That's why I have an "assumptions" part. It doesn't matter though, it will depend on the implementation of the fingerprint scanner.

The gist is, a password and a fingerprint are not the same thing. Fingerprint is not a weaker password or anything like that, they have different properties and as a result they have different pros and cons. For example, no one can copy your fingerprint by looking over your shoulder - unlike a password.

I think accounting for scenarios where someone might want to cut your finger off to gain access to your device is covered under the thread modeling reply above closer to the parent comment. Which makes sense. If I'm a cartel boss, I'm definitely not using biometrics. But if I'm a college sophomore who doesn't have any nation state enemies, then biometrics is fine.

> Your finger can be cut or you might be forced to unlock the device.

How common is this scenario? I imagine it is a lot less common than passwords getting stolen or cracked.

Contrary to how some people here are acting, most people aren't targets of foreign foreign espionage.

if they are about to cut off my finger, I'm pretty sure I will just tell them my sudo password of my local machine. at that point they can modify all they want on my laptop.

Touch ID specifically requires a live finger. Other fingerprint readers might not.

You can also be forced to reveal or enter the password.

> Touch ID specifically requires a live finger.

I remember reading about one school which implemented "live finger" readers.

How did kids hack it?

Polymer clay and a gummy bear.

Put your finger on clay and wait for it to dry. You will have your permanent mirrored fingerprint.

When required fingerprint press gummy bear against clay and then against the reader. As gummy bear holds charge, can even be cut thin etc. there is little chance to detect that it is not a real skin.

You are missing the "requires a live finger" part.

The biometric system (sensor + algorithm) used by Apple, as well as other competitive biometric vendors, detect blood flow, pulse in the finger. This is done as a mitigation against fake fingers as well as the (always presented) gory "cut off the finger" attack scenario.

A gummy bear may be lifelike, but normally lacks a beating heart and circulatory system.

Most fingerprint sensors that look for a pulse can be fooled by a gummy bear that has been sliced thin enough to allow the pulse to pass through, but thick enough for the ridges to be picked up. Think about something around a millimeter thick.

> A gummy bear may be lifelike, but normally lacks a beating heart and circulatory system.

“Normally”?

Sure, everyone says they want humanely sourced gummy worms. But there’s still a niche market for that fresh worm with the gummy goo still coagulating.

If this is the case, why does Touch ID unlock a device in less time than the gap between heartbeats?

No, it only means that the device reported a match; or, that a match signal came in on a certain hardware port (since the scanner may have been replaced, tamperered with, etc.).

Not necessarily, it depends on the implementation. On Apple's case AFAIK the fingerprint mach doesn't simply report a match but also provides the system with the key(which was stored in a separate system) to decrypt the data. You can't simply connect a bogus fingerpront scanner to an Apple device and access the system, in fact that's the reason why unauthorised repairs end up having the touch ID or Face ID broken.

Same on Android. Fingerprint is used to enable access to cryptographic key.

That was literally the second half of the sentence (which you left out, unless GP edited their post).