We already know Touch ID secures your digital fingerprint by storing it in a secure enclave on the Apple A7, only accessible to the sensor itself. It allows the iPhone 5s to better allow for both convenience and security. But what if that wasn't the only safeguard Apple took in order to protect your prints? We've taken a closer look at Touch ID and, through collaboration with repair company mendmyi, found that Apple has taken extra precautions beyond the secure enclave, on a hardware level that we've never seen implemented before.
Apple has touted Touch ID as a secure hardware path from the beginning. Here's the explanation straight from Apple:
Apple doesn't make specific mention of any other additional safeguards. However, as we discovered through some research and testing of our own, it seems as though Apple went through the trouble of pairing every individual Touch ID sensor cable to each individual phone as well. That's an incredible feat, and it immediately raises the question - why?
Our investigation into the Touch ID assembly started when mendmyi contacted me about an issue with Touch ID on a customer's phone. It had come in for their Colour Lab service. The video below demonstrates the issue:
In order to try and rectify the problem, many steps were attempted. These included swapping out the Touch ID sensor for one verified to work, replacing the dock connector the Touch ID makes contact with, and even replacing the logic board itself. When each different hardware fix was attempted, a DFU restore was performed as well. Nothing worked. It was baffling.
It was then discovered that the Touch ID sensor currently in the device was not the original one that came in the device. Once the original was returned, Touch ID started working again.
At this point, we knew there had to be some additional, previously undisclosed, hardware lockdown going on. To test this theory, we took two iPhone 5s handsets that had never been opened before, and verified Touch ID was working on both. The front assemblies, which contain the Touch ID assembly itself, were then removed and swapped. After re-assembly, both Touch ID setups failed. When returned to the original device, Touch ID once again operated correctly.
This confirmed for us that the Touch ID component cable assembly itself is tied to each individual A7 chip.
I asked our resident security expert, Nick Arnott, if he had any thoughts on why Apple would find this necessary. While none of this can be confirmed, these are his thoughts on why Apple may have taken the extra precaution:
I think all Nick's points are valid and could certainly explain what Apple was getting at in their own description of Touch ID when they say it isn't possible for your fingerprint to be reverse-engineered. One thing is for sure, I'd be very curious to see if these kinds of security precautions are taken in other fingerprint readers such as the one found in the HTC One Max.
Update: Interesting take from natevancouver on Twitter as well:
So what does all this mean for general consumers, hackers, DIY repairs, and future security standards? For general consumers, this is good news. It means you've got an extra layer of protection that's specifically unique to your device. A universal hack won't work. For hackers, it means they've got their work cut out for them and if they want to attack Touch ID. It looks like it can't be done by modifying the sensor cable itself.
When it comes to DIY repairers, it means your job just got a little more precarious. Since you need to remove the Touch ID cable and transfer it in order to perform to most common repair, including replacing a cracked screen, you'd better make damn sure you don't break it. If you do, you'll lose Touch ID functionality and won't be able to get it back.
I've not yet been able to find a reference to another company locking down specific hardware components the way Apple has with Touch ID. It theoretically means they could lock down any component in an iPhone, iPad, iPod, or Mac if they really wanted to. Will they? Probably not. But the option is there.
It's obvious tremendous safeguards have gone into building Touch ID, likely to make sure everyone feels safe and comfortable using it now and into the future.
iMore senior editor from 2011 to 2015.