Great, right? The number of mobile devices left unprotected will go down, sparing some non-trivial number of individuals the heartache of having their devices accessed in a way they didn't authorize. Hooray Apple!
Not so fast!
The Chaos Computer Club thinks that's a really "stupid" way to look at things. They think that because it was so "easy" for them to create a rubber finger (likely with the full participation of the user) in a matter of (at least) hours, that only a moron would use the technology.
Chaos Computer Club breaks Apple TouchID.
The biometrics hacking team of the Chaos Computer Club (CCC) has successfully bypassed the biometric security of Apple's TouchID using easy everyday means. A fingerprint of the phone user, photographed from a glass surface, was enough to create a fake finger that could unlock an iPhone 5s secured with TouchID. This demonstrates – again – that fingerprint biometrics is unsuitable as access control method and should be avoided.While both of the parts above in bold type are false, they are false in different ways. The first part, "using easy everyday means" is only a fib. The process described is "easy and everyday" kind of like manufacturing dentures is easy and everyday. Sure, it happens every day, but it isn't like making brownies.
...
"We hope that this finally puts to rest the illusions people have about fingerprint biometrics. It is plain stupid to use something that you can't change and that you leave everywhere every day as a security token", said Frank Rieger, spokesperson of the CCC. "The public should no longer be fooled by the biometrics industry with false security claims. Biometrics is fundamentally a technology designed for oppression and control, not for securing everyday device access." Fingerprint biometrics in passports has been introduced in many countries despite the fact that by this global roll-out no security gain can be shown. [ed. bold emphasis added]
The second bolded part is indistinguishable from the ranting of a conspiracy theorist.
There's something vaguely embarrassing about people who claim to know a lot about technology, but who display no understanding of its use or appreciation for its context. When they also presume to tell everyone else what to do, it begs a response.
The CCC shows either a total ignorance of the purposes of security technologies or a belief that the world is a one-size-fits-all security market. Either way, they come off as contemptuous of ordinary people who might want a more convenient way to increase their own security and the people working to give it to them.
It's one thing to point out how new technologies are fallible. All technologies are and it is important that consumers understand how that is the case. It's another thing to try to scare people away from adopting security techniques that will leave them safer than they are now and are convenient to use.
Apple's implicit point is that when it comes to protecting access to the device, fingerprint access is better compared to doing nothing, which is the option many people currently choose. It's not a question of perfect security, it's a question of security that is convenient enough that it actually gets adopted.
Other posts where the question "...compared to what?" arises:
The old Gummi Bear trick
Visa to drop signatures on credit card purchases by 2013
Unisys Poll: 63% of credit card users would prefer fingerprint
German gov downplays biometric ID card hack
It's one thing to point out how new technologies are fallible. All technologies are and it is important that consumers understand how that is the case. It's another thing to try to scare people away from adopting security techniques that will leave them safer than they are now and are convenient to use.
Apple's implicit point is that when it comes to protecting access to the device, fingerprint access is better compared to doing nothing, which is the option many people currently choose. It's not a question of perfect security, it's a question of security that is convenient enough that it actually gets adopted.
Other posts where the question "...compared to what?" arises:
The old Gummi Bear trick
Visa to drop signatures on credit card purchases by 2013
Unisys Poll: 63% of credit card users would prefer fingerprint
German gov downplays biometric ID card hack
UPDATE:
Marco Tabini at Macworld seems to agree. Apple's Touch ID may not be bulletproof, but it's still useful.
