Nobody's going to bother to recreate your fingerprint, when it's much easier to beat you with a wrench ( https://xkcd.com/538/ ) until they get access to your phone. It's a huge convenience for you though, to unlock it without doing anything extra, as you're pressing that button anyway to turn the screen on. Much easier than typing passwords.

My worry is that this is a gateway drug to "Fingerprint protect all the things!"

My bank emailed me the other day with an announcement that I could access my account through their app via my fingerprint. WTF? My text messages are one thing by now my money is protected by just my fingerprint? I took my bank to task because they allowed my username to be twice as long as the allowed characters in my password. Someone at the bank said, "Hey, all these new-fangled phones have fingerprint readers, why don't we tap into that and sell it as a feature?" When everyone is doing it, no one is going to stop and ask if they should, it's just a race to incorporate the newest features. Normal people aren't asking if this is secure, they are buying into the marketing copy pushed on them, so they start thinking that it has to be secure, because why would my bank not have my interests in mind?

What can the bank app do? Mine can only deposit and view accounts, not withdraw or transfer. Open access to it would be weird, but not much worse than someone fishing my ATM receipts out of the trash to see my balance.

It's Bank of America, so it's about as feature-filled as a banking app gets. You can do all the normal stuff like check balances and deposit checks, but you can also open new accounts (including credit cards) and transfer money (between other accounts you own or to other people outside the bank). And yes, the app has the ability to add new transfer recipients, which only needs their email address or phone number. There is a protection to guard against unauthorized adding of new recipients, but you guessed it, the protection is in the form of a 2FA code sent via SMS. So if you're already in the phone and in the banking app you can add yourself as a transfer recipient with your email address and verify the recipient addition because you can read the incoming text messages too. And the warning email that comes when you add a new recipient and initiate a new transfer is likely going to come to the same phone you're currently holding. If you get into my banking app through my phone you can send yourself as much of my money as you want and cover your tracks so I wouldn't know until my next statement comes, and to top it all off, it looks like I was the one who sent the money to you, so how am I going to argue that I didn't?

This is scary enough I'm uninstalling my app just incase they add these "features" in an update. Thanks. Oh well, no big loss.

Thank you for validating my decision to not put any BofA online banking apps on my phone.

Yeah, no-one will steal your fingerprint, just like no-one will crack a reasonably strong password. But if every site has a copy ...

It's quite possible that your fingerprint has already been stolen

http://www.theguardian.com/technology/2015/sep/23/us-governm...

The bottomline is that if someone can hack a server to steal your fingerprint, they can just as easily use the same method to steal your method so I don't really see the differen imho.

The bottomline is that someone doesn't need to hack a server to steal your fingerprint, you leave those everywhere you go as virtual gifts to any passers-by. All they need to do is steal your phone, and that's pick-pocketing level easy.

Ummm, if I lose my phone, I'm just going to remotely disable it so there's no way the person who stole my phone can reach my data.

So, you're using full-disk encryption on your phone and the remote kill switch flushes the key?

Otherwise the data is still there in the plain, accessible by anyone who can read the flash.

If you're using a Nexus 5X or 6P on Android 6, then probably yes.

Android 5 has full disk encryption but was disabled by default on the Nexus 5 (and most other phones) due to performance issues.

Do the Nexus 5X or 6P finally have hardware encryption support ?

I didn't notice any mention of those, specially because they failed miserably last year parading full disk encryption on Nexus 6 and got bitten when reviews showed the performance degradation and lack of hardware encryption.

It's a good question, I've looked and the Qualcomm Snapdragon 810 has the support needed, but I don't know if it'll be enabled by default or not in Android 6.

If it's not, then Google are starting to take the piss..

Except that you can't choose a different fingerprint for each app/site. Lose it once and all your accounts are compromised.

All the apps that I use give me the option to not use fingerprint login.

*steal your password

Fair point, it should be used for convenience, not for real security.

.. non-hackers will equate it with security.

