A look at the iPhone 5s Touch ID fingerprint sensor
One of the biggest features of the iPhone 5s announced yesterday is the Touch ID fingerprint sensor that is used for user authentication. Rich Mogull at TechHive has written the definitive Q&A about the sensor built into the iPhone 5s, and there are some fascinating things to know about the future of mobile security.
The first thing Mogull points out is that the Touch ID sensor is based on a capacitance reader, which makes use of the fact that the outer layer of your skin is non-conductive while the subdermal layer is conductive. Mogull notes that when you touch the sensor, "it measures the miniscule differences in conductivity caused by the raised parts of your fingerprint, and it uses those measurements to form an image."
The ring around the sensor, which is embedded in the home button, is used to turn on the sensor and reduce signal errors. As Mogull says, the capacitance design is less easy to spoof than an optical reader (which a photocopy of a fingerprint can fool), less fragile and less prone to error due to smudged glass.
Some internet wag has already created a meme that states that Apple would nab fingerprints to create a huge "name to fingerprint" database. Well, that's not possible. The fingerprint is run through an algorithm to create a fingerprint template, a mathematical representation of your fingerprint. Mogull believes that the template is then run through a cryptographic hashing algorithm and combined with a random or unique number to further scramble the data.
Apple mentioned during the keynote yesterday that the fingerprint data is neither transmitted to the company nor stored on their servers. Instead, it is stored only on the iPhone 5s. Whenever your fingerprint is scanned, the phone does the same template creation and compares the result with the stored hash.
Mogull points out that while fingerprints are more secure because they are impossible to guess, fingerprints and passcodes are still examples of single-factor authentication. A more secure system would require a passcode and a fingerprint. Passcodes are still required if you damage your finger or break the Touch ID sensor.
As for using Touch ID with iCloud and the iTunes Store, Mogull thinks that Apple will store the passwords for those services in the iOS keychain, using your fingerprint to authorize access. OS X and iOS handle stored passwords this way, and it emphasizes Apple's comment that the fingerprint data never leaves the device.
Mogull's bottom line is that Touch ID could be game-changing, in that it makes security invisible. Apple noted during the keynote that it thinks of the iPhone to be a "key," so it wishes to eventually make your phone and fingerprints be the keys to just about everything in your life. Imagine door locks or home alarms that are locked or armed with a fingerprint, or payments that can be authorized with a tap of a finger. In the long run, Touch ID might be the most important feature of the iPhone 5s and future Apple devices.
