Check out our review of the Apple iPhone 5S smartphone.
Get excited, people: We’re all soon going to be fingering our iPhones! Apple’s new high-end iPhone 5S packs a fingerprint sensor called Touch ID, which lets users unlock their devices and buy apps without a pesky password. While fingerprint sensors have been integrated into gadgets for years, you can be sure that Apple’s offering will trot the technology into the mainstream. From the basic functions to NSA snoops, here’s a rundown on everything cool, lame, and mildly disconcerting about Touch ID for the iPhone 5S.
How Touch ID works
Touch ID – which is only available on iPhone 5S, not iPhone 5C – allows users to scan their fingerprints to unlock their phones, or to make purchases from iTunes and the App Store, rather than typing in some obnoxious (and less secure) password.
Apple’s Touch ID sensor is located beneath the Home button, under a piece of sapphire glass that lets the sensor take a highly detailed picture of your fingerprint. Press any finger against the Home button, and a steel ring around the button checks to make sure you’re a living person – that way nobody can cut off your finger to access your device, ‘cause that totally could happen. It then activates the sensor, which records a detailed image of your fingerprint. Provided the fingerprint matches up with the one you have set in the device, your phone will unlock (or your purchase will be made).
Any finger’ll do
Touch ID does not require you to use the same finger every time. Nor does it make you hold your finger at some precise angle – any orientation works, according to Apple. That said, you will certainly have to remove your gloves to use Touch ID, which will suck in cold weather. And it’s possible that shivering or other weird movement might cause some authentication failures – we just won’t know until we try. (Shiver-gate, anyone?) Oh, and those fancy touch-capacitive gloves you bought likely won’t work with Touch ID either, sorry.
Lock it down, folks
Security experts say biometrics, of which fingerprints are the most common type, provide far from perfect security. But we can say with a fair degree of certainty that a fingerprint is going to be better than just the ol’ four-digit PIN that every other iPhone (including the iPhone 5C) still has, if for no other reason than it eliminates one of the many passwords you have to remember these days. It’s also possible that Apple will allow you to use both simultaneously, which really would mean robust security for your iPhone.
The four-digit pin isn’t completely dead
While Touch ID will be one way to unlock your device, Apple says you will still have the option of punching in a four-digit pin, as you would with any other model iPhone.
This means you won’t be forced to use Touch ID if you want to lock your device. We don’t know for certain yet, but we hope this also means that if you have Nutella smeared all over your hands, or suffered some disfiguring finger burn while cleaning out your bong, (perhaps both simultaneously), you’ll still be able to access your phone.
Update: The Wall Street Journal has some additional information on both the 4-digit pin, as well as the finickiness of Touch ID, reporting that users are required to create a pin along with adding their fingerprint signature. Also, “Apple testers have found the device sometimes doesn’t work with moisture-laden fingers covered in sweat, lotion or other liquids.” Touch ID also has “some trouble” reading particular fingerprints, according to an Apple spokesperson. In other words, if you plan to buy the iPhone 5S, check the return policy before you buy, and test out the fingerprint sensor to make sure it works with your mitts.
Go local
When Touch ID was still a rumor, many worried that Apple would store users’ fingerprint data in a central database. Seeming to anticipate these concerns, Apple SVP of Hardware Engineering Dan Riccio explained in the company’s iPhone 5S presentation video that all fingerprint data will be stored in a “secure enclave” on the device’s A7 processor, where it will be “locked away from everything else, accessible only by the Touch ID sensor.”
“It’s never available to other software. And it’s never stored on Apple’s servers, or backed up to iCloud,” said Riccio.
As security expert Bruce Schneier explains at Wired, this type of local storage poses far less a security risk than a centralized database of users’ fingerprints. “If the system is centralized, there will be a large database of biometric information that’s vulnerable to hacking,” writes Schneier. He adds that an individual iPhone can “almost certainly” be hacked as well – but it’s not as risky as a Internet-connected database.
Apple, fingerprint hoarder?
Your iPhone will not store your actual fingerprint – that’s not how modern fingerprint scanners work. Instead, the Touch ID software will convert an image of your fingerprint into a digital signature. This is what will likely be stored on your device, and it’s also what will be transferred over the Internet to Apple when you use Touch ID to make iTunes purchase.
Don’t sweat the NSA
The moment Apple confirmed that its new iPhone 5S would in fact pack a fingerprint sensor, pretty much everyone freaked out with some version of, “Great, now the NSA will have access to my fingerprints, too.” We can understand the concern (kind of) but it’s probably not anything to fret about.
You leave your prints everywhere you go – there are far easier ways to snag them, if the NSA spooks were so inclined.
Yes, a recent report from German magazine Der Spiegel, based on documents provided by whistleblower Edward Snowden, says that NSA analysts have successfully accessed “38 different features of the iPhone 3 and 4 operating systems.” This includes access to “the mapping feature, voicemail and photos, as well as the Google Earth, Facebook and Yahoo Messenger applications.”
And yes, the NSA was able to access targets’ contacts, text messages, call logs, and other data by hacking into a user’s computer that has synced with his or her iPhone. We don’t know whether the NSA has this kind of access to later versions of iOS, which will soon be up to iOS 7. But considering the NSA called iPhone users “zombies” and referred to Steve Jobs as “Big Brother,” it’s not much of a stretch to assume that they will at least try to gain similar access to newer iterations of iOS.
That said, your fingerprint data should not upload to your computer, and should remain encrypted on your iPhone. That’s not to say NSA analysts can’t decrypt stuff – they can – but why would they go through the trouble of hacking your iPhone just to have your fingerprint? Your prints are less revealing than your call logs and chats. And besides, you leave your prints everywhere you go – there are far easier ways to snag them, if the spooks were so inclined. Which they probably aren’t, so chill.
Tight-fisted with fingerprints
As for your fingerprint data getting out into the ether in other ways, Apple has set some restrictions. App developers will not be able to use Touch ID in their apps – at least for now. If you’re worried about the NSA, then this is probably a relief. If you just want sweet new features in your apps that use a kick ass next-gen system, then that’s bad news. But don’t fret – we would bet Apple will open up access to Touch ID once this whole NSA fiasco blows over.
What’s the overall verdict on Touch ID?
Touch ID certainly seems like an improvement over the four-digit PIN system. But we’ll have to give it a try when the new iPhones arrive on September 20 before we can say for certain. The fingerprint sensor definitely seems way more James Bond-ish than anything else out there. And to that we say, badass.
