The end of the password – is nowhere near.  The new iPhone is not going to make that happen either.  That’s because of a fundamental misunderstanding that is rolling out there that the new fingerprint scanning capability on the new iPhone 5S is an elevated level of security that no one has ever done before.  That is wrong.  I went through through my thoughts on this in an earlier post, and it’s a notion that should be stopped cold, right now.

Cryptography and security expert Bruce Schneier has been in the news lately, he’s been in proximity to the ongoing Edward Snowden revelations through the Guardian.  He recently called for a fundamental and complete re-engineering of computers, networking and the internet to reverse the actions that the NSA has done, reverse the course of the internet, especially in light of the recent backdoor to encryption revelations.  A respected author and well-read security writer, he shared how this iPhone 5S authentication falls short on security and how there is no path to this replacing passwords.

..can biometric authentication be hacked?

Almost certainly. I’m sure that someone with a good enough copy of your fingerprint and some rudimentary materials engineering capability — or maybe just a good enough printer — can authenticate his way into your iPhone. But, honestly, if some bad guy has your iPhone and your fingerprint, you’ve probably got bigger problems to worry about.

The final problem with biometric systems is the database. If the system is centralized, there will be a large database of biometric information that’s vulnerable to hacking. A system by Apple will almost certainly be local — you authenticate yourself to the phone, not to any network — so there’s no requirement for a centralized fingerprint database.

He also talks about some of the ways that fingerprint authentication devices are defeatable based on specific examples.  He also dissects the folly of thinking your fingerprints are the ultimate secure password.

“Your fingerprint isn’t a secret; you leave it everywhere you touch”

Fingerprint systems are also susceptible to failure, even for the phone owner:

“Failures will be more common in cold weather, when your shriveled fingers just got out of the shower, and so on.”

Schneier punctuates how this is an interesting consumer technology, but points out the risk as well.

“Apple’s move is likely to bring fingerprint readers into the mainstream. But all applications are not equal. It’s fine if your fingers unlock your phone. It’s a different matter entirely if your fingerprint is used to authenticate your iCloud account. The centralized database required for that application would create an enormous security risk.”

And that’s that – fingerprints are not passwords and they never will be.  Referring to my earlier article I pointed out how at some point that fingerprint must be stored and referenced in a digital form, where it basically becomes what’s known as a hash.  Think of a hash as an encrypted digital file that is where passwords are checked during authentication.  Confirmation came today that the fingerprints are “represented by a digital signature which is encrypted and stored in the A7 chip within the device itself”.  Ladies and gentlemen, that is a hash and the first thing security researchers are going to try and do when this iPhone hits the streets is dump that file and crack it.  How long do you think that might take?  I’ll be back with that story as soon as it breaks just to make the point.  As Melissa reports, passcodes will also be in place on the iPhone 5s to aid in securing the phone, and thank goodness for that.  My goal here is not to bash the new phone or the company that made it, but the message about this fingerprint thing has to be corrected.  There are plenty of great and interesting new features in iOS 7 that are business friendly and I touched on a number of those recently and we’ll do more to talk about that in the weeks to come.