor on iCloud. From the Efficient Texture Comparison patent[13] covering Apple's Touch ID technology:

In order to overcome potential security drawbacks, Apple's invention includes a process of collapsing the full maps into a sort of checksum, hash function, or histogram. For example, each encrypted ridge map template can have some lower resolution pattern computed and associated with the ridge map. One exemplary pattern could be a histogram of, e.g., the most common angles (e.g., a 2 dimensional (2D) array of common angles). The exemplary pattern could include in each slot an average value over a respective vector of the map. The exemplary pattern could include in each slot a sum of the values over a respective vector of the map. The exemplary pattern could include the smallest or largest value within a respective vector of the map or could be a difference between a largest and a smallest value within the respective vector of the map. Numerous other exemplary embodiments are also possible, and any other exemplary pattern calculation can be used, where the exemplary pattern includes enough associated information to narrow the candidate list, while omitting enough associated information that the unsecured pattern cannot or cannot easily be reverse engineered into a matching texture.

If the user's phone has been rebooted, or has not been unlocked for 48 hours, only the passcode a user has created, not their fingerprint, can be used to unlock the device, or during other specific use cases.[12][14]

In September 2013, the German Chaos Computer Club announced that it had bypassed Apple's Touch ID security. A spokesman for the group stated: "We hope that this finally puts to rest the illusions people have about fingerprint biometrics. It is plain pity to use something that you can't change and that you leave everywhere every day as a security token."[15][16] Similar results have been achieved by using PVA Glue to take a cast of the finger.[17]Others have also used Chaos Computer Club's method, but concluded that it is not an easy process in either time or effort, given that the user has to use a high resolution photocopy of a complete fingerprint, special chemicals and expensive equipment, and because the spoofing process takes some time to achieve[18]

Impact

In a 2013 New York Magazine opinion piece, Kevin Roose argued that consumers are generally not interested in fingerprint recognition, preferring to use passcodes instead. Traditionally, he wrote, only businesspeople used biometric recognition, although they believe Touch ID may help bring fingerprint recognition to the masses. Roose stated the feature will also allow application developers to experiment, should Apple open up access to Touch ID later on (which they have done), but that those wary of surveillance agencies such as the US National Security Agency may still choose not to use Touch ID.[19]

Roose also noted that complementary metal oxide semiconductor (CMOS) sensors, such as those found on Touch ID, generally wear out and become unusable after some period of time, and while Apple may have found a way to manufacture the sensors better, if the sensors stop working, users may just switch back to using their passcode, making fingerprint recognition a non-starter once again. Roose also noted that fingerprint technology still has some issues, such as the potential to be hacked, or of the device's not recognizing the fingerprint (for example, when the finger has been injured).[19]

Adrian Kingsley-Hughes, writing for ZDNet, said Touch ID could be useful in bring your own device situations. He said the biometric protection adds another layer of security, removing the ability of people to look over others' shoulders and read their passcode/password. He added that Touch ID would prevent children from racking up thousands of dollars in unwanted purchases when using iPhones owned by adults. He observed that Touch ID was Apple's response to the large number of iPhone crimes, and that the new feature would deter would-be iPhone thieves.

Moreover, he notes that the feature is one of the few that distinguish the iPhone 5S from the 5C.[20] Roose also stated the feature is intended to deter theft.[19] However, Brent Kennedy, a vulnerability analyst at the United States Computer Emergency Readiness Team, expressed concern that Touch ID could be hacked and suggested that people not rely on it right away.[21] Forbes noted a history of fingerprints being spoofed in the past, and cautioned that the fingerprints on a stolen iPhone might be used to gain unauthorized access. However, the article did say that biometrics technology had improved since tests on spoofing fingerprint readers had been conducted.[21]

Galaxkey was the first company to deploy encrypted email using Touch ID and thus implement two-factor authentication on an iOS device. They noted that fingerprints could be used to gain authorized access to email and files on Touch ID-enabled devices.[21]

Kingsley-Hughes suggested the Touch ID as a form of two-factor authentication, combining something one knows (the password) with "something you are" (the fingerprint).[20] Forbes said that, if two-factor authentication is available, it will be an overall improvement for security.[21]

Forbes columnist Andy Greenberg said the fact that fingerprint data was stored on the local device and not in a centralized database was a win for security.[22]