Non-hackers aren’t responsible for data security. Well, except for Sony. And every other company that doesn’t deal with data security in particular.

"Nobody's going to bother to recreate your fingerprint, when it's much easier to beat you with a wrench ( https://xkcd.com/538/ ) until they get access to your phone."

I think this misses the point. Accessing a device using a "cloned finger" (not tremendously difficult) can be done without the target ever knowing it has happened.

The wrench technique, less so.

Yes, but is it worth spending the required resources? If the answer is yes, than anyway the 4 digit pin isn't more secure (you can watch people type them and find out the code).

You can change your code. The fingerprint is a bit more difficult. That's my main issue with biometric security, revocation of compromised credentials (e.g. fingerprints) is difficult or impossible.

Not only that. With fingerprints, you are essentially using the same password everywhere. You just need to lose it once and all your accounts would be compromised.

> Nobody's going to bother to recreate your fingerprint,

Whyever not? They might have a copy of it lying around. http://www.theguardian.com/technology/2015/sep/23/us-governm...

> Yes, but is it worth spending the required resources?

When it becomes easy - and it will become easy, there's nothing basically hard about printing out some ridged plastic - it will become commonplace. And unlike stolen passwords, an attacker can be fairly sure that you haven't changed your fingers.

(I'm not a lawyer, I've just read a bunch of blogposts/discussions on the issue)

There's a legal difference in some places between having your phone secured by a fingerprint and a password. If your phone is secured by a password, then in some places you cannot be obliged to provide the password, but a fingerprint you can.

Where are those laws in place?

In the US in particular.

There was a bunch of reporting in the past few days that a Federal District Court in Pennsylvania found that Fifth Amendment rights apply to smartphone passcodes.

Random link: http://www.digitaltrends.com/mobile/why-the-government-cant-...

That same protection doesn't seem to apply to fingerprints. Random link: http://time.com/3558936/fingerprint-password-fifth-amendment...

Again, I'm not a lawyer, but that seems to be how the law falls out on that issue.

Whether that's an issue for you, personally - no idea. It might be a factor for some.

The other thing about the US is that occasionally you'll find a police department that's willing to bend the law. They can make you touch the fingerprint sensor and then claim that they never did and they found your phone unlocked, and it'll be your word against theirs. If the court believes the police, which they are culturally inclined to do, the Fifth Amendment question doesn't even come up.

One of the neat things about encryption, historically, is that the government couldn't force decryption even if it were willing to break the law in doing so. That's why there were export controls and demands for backdoors in the '90s, and that's why there are demands for backdoors today. Fingerprint locks may mathematically involve encryption, but they don't have this property.

I wonder if its possible to counter this through obscurity. Since the sensor is on the back of the phone, you can use your ring finger to unlock it instead. If >3 attempts with any other fingers are made, then the phone will be locked with a password. That way, you still keep your right to protection.

I think the OPM data breach recently put about 10 million fingerprints and a ton of associated personally identifying information into the hands of people who have clear motivation to hack the cell phones of many of the people impacted.

Many countries now take fingerprint scans when you cross the border. Even if they themselves never use it, its easily conceivable that they could be hacked or leaked. Then what? You can't revoke your fingerprint.

Who will bother to recreate the fingerprint, most of us aren't that important? (I'm not) :) Don't get me wrong, I do understand the main problem is that you can't change this "token" and it's something that the people have easy access to. It shouldn't be used to keep data that has a higher value than the effort required.

The real risk is that if it reaches a certain level of ubiquity (which it appears it is), authorities will invest in a) laws and b) technology to break it with almost trivial ease. The US already has my fingerprints on file from crossing the border. Presumably it means that if they wish they could trivially unlock my phone and search its contents. I fully expect that if fingerprint access does become the universal security mechanism used on computing devices we'll soon enough have fully automated solutions where law enforcement can either download your fingerprint from their existing database or scan it from any available surface in real time and apply an image to the sensor to fool it into unlocking. Obviously this will take a while to happen, so for now people are lulled into a rather false sense of security that their fingerprints are a "pretty good" way to secure their phone when they are only "pretty good" because technology will take a few years to automate the breaking of them, at which point they will become "very bad".

