1

Yesterday I logged on to my banking app via my iPhone. The normal procedure was to enter information that consisted of:

  1. The answer to a security question. This had to be entered in full and was the same during each login.
  2. Three characters from an additional string. The specific characters asked for were different for each login.

A message appeared which said that they were "upgrading" this to be more secure. It involved setting up a security answer (a string which was different to [1]). However, after using this it simply said that touch (fingerprint) ID could be used instead of using any of this information.

In theory this sounded ok, but it then said that it would work for anyone who had a fingerprint access for the device. The device in question is an iPhone SE. Given it's possible for multiple fingerprints to work on an iPhone I was wondering how secure this actually is?

I have a couple of thoughts on this:

  1. If I have to enter the details as in [1] and [2] then only I know them (unless they are leaked). So in theory only one person knows these details (me).

versus:

  1. If someone else has fingerprint access on the device I use they can enter the app without any additional details.

My thoughts were what if this was a shared device (e.g. family iPad/phone)? This is possible - and quite often the case - for example:

Or, maybe you share an iPad with your significant other, and they want to use Touch ID too. There’s any number of valid scenarios where you’d want to use a different finger with your Touch ID sensor. Luckily, Apple anticipated this because iOS allows you to add as many fingerprints to your device as you want

(Source: https://www.howtogeek.com/205525/how-to-add-touch-id-fingerprints-to-iphone-or-ipad/)

In the previous method it relied on someone entering details only they knew, versus a method multiple people may be able to perform.

I won't name the bank in case this is some serious issue.

Please can someone provide details about whether this is genuinely a step in the right direction in terms of security and whether there are advantages/disadvantages over the previous method?

  • So you saved your login in your ICloud Key Chain and it is filled in when you use the App? Or is there no more Input required? – Jens Krüger Jul 3 at 11:47
1

The problem with multiple fingerprints: The bank application can't store the actual fingerprint nor a mathematical representation of it (like a number or a hash). The only thing that the application receives is something like "true" or "false", meaning "true" if the Touch ID was successful and "false" if it wasn't successful. And for security reasons that is really all Apple provides when using Touch ID. An application can't ask for a specific fingerprint on the device.

The implication of this is that other persons who are authenticated with Touch ID on your iPhone could also use the bank application since the iPhone would provide a successful Touch ID authentication to the application.

So if I were you I wouldn't change to Touch ID for the bank application.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.