So I did the thing I always say I'm not going to do and stood in line for a phone. Not for hours, thankfully, my local Verizon store had exactly enough 5s units that showing up at 8:40 on launch morning got me out the door by 9:15 with a gold one (a decision I already half regret, it looks fine but I wanted the space gray and they were sold out in about eleven minutes). That was over a week ago now. What I actually want to talk about is what happened four or five days later, because it's more interesting than "new phone is nice."
Touch ID got broken. Not broken in some theoretical academic-paper way either, the Chaos Computer Club, the German hacker group that's been doing this kind of thing since before I was born, cracked it within about 48 hours of the phone shipping. Their method is almost annoyingly analog for something targeting a piece of biometric hardware Apple spent years on: photograph a fingerprint left on glass, clean up the image, print it onto transparent sheet with a laser printer at high toner density, then use that as a mold with wood glue or latex milk to build a thin fake fingerprint layer. Press that onto a dummy finger, press the dummy finger to the sensor. Done. No enrollment, no cooperation from the phone's owner needed, just a decent photo of a print they left somewhere (a glass, a doorknob, the phone's own screen, which is the darkly funny part).
I read through their writeup twice because I wanted to be annoyed at Apple and instead came away kind of impressed at the CCC's patience more than anything. This isn't a five minute hack. You need a print with good ridge detail, decent equipment, and some trial and error getting the fake layer thin enough to still register as skin to the capacitive sensor. It's not nothing, but it's also not "your fingerprint is now useless as a security measure," despite how a lot of the headlines wanted to frame it that week.
Here's my actual opinion on this, since half the point of still running this blog after two years is that I get to have one: I'm keeping Touch ID on. My passcode before this was 1177, which is not meaningfully more secure than a sticky note on the back of the phone, and I picked it because typing a real passcode forty times a day standing on a train platform was never going to happen consistently. The realistic threat model for basically everyone reading this isn't a state-sponsored fingerprint-lifting operation, it's someone finding your phone in a cab. A fake latex fingerprint mold defeats exactly nobody who grabs your unlocked-looking phone off a bar table. Different problem, different tool.
What bugs me more, honestly, is that Apple's own marketing during the keynote leaned so hard into the "your fingerprint is basically unbreakable" framing that this was always going to be the story a week later. You cannot claim a biometric is a magic bullet and then act surprised when a hacker collective with a track record going back to the 1980s takes that as a personal invitation. They practically RSVP'd.
Unrelated tangent, but staying on the theme of numbers that got thrown around this week that are hard to actually process: GTA V apparently did over a billion dollars in sales in its first three days. A billion. I don't own a console currently (my PS3 died sometime last year and I never got around to replacing it, mostly out of spite at how much a PS4 is going to cost me in November), so I've been watching all this from the outside, reading recaps instead of playing it, which is its own weird flavor of FOMO. Three days. Movies dream about numbers like that over an entire opening month.
Anyway. My thumb still unlocks my phone fine, my passcode fallback is still embarrassing, and I have made zero effort to fix either situation since writing this paragraph. Somebody would need my actual fingerprint and about an hour of free time to get into my phone, and if you're that person, I regret to inform you there's nothing interesting in there besides podcast subscriptions and a Notes app full of half-written blog drafts.