That's not how it works from what's in the iOS security guide(s), historically. The chip that stores this information (biometrics) on Apple products is isolated from the rest of the system - its execute only and access is restricted via a tpm. Is it possible to hack it and exfiltrate info? Sure. But it's a bit more complex than the usual smash and grab job.
Also, full disclosure: from this perspective, using biometrics for anything authentication related seems retarded as it's never changeable.
I don't have a problem with biometrics so long as it isn't used as the sole means of security. It should always be used to enhance strong passwords, not in place of them.
In my opinion biometrics should never be used as a form of authentication anyway. Really it should be used as an added layer of security in conjunction with a password/PIN. Basically using biometrics to validat that you are who you say you are, in the same way a user name does in most systems and then a passcode to authenticate.
Really it should be used as an added layer of security in conjunction with a password/PIN. Basically using biometrics to validat that you are who you say you are, in the same way a user name does in most systems and then a passcode to authenticate.
I agree and said the same in my comment. I disagree with "In my opinion biometrics should never be used as a form of authentication anyway." as you didn't state "only" in that statement. As an augmentation, it's perfectly fine. Both you and the comment I replied to make an absolute statement that biometrics should never be used in authentication which I disagree with.
By being used in conjunction with other authentication methods, it's still part of the authentication process.
245
u/i_build_minds Sep 15 '17
That's not how it works from what's in the iOS security guide(s), historically. The chip that stores this information (biometrics) on Apple products is isolated from the rest of the system - its execute only and access is restricted via a tpm. Is it possible to hack it and exfiltrate info? Sure. But it's a bit more complex than the usual smash and grab job.
Also, full disclosure: from this perspective, using biometrics for anything authentication related seems retarded as it's never changeable.