Hands on the iPhone TouchID
Last week, the Apple iPhone 5 entered the market, its TouchID fingerprint sensor exposing biometric security to a more mainstream audience than ever before. Symptomatic of any product launch, the Apple iPhone 5 was not without its bugs. Reports emerged that the iOS 7 lockscreen could be bypassed with an exploit, enabling unauthorized access to photos, which will surely be patched in a future update.
More shockingly, a European hacking group has even claimed to be able to crack TouchID with nothing more than a 2400 DPI photo of a fingerprint printed heavily to a transparency and transferred to a thin layer of latex; although they note such a crack works on virtually all biometric sensors.
Barring such exceptional “Mission Impossible” scenarios, the veracity of which remains to be determined, the Apple iPhone 5 is a step in the right direction for biometric security; the biometric itself is implemented intelligently and it extends many of the strong security protocols inherent to iOS 7.
First, a bit about passcode security. We know that a four-digit passcode has 10,000 permutations and that a six-digit passcode has a million permutations, but there are billions of permutations for fingerprints; at this most basic level it is evident that a fingerprint offers a much stronger lock.
However, the strength of this lock is dependent on the strength of the architecture/design used to implement it. What we do know about the TouchID fingerprint sensor would indicate that Apple has done a lot to implement the biometric in the right way. Specifically, the iPhone does not store the fingerprint image; rather, encrypted fingerprint information is securely stored on its A7 chip, available only to the TouchID sensor - sequestered from any other access. This information is never made available to other apps, never stored on Apple server and never backed up to the iCloud, so users never have to worry about compromise through other channels.
Senator Al Franken underscores why this separation is so important:
"Passwords are secret and dynamic; fingerprints are public and permanent," wrote Sen. Franken."If you don't tell anyone your password, no one will know what it is. If someone hacks your password, you can change it—as many times as you want. You can't change your fingerprints. You have only ten of them. And you leave them on everything you touch; they are definitely not a secret. What's more, a password doesn't uniquely identify its owner—a fingerprint does. Let me put it this way: if hackers get a hold of your thumbprint, they could use it to identify and impersonate you for the rest of your life."
Apple TouchID incorporates the strength its biometric authentication into the iOS security. The biometric unlocks the device, which in turn unlocks the decryption keys for the encrypted files. Depending on the file classification; the decryption keys are deleted upon locking or power down. By strengthening the unlock process with fingerprint the security of encrypted files is much stronger as well. Recall that a fingerprint has billions of combinations as opposed to ten thousand for a four digit passcode.
However, it is important to realize that while the TouchID fingerprint sensor is a good step forward for biometric security and a great way of exposing it to the mainstream; access security is only one aspect of mobile security. It is still possible for malicious mobile applications and attacks to compromise a mobile device once it is unlocked; no amount of biometric security can prevent this. A comprehensive mobile security strategy needs to combine access security with the ability to monitor mobile traffic and app behavior to prevent unauthorized access and infection.