Protect Your Assets
Showing results for 
Search instead for 
Do you mean 

Mobile Security: Threat Modeling Apple's TouchID

danielmiessler ‎09-24-2013 11:11 AM - edited ‎07-07-2015 12:41 PM


InfoSec is usually a sliding bar between usability and security. When you gain one, you lose the other. The Apple iPhone 5s tries to balance usability and security with the release of TouchID.

Four-digit pins are more secure than having no passcode—but they’re more annoying to use. And having no passcode at all is the simplest option for the user, but it offers no security.


Meet TouchID


Apple’s TouchID, which just launched on the iPhone 5s looked to do something that isn’t often accomplished—to simultaneously improve both ease of use and security.


Compared to having no passcode whatsoever, using TouchID is slightly more complicated—but not much. But compared to using a four-digit passcode (which is what most people had, if anything), simplicity and security are both improved.


Threat modeling vs. a mobile phone


In order to say “security was improved”, one must ask, “Improved against what?” Threats matter. So let’s take a quick look at what the threats against 99 percent of mobile phones are:

  1. Friends / Acquaintances / Significant Others snooping on your device
  2. Theft of the device by common, opportunist criminals
  3. Targeting of your data by sophisticated attackers (criminals/government/etc.)

Looking at these three categories the point should leap out at you:


TouchID was designed to counter the top two threats (acquaintances and common thieves), not sophisticated criminals. Those in the third threat class are not going to be stopped by either a passcode or a fingerprint because they have other ways of getting that data.


Is it anyone’s honest opinion that when faced with an advanced attacker targeting your data, it’ll be the passcode on your mobile phone that will protect you? (For one thing, they don’t need your physical phone to wage an attack.) In short, TouchID fails only in the scenarios where it cannot possibly succeed. This is also the area where  there aren’t many good options in any case.


But for the situations it was built for, i.e. keeping the opportunist criminal and the overly curious from accessing your device, it advances the game in both security and simplicity.




Stay tuned for an upcoming analysis of the secuity features in the newly released iOS 7.


Daniel Miessler is a Principal Security Architect with Fortify on Demand, and can be reached at daniel.miessler@hp.comand on Twitter at @danielmiessler


0 Kudos
About the Author


sunil vadher
on ‎10-08-2013 11:00 AM
as soon iphone5 introduce some one breack finer print lock / hached surprise. Mr. Sunil
Aug 29 - Sep 1
Boston, MA
HPE Big Data Conference 2016
Attend HPE’s Big Data Conference on August 29 - September 1, 2016 to learn from peers in every industry and hear from Big Data experts and thought lea...
Read more
Sep 13-16
National Harbor, MD
HPE Protect 2016
Protect 2016 is our annual conference on September 13 - 16, 2016, and is the place to meet the world’s top information security talent, discuss new pr...
Read more
View all