References

  1. ^ "Fingerprint Scanner On Phones: History & Evolution, But Do We Really Need That?". Web cusp.
  2. ^ a b c Rosenblatt, Seth (September 10, 2013). "iPhone 5S comes with Touch ID fingerprint scanner". CNET. Retrieved September 11, 2013.
  3. ^ Valazco, Chris (September 11, 2013). "Apple's Touch ID Is A 500ppi Fingerprint Sensor Built Into The iPhone 5S Home Button". TechCrunch. Retrieved September 11, 2013.
  4. ^ "iPhone 5S : Une photo du bouton Home avec lecteur d'empreintes digitales ?!". NowhereElse. September 3, 2013. Retrieved September 11, 2013.
  5. ^ "iPhone 5S : Le lecteur d'empreintes digitales confirmé ?!". NowhereElse. September 10, 2013. Retrieved September 11, 2013.
  6. ^ Newton, Casey (September 10, 2013). "Apple's new iPhone will read your fingerprint". The Verge. Retrieved September 11, 2013.
  7. ^ "List of All Fingerprint Scanner Enabled Smartphones". Retrieved May 10, 2016.
  8. ^ a b Hughes, Neil (September 4, 2013). "Fingerprint sensor in Apple's 'iPhone 5S' predicted to boost mobile commerce, enterprise adoption". AppleInsider. Retrieved September 11, 2013.
  9. ^ a b "Apple Announces iPhone 5S - The Most Forward-Thinking Smartphone in the World". The Wall Street Journal. September 10, 2013. Archived from the original on September 13, 2013. Retrieved September 11, 2013. {{cite web}}: Unknown parameter |dead-url= ignored (|url-status= suggested) (help)
  10. ^ a b "Apple announces iPhone 5S: Touch ID fingerprint security, 64-bit A7 CPU, new gold option coming Sept. 20". AppleInsider. September 10, 2013. Retrieved September 11, 2013.
  11. ^ Gilbert, Ben (September 10, 2013). "iPhone 5s fingerprint sensor called Touch ID, recognizes your thumb on the Home button: here's how it works and what it does". Engadget. Retrieved September 11, 2013.
  12. ^ a b "Apple: New iPhone Not Storing Fingerprints, Doesn't Like Sweat". Digital. The Wall Street Journal. September 11, 2013. Retrieved September 11, 2013.
  13. ^ "Efficient Texture Comparison". Digital. US Patent & Trademark Office. May 18, 2012. Retrieved November 21, 2013.
  14. ^ "iOS Security Guide" (PDF). Apple Inc. March 2017. Retrieved March 26, 2017. {{cite web}}: Cite has empty unknown parameter: |dead-url= (help)
  15. ^ Rieger, Frank (September 21, 2013). "Chaos Computer Club breaks Apple Touch ID". Chaos Computer Club. Retrieved September 21, 2013.
  16. ^ Musil, Stephen (September 22, 2013). "Hackers claim to have defeated Apple's Touch ID print sensor". CNet. CBS Interactive Inc. Retrieved September 23, 2013.
  17. ^ Rogers, Marc (September 23, 2013). "Why I Hacked Apple's TouchID, And Still Think It Is Awesome". Lookout. Archived from the original on 2017-03-24. Retrieved September 23, 2013.
  18. ^ https://blog.lookout.com/iphone-6-touchid-hack
  19. ^ a b c Roose, Kevin (September 10, 2013). "Will the New iPhone's 'Touch ID' Feature Finally Make Fingerprint Scanning Happen?". New York (magazine). Retrieved September 11, 2013.
  20. ^ a b Kingsley-Hughes, Adrian (September 10, 2013). "iPhone 5S with Touch ID is a big win for BYOD security". ZDNet. Retrieved September 11, 2013.
  21. ^ a b c d Greenberg, Andy (September 10, 2013). "Apple's New iPhone 'Touch ID' Makes Fingerprint Scans Easy, But Don't Ditch Passcodes Yet". Forbes. Retrieved September 11, 2013.
  22. ^ Steinberg, Joseph (September 13, 2013). "Your New iPhone Can Put Your Identity At Risk". Forbes. Retrieved July 5, 2014.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Touch_ID&oldid=788849067"