In theory, there's no difference between theory in practice; In practice, there is. ;]
OTOH, Here is a supposed example of an attacker circumventing TouchID iPhone-access controls: "The video shows in detail how CCC member "Starbug" managed to fool the Touch ID sensor of Apple's new iPhone 5s – using only a scanner, tracing paper, a pcb and wood glue." [1]
https://www.heise.de/video/artikel/iPhone-5s-Touch-ID-hack-i...
More real-life conditions (smeared print, non-glass surface) would be interesting to reproduce.
My guess is that it ups the ante significantly for cost of hacking.
(Remember that iOS locks and/or wipes devices after 10 failed attempts. You want to go to however much effort is required to be perfect the first time.)
I can think of a number of situations one could create where a person would have no incredulity about actually inking their fingers and carefully applying fingerprints to a piece of paper. Committed adversaries aren't scared of crimes like "impersonating a police officer", remember.
You only get 5 attempts at TouchID - 10 attempts is for the passcode.
Wasn't that whole "Can the FBI convince Apple to unlock this iPhone" case solved by backing up the NAND memory and constantly reflashing it after the 10 attempts were used up?
I imagine the same process can be applied in this case too
That is exactly what the article says. Specifically:
The researchers did not test their approach with real phones, and other security experts said the match rate would be significantly lower in real-life conditions.
and
“To really know what the impact would be on a cellphone, you’d have to try it on the cellphone,” she said.
and
Dr. Ross acknowledged the limitations of the work.
Half of the article is about the limitations of the approach the paper used, so I fail to understand your criticism of the reporting.
That said, the headline still explicitly calls out smartphones.
Grr, hate it when they do that, it's clearly too hard to add a second link "previously the linked article was: ..."?
Since most people won't actually read and digest the full article, but instead go by the headline "That Fingerprint Sensor on Your Phone Is Not as Safe as You Think" and read the first paragraph or so, none of the caveats matter much, people will walk away with the impression that this is a verified fact.
when in fact, probably they are
You are indeed correct. I wish someone would do a full test on how secure the readers are.
"Experiments on a capacitive fingerprint dataset, similar to the one used by Apple TouchID, showed that it is possible to break 6.88% of users’ account in 5 attempts if the FMR setting of the matching algorithm (Verifinger 6.1 SDK) was set to 0.01% and each subject was enrolled with one finger and 12 partial impressions per finger."
It seems that using commercial fingerprint software and captive systems 'similar to the one used by Apple TouchID' is very different from actually testing your theories against, you know, Apple TouchID.
The way you believe TouchID works may be significantly better or worse than it actually does, so don't you need to test iPhones if you're going to be giving scary quotes to reporters about them being insecure?