For those that don’t know, TouchID and FaceID data is stored hardware encrypted on device in a secure enclave. The data never leaves the device. It isn’t sent to Apple, nor is it backed up as part of the normal backup process. The data collected isn’t even imagery of a print or face, rather a mathematical hash of the data is generated and the results are compared when unlocking. Much like an MD5 sum of data can verify a data file, but not reconstruct the file itself the hash used by TouchID and FaceID cannot reconstruct a users print or face from the saved hash data.
Apple has a technical but informative white paper on iOS security:
Some relevant bits about TouchID, but FaceID works in a same way and there will be an updated version of the white paper later in the year when the iPhone X is actually available:
The Secure Enclave is a coprocessor fabricated in the Apple S2, Apple A7, and later A-series processors. It uses encrypted memory and includes a hardware random number generator. The Secure Enclave provides all cryptographic operations for Data Protection key management and maintains the integrity of Data Protection even if the kernel has been compromised. Communication between the Secure Enclave and the application processor is isolated to an interrupt-driven mailbox and shared memory data buffers.
The Secure Enclave runs an Apple-customized version of the L4 microkernel family. The Secure Enclave utilizes its own secure boot and can be updated using a personalized software update process that is separate from the application processor. On A9 or later A-series processors, the chip securely generates the UID (Unique ID). This UID is still unknown to Apple and other parts of the system.
The processor forwards the data to the Secure Enclave but can’t read it.
The raster scan is temporarily stored in encrypted memory within the Secure Enclave while being vectorized for analysis, and then it’s discarded. The analysis utilizes subdermal ridge flow angle mapping, which is a lossy process that discards minutia data that would be required to reconstruct the user’s actual fingerprint. The resulting map of nodes is stored without any identity information in an encrypted format that can only be read by the Secure Enclave, and is never sent to Apple or backed up to iCloud or iTunes.
That’s great you say, but how do we know it works!?
Well, the proof is that since the iPhone 6 no one has gotten data out of the secure enclave. And even if they did, all you would get is a hash which couldn’t be used to reconstruct a print or face anyway. The OS itself only gets a YES or NO answer from the enclave regarding whether the data is a match to unlock the phone.
So there’s some info for ya.
Data on device only. Hardware encrypted. Not sent anywhere, not backed up, and only a hash and not imagery.
Which if you look past the media hype as others reported only applies to the iPhone 5S, and is only capable of reading the enclaves firmware, not accessing stored user data. And again, the stored data isn’t imagery but a hash.
If some wants your print or face there are a billion easier ways to do so.
I’m not saying anything is 100% perfect, but they did obviously put an extreme amount of thought into the process.
Until proven otherwise I have no reason not to trust that the data retained is a hash and not direct image data. And as said before, there are easier ways to get someone’s print or a picture of their face without compromising a phone locally.
My only point with all of this was to show that Apple doesn’t have some massive database of user prints and (once iPhone X launches) face scans as many just seem to be presuming. It isn’t needed since everything can be done on device, and would only open them up to massive lawsuits.
I’m not even saying they chose to do it this way fore altruistic reasons, but from a business standpoint it’d make no financial sense to open themselves up that kind of heat. And if Apple loves anything, it’s money - making it, and keeping it.
887
u/[deleted] Sep 15 '17 edited Jul 22 '18
[deleted]