Question for #infosec crowd. I've always stayed away from TouchID (or similar) due to not wanting Apple (or other companies) to have access to my fingerprint. Am I wrong?
@mr_oova Most fingerprint detection systems built into mobile devices (not sure about TouchID specifically) store the biometric data locally, often in a "secure element", so, at least pro forma, the vendor does not get access to it. However, since the vendor controls the entire OS around it, one has to assume they can get access, at minimum when you unlock the device. Stationary scanners tend to be connected to databases directly, they don't even pretend otherwise. Also: In many jurisdictions you can be legally compelled (usually incarcerated until you comply, more or less indefinitely) to provide your fingerprints to police, which is often not true for passwords. They are easy to obtain against your will anyway (for example I have the fingerprint of former minister of the interior of Germany, Wolfgang Schaeuble, as a literal stamp right here: https://shop.digitalcourage.de/stempel/stempel-schaeubles-fingerabdruck.html), and you have a limited number of fingers you can lose (physically, or through aforementioned shenanigans) before that becomes a problem; Not to mention how many systems get very suspicious if you insist on using a different finger from their default, because the staff do not understand these implications. In short: Stay away from biometrics. They seem convenient until they really aren't; And they can be stolen, faked, and abused easily (especially bad compared to the nimbus of "security" they enjoy).
Add comment