The FBI already keeps a fingerprint database; these were John Lennon's on his application for permanent US residence. Photograph: Henry S Dziekan III/Getty Images
The latest "oh, this must be true because we read it somewhere" is that "Apple is going to share its fingerprint database collected by the iPhone 5s with the National Security Agency". Reality check: the article claiming this comes from a right-wing "satire" site. Why are people confused? Because the satire's badly executed.
A lot of people read it but didn't realise that the satire site was a satire site. (I've had at least one email pointing excitedly to it, and not ironically.) This isn't surprising, because the thing about satire is that you either have to lay it on with a trowel, or get so close to the bone (eg The Thick Of It) that it's indistinguishable from painful reality. It's easy to do badly. And the site in question, National Report, does it really badly. It's like Fox News, but with the jokes and facts taken out.
Even so, you'd hope people who read such "stories" might think a bit. Or that they might even look at other headlines on the site, and wonder if a site which has a story headlined "Apple iPhone 5s Fingerprint Data To Be Shared With NSA" but also has one headlined "Packers Embarrassing Loss to Bengals Linked To Green Bay Bridge Collapse" and "Taurus Firearms Company Introduces The New Trayvon PK-10 or 'Perp-Killer'" is entirely serious. (It isn't actually funny, especially the latter headline; if you're easily offended, don't read the story that goes with it. But that's another matter.)
Let's recap what we do know about the iPhone 5s's fingerprint system.
• First: Apple says the iPhone 5s doesn't store a "fingerprint database". Its "Touch ID" stores a cryptographically hashed mathematical representation of the pattern of each finger that you choose to register on it. You don't register any fingerprints at all if you don't want to.
Reversing the cryptographic hash to produce a facsimile of the original fingerprint may be impossible, depending on how good the encryption is. Even if the NSA has somehow gotten in and weakened the encryption used (something it has done elsewhere), that doesn't make reversing the hash trivial - just less slow.
• Second, Apple says that the data is stored in a "secure enclave" within the A7 chip on the phone. There doesn't seem to be any way to get that hash out; if you input a hashed print into the "enclave", you can get out a yes/no answer for whether it matches any stored hashes. But there's no way yet known to reverse from the hashed representation to anything like your original fingerprint. (The Chaos Computer Club, and also Lookout Security, have managed to spoof the Touch ID system by lifting a fingerprint from a glass surface, making a high-resolution copy and then pasting that on their finger. That means they've broken into the system, but not that they've got the data out.)
• Third, the NSA will already have access to your fingerprints if you're an American citizen of driving age with a car (you provide fingerprints for a driving licence) or if you're a foreign citizen who has visited the US. The FBI also maintains a database of fingerprints in the US. Neither needs to reverse them out of phones.
• Fourth, if the NSA or FBI or other law enforcement agency wanted to know the ownership of a phone, it could do it much more easily than by reversing a cryptographically hashed representation of the owner's fingerprint (even assuming that it's possible) simply by subpoenaing operator records for the SIM and IMEI (unique device number) associated with the phone. Those would tell it where the owner had been, and when and where they had made phones calls. (Remember the Verizon metadata, which kicked all this off? It's that.) Remember The Wire? No fingerprint hashes involved. Lots of phones and pagers, though.
• Fifth, while Apple hasn't said that the fingerprint system is totally secure (it puts the chance of a random unregistered fingerprint unlocking the device at 1 in 50,000, which is five times better than a four-digit PIN), it has emphasised that the data doesn't go off the device, isn't backed up, isn't synchronised to iCloud.
It hasn't said that it won't give it to the NSA. But then, none of the big technology companies (Microsoft, Google, Apple, etc) wants to say the NSA-word in talking about new devices or services, because that attracts the question of "so how much did you share before?", which quickly turns into a "Have you stopped beating your wife and sharing the video with the NSA?" type of inquisition.
Saying "it stays on the device" is their best option here. That's not a guarantee that if the US authorities seize a device, and for some reason want to be able to reverse-engineer the fingerprints, that Apple won't be obliged to work with them. But reversing cryptographic hashes is hard; US police have already complained about the difficulty of doing it on earlier Apple devices, and there's no reason to think the "enclave" will be any less secure.
Now, to details. The article at National Review claims to quote someone called "Tim Richardson" who it says is "District Manager of Apple's North America Marketing Department" as saying
"Absolutely the databases will be merged. This whole 'fingerprint scan' idea originated from someone in our Government. They just didn't expect to be outed by Snowden."
Fact: there's no such person working for Apple in any role. And it doesn't have a "North America Marketing Department".
Wait, there's more:
"He went onto [sic] explain that the NSA and FBI have been compiling a special database for over a year now to use with the new Apple technology. Fingerprints from all over the nation. Cold cases. Fugitives of the law. Missing persons."
As pointed out above, the FBI has a lovely big fingerprint database, and the NSA can easily find out where people have been if it wants to.
Of course the clue that it's satire - or "satire" - comes in the HILARIOUS quote at the end, quoting "an Apple user we spoke with": "I like the idea of easily being able to unlock my Apple device with a fingerprint. But I also shouldn't have to worry about being tied to a string of murders I commuted [sic - we think they mean "committed"] in the 70's… That's not America and that's not freedom."
Yes, hilarious. Also, complete nonsense. Yet we've seen it quoted on other sites. Remember, it's good to keep an open mind, but not so much that the wind blows through it.
(If you're wondering, the links above to National Review all use rel=nofollow.)
Other stories in this occasional series:
• No, Samsung did not pay its $1bn fine to Apple in nickels
• No, Bruce Willis isn't suing Apple over iTunes rights
via apple - Google News http://news.google.com/news/url?sa=t&fd=R&usg=AFQjCNERDQG4B7VcVevOAy-9K0BHjqG0jg&url=http://www.theguardian.com/technology/2013/sep/27/no-nsa-iphone-5s-fingerprint-apple
Posts
0 comments:
Post a Comment