How secure is Apple's Touch ID?

We pit the fingerprint scanner against the default 4-digit passcode.

One of the few hardware upgrades Apple introduced in the iPhone 5s was Touch ID, a fingerprint scanner built into the home button.

This allows users to log into the device without having to type a password and enables purchases from theiTunes Store, App Store, and iBooks Store to be authorised.

There's no doubting Touch ID is more convenient than tapping in a traditional pin number or passcode, but just how secure is it?

Is Touch ID safer than a 4-digit password?

Advertisement - Article continues below

Yes. The chances of a stranger guessing a 4-digit pin are 1 in 10,000. These odds reduce dramatically if you know the person. Friends or relatives know important dates such as anniversaries/birthdays, which could be used as a password. Of course it's also easy to look over someone's shoulder and memorise the short 4-digit sequence.

Because fingerprints are unique to individuals and tangible there's no chance they can be bypassed with guess work you either have the corresponding print or you don't. No two fingerprints are identical, and Apple claims the probability of strangers having fingerprints close enough to bypass its sensor are 1 in 50,000. You only have a maximum of ten attempts to use the fingerprint scanner before it asks you for a password - so the chances of this are slim.

On the balance of probabilities Touch ID is five times more secure than the 4-digit pin.

However, Touch ID is not impenetrable. German hacking group, Computer Chaos Club showed how to hack the system by replicating a fingerprint. The method is a laborious process - requiring a hacker to lift a fingerprint from a surface, clean it up using graphite power, take a high-res photo with a 2400dpi camera, and print it off at a resolution of 1200dpi onto a plastic or latex material.

A second way of hacking Touch ID is far easier, but depends on opportunity. Simply wait for the person whose fingerprint you require to fall asleep before gently prodding their finger on the home button. It's crafty and most probably restricted to nosy family members and friends. But it's far more likely to happen than the fake fingerprint method.

The 6-digit combo

On the balance of probabilities Touch ID is five times more secure than the 4-digit pin. But what if you up this to a unique 6-digit combination?

The chances of someone guessing a random 6-digit pin are one in a million in theory - making it 20 times more secure than Touch ID. If you use a 6-character alphanumeric password, the number of possible combinations increases to two billion.

So what's the takeaway? Touch ID isn't perfect, but it is safer than the 4-digit pin. We see it gaining mass adoption amongst Apple users due to the ease of use. But a combination of 6+ characters is still safe, and Apple hasn't killed off the password completely.

The iPhone 5s requires users to enter their password every time they reboot, when over48 hourshave elapsedbetween unlocks and when you want to enter the Passcode and Fingerprint setting.

Featured Resources

The IT Pro guide to Windows 10 migration

Everything you need to know for a successful transition

Download now

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Software-defined storage for dummies

Control storage costs, eliminate storage bottlenecks and solve storage management challenges

Download now

6 best practices for escaping ransomware

A complete guide to tackling ransomware attacks

Download now


Business strategy

Apple launches new TV, gaming and finance services

25 Mar 2019

Jony Ive: A retrospective

29 Nov 2019

Apple iPad 10.2in (2019) review: The iPad grows up

10 Oct 2019

Apple iMac Pro review: The return of the king

2 Sep 2019

Most Popular

identity and access management (IAM)

44 million Microsoft customers found using compromised passwords

6 Dec 2019
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019

Five signs that it’s time to retire IT kit

29 Nov 2019

Where modernisation and sustainability meet: A tale of two benefits

25 Nov 2019