Should You Use Fingerprint Unlock?

Summary

This video delves into the security and convenience of fingerprint unlock on smartphones. It explains how biometric data is stored locally and not in the cloud, enhancing privacy. The video compares the security of fingerprint unlock to PINs or passwords, noting that while fingerprints offer convenience and protection against shoulder surfing, they are not revocable and could be vulnerable to targeted attacks. It also discusses the legal implications of biometric data at borders and suggests that the choice between PIN and fingerprint unlock depends on personal threat models and the device's security features.

Takeaways

• 🔐 **Fingerprint Readers Work Differently**: Some phones use optical scanners, while others use ultrasonic scanners that create a 3D map of the fingerprint.
• 📱 **Local Storage of Biometric Data**: Fingerprint data is stored locally on the device and not uploaded to the cloud, enhancing privacy.
• 🔒 **Secure Enclave and TEE**: Apple uses the Secure Enclave, and Android uses the Trusted Execution Environment to securely store fingerprint data.
• 🔑 **Convenience vs. Security**: Fingerprint unlock is convenient and can be more secure than a 4-digit PIN but less secure than a 5-digit PIN.
• 👤 **Biometrics are Permanent**: Unlike passwords, fingerprints cannot be changed, which could be a security concern if biometric data is compromised.
• 👁️ **Protection Against Shoulder Surfing**: Fingerprint unlock provides a layer of security in public places by preventing others from seeing and stealing your unlock code.
• 🚫 **Coercion and Legal Considerations**: Some devices have features to prevent unlocking with a severed finger, and legal rulings on PIN coercion are not uniform.
• 🔄 **Biometric Data Breaches**: There have been instances of biometric data breaches, indicating that fingerprint data is not entirely secure.
• 📈 **False Positive Rates**: The false positive rate for fingerprints is about 1 in 50,000, suggesting a balance between security and convenience.
• 🌐 **Device-Specific Security**: The security of fingerprint unlock varies by device, with some offering better protection against brute-force attacks than others.

Q & A

How do most phone fingerprint readers work?

Most phone fingerprint readers work by taking a series of scans of your fingerprint. Some use optical scanners, which are like cameras that capture an image of your fingerprint, while others use ultrasonic scanners that create a 3D map using ultrasonic sound waves.

Where are the fingerprint data stored when using fingerprint unlock on smartphones?

Fingerprint data is typically stored locally on the device and not uploaded to the cloud. Apple uses the secure enclave to encrypt and store the data, while Android uses the Trusted Execution Environment (TEE).

Is fingerprint data collected by Google and Apple when using fingerprint unlock?

No, fingerprint data is not collected by Google and Apple. It stays locally on your device, and both companies report that it is never stored in servers or uploaded to the cloud.

How often do people typically unlock their phones in a day?

Most people unlock their phones about 100 times a day, or around every 10 minutes.

What is the benefit of using fingerprint unlock over a PIN or password in crowded places?

Fingerprint unlock is more private and prevents shoulder surfing, where thieves watch people enter their PINs and later steal the phone.

Can anyone's fingerprint unlock a device if they have access to the fingerprint data?

No, fingerprint data is not easily revocable like a password, and it requires special tooling and a way to generate fingerprints that would be accepted by the sensor to unlock a device.

What is the false positive rate for fingerprints in biometric systems?

The false positive rate for fingerprints sits at about 1 in 50,000, meaning there's a 1 in 50,000 chance of an unauthorized user being mistakenly granted access.

How does the security of fingerprint unlock compare to that of a PIN or password?

The security of fingerprint unlock is generally considered to be between that of a 4-digit and a 5-digit PIN, but it's not a perfect comparison due to the differences in how brute-force attacks are carried out.

What is the Titan M2 chip and how does it protect against brute-force attacks on Pixel phones?

The Titan M2 chip contains a Weaver token mechanism that adds a time delay to successive PIN attempts, making brute-force attacks more difficult and time-consuming.

How can the risk of coercion attacks be mitigated when using biometric unlock methods?

Some phones prevent coercion by detecting natural electrical signals of the body, so a severed finger won't work. Users can also consider powering off devices when traveling to require a PIN upon restart, adding an extra layer of security.

What should be considered when deciding between using a PIN or fingerprint unlock for device security?

The decision should be based on the device, personal threat model, and tolerance for inconvenience. Fingerprint unlock is convenient and generally secure, but a long, random PIN or password might be preferable for those at risk of highly targeted attacks.