Learned a lot from this piece.
Capacitance readers are more complex, instead creating an image of your fingerprint by measuring the differences in capacitance between the ridges and valleys of your fingerprint. They leverage the electrical conductivity of your sub-dermal skin layer, and the electrical insulation of your dermal layer (the one where your fingerprint is). Your fingerprint is effectively a non-conductive layer between two conductive plates, which is the very definition of a capacitor. The fingerprint reader senses the electrical differences caused by the varied thickness of your dermis, and can reconstruct your fingerprint.
The Touch ID sensor in the iPhone 5s is a capacitive reader, embedded in the home button. That was a good choice on Apple’s part, since capacitive scanners are more accurate and less prone to smudgy fingers, and can’t be faked out with a photocopy of a fingerprint.
The question I have is, are capacitance readers susceptible to Play-doh copies of your fingerprints. This is a technique used to defeat some fingerprint technologies.
UPDATE: And the answer is, a resounding no. Need a live finger for capacitance to work.
Not according to this article…
http://www.citeworld.com/security/22399/iphone-fingerprint-scanner-better-biometrics
It would seem to me that a capacitive sensor would be hard to fool. You’d need a copy of the real fingerprint on something that was equally non-conductive as the owner’s skin and then you’d have to remove the same amount (electrically) of your skin to place the copied print onto your finger. That’s the only way I can see to have the same capacitance in all the peaks and troughs given that one plate of the capacitor is inside the sensor and the other is your sub-dermal skin layer.
That sounds pretty secure to me…
It would be far easier to force the real print owner to unlock it with the threat of violence if you really need to get into the phone (or the threat of years in jail if you work at a border entry point).
I see the concern but honestly, when are you ever going to get a Play-Doh imprint of someone’s finger.
Play-doh. Play-doh! Play-doh?
Don’t talk about play-doh.
Which part of capacitance you don’t understand.
You know something to do with electrical charge.
Only real way to attack the fingerprint is to replace the hash with the one that matches yours .
NSA won’t be able grow your finger in the lab using stem cells. They can easily go to apple and cell phone companies to get all your info.
what on earth are you talking about? neither apple nor the cell provider keep a copy of the hashed data that represents your print. it’s stored in the A7 processor only, and that will be easy to verify in a control room.
Good article. I see what you mean. Would definitely take a live finger to fool the sensor. Thanks.
I see a movie plot point with a Frankenstein finger and a 9V battery…
Why do you need a live finger? Capacitance works perfectly well with dead stuff. That’s how iOS styluses work; they’re not exactly alive 🙂
Slow down, cowboy. He’s on your side 🙂
He’s saying that it’s easier to get your personal data from Apple, than to create a copy of your finger and get it from your phone.
Though I’d be very surprised if you really needed to get around the fingerprint sensor in order to recover data from an iPhone.
As we just found out, the answer is actually a resounding “yes”.