Why bother breaking into a phone manually when you already have access to all the data it sends, receives, and contains (especially now that cloud storage solutions are all the rage)? What do passcodes and fingerprint scanners even mean when the target data is already being made accessible to national governments through more convenient channels?

In my mind, the only reasons tech giants continue to force centralization on their users are PRISM and data mining. Today’s devices have sizable internal drives, so all personal data could realistically be stored and processed locally; and secure, distributed systems have been proven to work for data transfer (BitTorrent), monetary transactions (Bitcoin), message boards (Aether—sort of), and more. Hopefully solutions like Copperhead OS and Blackphone that secure our mobile devices and communication channels, respectively, make it to the mainstream.

Bottomline is that in this day and age, if someone wants to hack a server and steal passwords, they can so it probably doesn't matter.

Not exactly, that's what bcrypt and scrypt are for. Attackers would have to modify the running code to divert raw passwords elsewhere, which would be a lot more noticeable.

No, that's not the bottom line. One fingerprint opens everything and cannot be changed. You can use a different password for each site so when some craptastic one gets compromised, you're not screwed for life.

Wrench, meet plausible deniability: https://en.wikipedia.org/wiki/Plausible_deniability#Use_in_c...

People who say this never game this out.

1. Attacker sees random data.

2. Attacker knows you might be smart enough to use a plausible deniability file system.

3. Attacker starts beating you with the wrench.

At this point, there are several possibilities that could happen:

1. You give up the secret and give the attacker what he wants. The beating continues after this point, because the attacker really has no idea if you've given up the right secret.

2. You give up a fake secret and give the attacker what he thinks he wants. The beatings continue. See possibility #1.

3. You don't give up the secret and he continues beating you with the wrench anyway to try to get you to reveal the secret.

4. You're not using a plausible deniability encryption at all, and it truly is random data, and he continues to beat you with the wrench to make sure.

As you can see, the wrench doesn't give two shits about your plausible deniability.

…unless drives were encrypted by default, in which case the wrench would have no method to distinguish the two! Any reasonable wrench would not pursue such a doubtful case anyway. And regardless, the goal is not to avoid being beaten by the wrench, but to sustainably deny the existence of the secret. There is no incentive to ever give up the actual secret when the wrench cannot tell the difference and must continue beating (which would only happen at high levels of worth or likelihood); I might as well have continued lying.

NOW GIMME MY SHITS

If your threat model involves wrench, you are OOL. Fortunately, its not true for most of us.

The world is rife with wrenches and people willing to use them. PD is only good against people who don't have legal leverage against you, and those not willing to break the law to get it.

I thought I wouldn't care for it on the iPhone, but it's honestly a nice convenience. It's not for security, it's for simple auth (like when unlocking the phone or authorizing a payment on the app store).

> (like when unlocking the phone or authorizing a payment on the app store)

Aren't these the things where you'd want security?

Unlocking your phone is done so frequently that many people opt not to secure it. The best security is one that you use. It's arguably more secure than a 4 number passcode, which someone can easily watch you enter over your shoulder.

Buying things on the App Store requires you to type in a password for the first purchase every so often. Then you use your finger print.

> It's arguably more secure than a 4 number passcode

My friends often have to share their passcodes with me; at which point it's like, what's this adding?

I don't have a passcode on my phone to protect it from my friends ... similarly I don't have a lock on my front door (that I give spare keys to friends for) to protect me from my friends.

This is a good point.

I guess that I think once you share it a few times and it's used regularly, then it becomes fairly public knowledge. Maybe this is a mis step from password security.

Passwords can always be changed to "reset the access list" if you will, if you're uncomfortable with how widely spread knowledge of the password has become. Biometrics, on the other hand ...

Yes but... passwords are useless.