0

I was wondering how secure Touch ID/Keychain is really. My understanding is that iPhone 5S devices that use Touch ID allow you to enter a passcode if your fingerprint doesn't work, as a "fallback". Now, with iOS8, Touch ID is being offered to apps as a way for users to authenticate.

But... it seems to me that this is far less secure than what many apps currently have. It effectively says that you can use the device passcode instead of an app password (which is stored in the keychain). Since most users only set up device pass codes with four digits, you only need to try up to 9999 numbers, and then you can get into not just the device, but apps such as banking as well (if they use the Touch ID API).

Also, if the device is stolen and jailbroken, with only a four digit passcode, can a hacker get hold of the keychain items for all my apps? This seems like a big risk.

Am I missing something?

Wouldn't it be better if TouchID's "fallback" was a strong password, instead of a four digit code?

|improve this question
  • 1
    I could be wrong, but I believe each app can define its own fallback (e.g., a strong password) in the case Touch ID fails. The 4-digit passcode is just the fallback for unlocking the phone, and is not tied to the use of Touch ID itself. – Stephen Touset Jun 11 '14 at 1:38
4

This is not the case. iOS 8 allows the use of touch ID for apps but the "fallback" for the touch ID in terms of apps are the actual app password. the 4 digit code is only used if touch ID fails to unlock your phone

on a side note, certain apps such as banking can almost definitely chose not to allow touch ID for the app itself or even high-risk functions inside the app e.g financial transactions.

|improve this answer
  • Thanks. That was the piece of information I was missing (on the WWDC presentation it looked like the passcode was being use). If the fallback password is the "app password" then a strong password policy can be enforced for the app, rather than relying on the user setting the device passcode, so nothing is lost. I can't help but remain nervous about the idea of a whole bunch of passwords sitting in the keychain though. Seems like if you get hold of someone's device and can hack the keychain then you have the keys to the kingdom. – Darren Jun 11 '14 at 11:51
  • you're welcome :) although hacking the keychain is not that simple, as you correctly suggested, storing your password on any device is a security risk and always will be. I think it comes to a matter of security vs availability but if correct protections are in place the risk is reduced greatly. – Abbas Javan Jafari Jun 13 '14 at 2:36
  • Hmm. I just tried out LastPass's implementation of the Touch ID API, and it allows me to use the device passcode to bypass Touch ID – Weaverfish Sep 19 '14 at 8:51
  • OK, 1Password's implementation does fallback to the app password, so I guess it's optional – Weaverfish Sep 19 '14 at 9:12
  • It appears that LastPass are not actually using the Touch ID API, but instead using separate SecAccessControl. This allows access based on 'user presence' which means that TouchID or device passcode are acceptable. I am not comfortable with this level of access so I hope most apps will make use of the actual TouchID API. – Weaverfish Sep 19 '14 at 10:27
3

You're missing three things:

  1. Third party apps don't have to use TouchID if they don't want to.
  2. A 4-digit PIN is only weak if the attacker can do an offline attack. You're describing an on-line attack, where the attacker is sitting at the device entering PIN codes. IOS will notice repeated bad codes and take steps. By default after every 10th bad password it disables itself for a period of time; for more security you can tell it to erase itself instead. cf the 4 digit PIN on your bank card.
  3. IOS already allows you to have a strong password instead of a 4-digit PIN if you like. Just turn off "Simple Password" in the settings.
|improve this answer
1

There is still the problem of grabbing the fingerprint of the phone (e.g. display) and copying it to an artificial finger to trick Touch-ID. This has already been demonstrated with not much effort using standard glue (see here as an example: http://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid).

So for a stolen iPhone, this is a real security hazard when you can authenticate with Touch-ID at an offline iPhone. There should be a security option, that Touch-ID would only work if the phone is actively connected to the Internet, so that the phone could be secured by a remote wipe or some other form of remote kill-switch via iCloud (and perhaps even be located).

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.