It's also not stored on the device. Hashes, not fingerprints, are stored.

You need the fingerprints themselves to fake out the hardware.

Well, they have to store fuzzy hashes rather than cryptographically secure ones since they're going to get a different section of the finger and slightly different features within that finger each time. There's a good chance that whatever form of fuzzy hashing they're using is reversible in the sense that, given a hash, you can create a fingerprint that isn't necessarily exactly the same as the original but will match that hash.

For example, the obvious approach is to store fingerprint features, which will be then matched by any print that has the same features in the same positions. If you do a good enough job of generating the new print you might even be able to fool police investigations, since they compare prints the same way.

Looks like fingerprints have 30-40ish bits of entropy depending on how forgiving the device is, so unless they're doing some key stretching it should be practical to produce an image of a similar fingerprint by brute-forcing the hash with every biologically likely fingerprint.

http://lukenotricks.blogspot.com/2009/04/on-entropy-of-finge...

Rare is the phone without the owner's fingerprints stored all over it.

Not true at all. There are quite a large number of cases out there that would be hard to lift fingerprints from. If the owner has this sort of case, and if the owner has cleaned the screen recently or just had the phone pocketed, thus wiping the screen off rather well...I think there are a large number of phones from which you would get no prints.

Sure, but his post was about stealing data "over the Internet". That's not possible.

All bets are off with physical access to the hardware, of course.

Nobody has been able to use those low quality fingerprints to defeat TouchID.

I wouldn't count on that. See https://twitter.com/dotMudge/status/381900643415240704

That picture shows a carefully polished phone into which someone has meticulously placed 5 careful fingerprints - as if they were being taken at a police station, nothing like the fingerprints you get in normal use.

I think it's a hot topic in security circles right now that a worm or virus could infect these mobile devices and "phone home" with the data, resulting in a media nightmare.