Feeds

iPhone 5S: Fanbois, your prints are safe from the NSA, claim infosec bods

But is it a decent authentication method? The jury's out...

The essential guide to IT transformation

Apple’s decision to bundle a fingerprint scanner with its newly unveiled iPhone 5s has the potential to become a game-changer for personal device authentication.

But the success of "Touch ID" fingerprint authentication will depend on security as well as reliability, according to market-watchers. The fruits of Apple's acquisition of fingerprint tech firm AuthenTec for $356m last summer are the long awaited arrival of a fingerprint-based authentication system, that only comes in the top-of-the-line iPhone 5S.

The authentication system features a redesigned home button and a metal sensor ring around it. Apple's promotional blurb explains: "[The sensor] uses advanced capacitive touch to take, in essence, a high-resolution image of your fingerprint from the sub-epidermal layers of your skin. It then intelligently analyses this information with a remarkable degree of detail and precision."

The technology will be used to authorise purchases through the Apple store as well as the obvious application of unlocking the device.

Fingerprint authentication has been bundled with laptops for years and has been a feature of handheld computers (such as Pocket PCs) for almost as long. External readers are also readily available. Nonetheless, a new fingerprint reader for iPhone smartphone is likely to spur widespread use of fingerprint readers as authenticators, the argument goes.

Tony Cripps, principal device analyst at market watchers Ovum, noted that "integrated capacitive fingerprint sensor will build legitimacy for the technology in mainstream consumer electronics, although privacy concerns are bound to raise their heads in these newly paranoid times."

Apple's previous security missteps have made security experts cautious about whether it's got its fingerprint recognition technology right at the first attempt.

Dirk Sigurdson, a mobile risk management specialist at vulnerability management and pen testing firm Rapid7, commented: "Apple has on a number of occasions released flawed versions of its passcode lock implementation which allows attackers to bypass lock screen protections.

"With the added complexity of biometric authentication it’s likely that we’ll continue to see vulnerabilities related to these features. It will remain important for companies to monitor iOS vulnerabilities and to implement a method for updating devices when fixes are available."

Biometrics: What's stored on the A7 stays on the A7

Apple is storing biometric information locally on the iPhone in a "secure enclave" on the new A7 chip that, says Cupertino, can only be accessed by the fingerprint sensor itself.

"Fingerprint stays only on the A7, never goes to iCloud, and is encrypted," noted Rik Ferguson, veep of security research at Trend Micro in one of a series of tweets playing down fears over the iPhone 5S's privacy features (examples here and here).

Ferguson slapped down accusations that Apple is somehow fulfilling an NSA request by introducing fingerprint recognition tech on its high-end smartphones.

He said: "Why is a fingerprint sensor on an iPhone such a violation of privacy when laptops have featured them for years and no one even blinked? Giving our fingerprints to Wintel PCs and various border control for years but Apple = NSA? This is crazy."

Paul Henry, security and forensic analyst at security software house Lumension, said that testing is needed to verify Apple's claims that the device offers locked down security for biometric data.

"What we need to know is how good a job did Apple actually do securing the biometric data. They say it’s encrypted and not shared with other applications, but we’ll have to wait and see how it works in practice. We also need to know if it’s a single sign on approach. If a single fingerprint grants access to other services (particularly iCloud), that’s a frightening prospect if Apple hasn’t done a truly expert job at securing that local credential."

Boost IT visibility and business value

More from The Register

next story
So, Apple won't sell cheap kit? Prepare the iOS garden wall WRECKING BALL
It can throw the low cost race if it looks to the cloud
Apple's iWatch? They cannae do it ... they don't have the POWER
Analyst predicts fanbois will have to wait until next year
AMD unveils 'single purpose' graphics card for PC gamers and NO ONE else
Chip maker claims the Radeon R9 285 is 'best in its class'
Barnes & Noble: Swallow a Samsung Nook tablet, please ... pretty please
Novelslab finally on sale with ($199 - $20) price tag
Apple to build WORLD'S BIGGEST iStore in Dubai
It's not the size of your shiny-shiny...
Just in case? Unverified 'supersize me' iPhone 6 pics in sneak leak peek
Is bigger necessarily better for the fruity firm's flagship phone?
Steve Jobs had BETTER BALLS than Atari, says Apple mouse designer
Xerox? Pff, not even in the same league as His Jobsiness
Leak: Intel readies next round of NUC
Cheap boxen to get a refresh
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?