2

My new Macbook Pro has Touch ID, and I've trained it on one of my fingers so I can use it to unlock my machine, which is quite fun. I've been wondering, though, how secure it is really.

To be clear, since I must have already logged in using my password, and you have to be physically present before you can try using Touch ID, Apple doesn't have to guarantee that it will only respond to my finger; it just has to be very unlikely to respond to someone else's finger. That's why, from time to time, the OS will require that my full password be typed in. It's similar to ATM card PIN numbers; four digits makes it difficult enough for a card thief to guess that it's a good-enough confirmation measure, although it would NOT be good enough if the card weren't required.

So, here's my specific question: how likely is it that a random, non-trained finger would be recognized as matching my trained one? Are we talking a 1 in 1000 chance, 1 in 10000, or even less likely? (I doubt I'd get a clear answer from Apple were I to ask them...)

Improve this question
4
  • Have you read the Wikipedia article? It’s a pretty good read. An unmentioned positive point for the required periodic manual unlocks is that you know your password. A relative used a fingerprint reader on a Windows PC exclusively for several years, it never required manual password entry, when the reader broke they had no idea what password had been set years before.
    – Tyson
    Commented Dec 22, 2018 at 22:53
  • Good point on having to reenter your password. The WP article was interesting, but it didn't answer this question.
    – Daniel Griscom
    Commented Dec 22, 2018 at 23:15
  • The original comment I was typing acknowledged that the article didn’t answer the question, as I was typing tho the answer came in, and my rewording dropped that fact.
    – Tyson
    Commented Dec 22, 2018 at 23:18
  • Actually, if you'd had an answer you would have posted an answer, so I have nothing to complain about. My apologies.
    – Daniel Griscom
    Commented Dec 22, 2018 at 23:21

2 Answers 2

Reset to default
2

Apple, iOS Security, November 2018, p. 10

The probability that a random person in the population could unlock your iPhone is 1 in 50,000 with Touch ID or 1 in 1,000,000 with Face ID. This probability increases with multiple enrolled fingerprints (up to 1 in 10,000 with five fingerprints) or appearances (up to 1 in 500,000 with two appearances). For additional protection, both Touch ID and Face ID allow only five unsuccessful match attempts before a passcode is required to obtain access to your device.

Improve this answer
1
  • Well, that's a whole lot more precise and open than I thought Apple would be. Thanks!
    – Daniel Griscom
    Commented Dec 22, 2018 at 22:48
-1

The main security concern of using biometrics is not the fact that they don't have enough entropy.

The main issue is that biometrics are not private i.e you literally show your face to everyone & leave your fingerprints on everything you touch.

Its trivial for any forensic professional to dust your Macbook for prints & unlock it with the findings.

Improve this answer
2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .