If someone wants what you have bad enough, there really isn't anything you can do to stop them.

TouchID is highly secure if the only way to break into it is to have an ultra high-def image of the exact finger the device is looking for. I guess 50 character-long passcodes aren't secure because you could just tell a thief the code?

We must have wildly different definitions of "highly". I'm pretty confident I could reproduce this result in one afternoon. Compare that to other things we might consider highly secure, like strong encryption or Fort Knox. What word do you use for security measures that take non-trivial resources to circumvent?

How do you approach that part of the problem?

But if I were trying to break into an iPhone, perhaps the finger prints are on the phone. Or some other item I also got as part of the same theft. Or I found the phone in the owner's house when I robbed it and have my pick of surfaces. Or I have the owner's prints in a database because they went were convicted of a crime(I admit I have no idea what resolution those are taken at). I don't think there's a shortage possibilities. You leave prints on almost everything you touch.

To be extra clear, I'm not saying the finger print reader isn't good enough for most iPhone users; I'm not arguing the nth-grandparent's point about that. My point is that it's not highly secure, and Apple shouldn't be marketing it that way. Similarly, the lock on my front door is plenty good for my house, but no one would ever describe my house as highly secure.

You do have a very valid argument.

It needs a 2400 dpi output. This is not hard. 300 ppi source can easily generate a 2400 dpi output. DPI =/= PPI.

From what I've found online, chip-PIN does indeed reduce fraud, but when fraud does happen, it becomes extraordinarily difficult for the cardholder to get a refund from the bank.

I could see fingerprint scanning going the same way -- with vendors saying "what do you mean you aren't the one who made this purchase? The device was unlocked with your unique fingerprint!"

You're baselessly asserting your position, though.

If you write your pin on your ATM card, they will not refund you. That is policy and they ask everytime you lose your card. The bank views this as lack of due care. Likewise, if you leave copies of your fingerprints on your payment device, they could argue that you are likewise acting with un-reasonable care.

Now that this has been (so easily?) spoofed, is it reasonable to believe it is secure? That is a valid concern. Unlike a pin, you cannot reset a fingerprint security mechanism. So when it is compromised, it is over. So, the result is messy in that it puts you in a problem using today's standard practices, but at the same time, the standard practice "defense" is not applicable, and lacks an obvious alternative.

This is not a strawman, its a legitimate edge case.

3. I will hold in strict confidence my personal identification number (PIN). I will take reasonable precautions to keep my PIN separate from my ATM card and to prevent the unauthorized disclosure of my PIN.

So, you sign an affadavit verifying you did not contravence this agreement. They will screen for this as/if you file a claim for fraud.

I live in Europe, and twice in the last two years or so my card details have been compromised, and both times my bank has rang me to notify me of suspicious transactions before I'd even noticed. It depends on the bank (and the country most likely) with regards to getting a refund. I got refunds no problem, but I've heard people having problems in the UK. The fraud happened online (not sure how, I'm reasonably tech savvy and careful with my card details).

I believe that this has now changed (although I've not had a new card recently and I don't remember seeing any new TOS).

Buying apps with your device is not terribly useful unless you have take full posession of the device, in which case the owner can remote lock/wipe it with iCloud and dispute the charges with their CC company.