this post was submitted on 23 Sep 2023
134 points (89.9% liked)
Apple
17476 readers
85 users here now
Welcome
to the largest Apple community on Lemmy. This is the place where we talk about everything Apple, from iOS to the exciting upcoming Apple Vision Pro. Feel free to join the discussion!
Rules:
- No NSFW Content
- No Hate Speech or Personal Attacks
- No Ads / Spamming
Self promotion is only allowed in the pinned monthly thread
Communities of Interest:
Apple Hardware
Apple TV
Apple Watch
iPad
iPhone
Mac
Vintage Apple
Apple Software
iOS
iPadOS
macOS
tvOS
watchOS
Shortcuts
Xcode
Community banner courtesy of u/Antsomnia.
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
So, I do agree on anti repair vs not-pro-repair, and assuming you’re right about the calibration stuff (which seems possibly true by my understanding)…
Why do they serialize the biometric scanners? The only way that’d make sense was if the bio scanner was scanning, comparing to a registered scan, and then just giving the rest of the phone a thumbs up to unlock.
But as I understand, the biometrics are stored on the Secure Enclave within the cpu and the scanner is just a sensing device.
For your device to be compromised would require an attacker to reverse engineer the sensors output, have a model of your face to spoof, and for the device to be accepting biometric unlocking, which iPhones only do after having been unlocked via passcode.
There are a couple of concerns with biometrics.
The big one is, as you already mentioned, spoofing biometrics.
The FaceID or TouchID sensor essentially saying “I got that face/fingerprint that you have in your Secure Enclave”. Granted it is a sophisticated attack, but nevertheless one you’d want to prevent if only because it’s good practice to maintain a secure chain in which the individual links can trust each other.
For similar reasons the lockdown mode exists, which is mainly useful in limited scenarios (e.g. journalists, dissidents, etc).
On the other hand, if ever there was a potential attacker, it would be a government because they unlimited funds in theory and it isn’t hard to imagine the FBI trying to utilize this in the San Bernardino case if it was available.
A different risk, which would make the above quite a bit easier to accomplish, would be an altered biometrics scanner that, in addition to working the way it’s supposed to work, stores and sends off your biometrics or simply facilitates a replay attack.