I was wondering how secure Touch ID/Keychain is really. My understanding is that iPhone 5S devices that use Touch ID allow you to enter a passcode if your fingerprint doesn't work, as a "fallback". Now, with iOS8, Touch ID is being offered to apps as a way for users to authenticate.
But... it seems to me that this is far less secure than what many apps currently have. It effectively says that you can use the device passcode instead of an app password (which is stored in the keychain). Since most users only set up device pass codes with four digits, you only need to try up to 9999 numbers, and then you can get into not just the device, but apps such as banking as well (if they use the Touch ID API).
Also, if the device is stolen and jailbroken, with only a four digit passcode, can a hacker get hold of the keychain items for all my apps? This seems like a big risk.
Am I missing something?
Wouldn't it be better if TouchID's "fallback" was a strong password, instead of a four digit code?