A lot of the media seem to be appalled that there is a way around the iPhone-5S fingerprint scanner. It gets a lot of media play, but for all the wrong reasons. The CCC did a pretty good job explaining their aim:

“We hope that this finally puts to rest the illusions people have about fingerprint biometrics. It is plain stupid to use something that you can´t change and that you leave everywhere every day as a security token”, said Frank Rieger, spokesperson of the CCC. “The public should no longer be fooled by the biometrics industry with false security claims.”

But then they go of the deep end and talk about biometric passports? That’s basically just ideological fluff that, while potentially valid, demeans the good statement they were making:

Do not believe that a fingerprint is the ultimate in security. It’s more like the child-proofing of a medicine bottle: it works against children and is useless against (most) adults.

The fingerprint scanner on the iPhone is the same thing. It keeps people without a lot of motivation out. For those with the know-how and the motivation there is a system to deal with it. It’s called remote wipe. And if even that is insufficient then you should probably not have your data on you phone.

The thing to realise is that security is not an absolute and it’s not about a technology or a product. Security means different things for different situations. It’s about a use case and the risks associated with that use-case.

We have to question what we want to achieve. It’s definitely not preventing determined criminals from accessing our phone data. It’s to prevent easy access to that data when we leave our phone on our desk when we step away.

So when you think about security, you need to think about what it is you need/want; you need to look at your use-case.

Media-Outlets reporting the story:

Stupid Analogy

I love to come up with analogies. Often they turn out stupid. This is one of those. However they usually do contain a grain of truth and when pondered might actually lead to good insights. I’ll leave this one here in case someone wants to go down a rat-hole for a while

Take contracts as an example. We put squiggly lines on pieces of paper and call it a signature. We accept that as proof of intent to form a contract. And guess what it works most of the time and it’s totally insecure.

If someone with sufficient motivation wants to do so, he can just put different squiggly lines on the paper than he usually and then claim he never signed after reaping the benefits of the contract. That’s what we call fraud and we made laws against that.

Thing is, it works well enough for 99.9% of all cases. And for the few cases it doesn’t, we have a system in place to handle it.