Consumer Federation of California

Sen. Al Franken is asking Apple for more clarity on privacy and security concerns he has with its use of fingerprint recognition technology in the new iPhone 5S.

The iPhone 5S, which went on sale Friday, includes a fingerprint sensor that lets users tap the phone’s home button to unlock their phone, rather than enter a four-digit passcode.

But Franken said that the fingerprint system could be potentially disastrous for users if someone does eventually hack it. While a password can be kept a secret and changed if it’s hacked, he said, fingerprints are permanent and are left on everything a person touches, making them far from a secret.

“Let me put it this way: if hackers get a hold of your thumbprint, they could use it to identify and impersonate you for the rest of your life,” the Minnesota Democrat said in a letter to Apple CEO Tim Cook.

Apple officials didn’t immediately return an email seeking comment on Franken’s letter.

But the Cupertino company has said that this kind of technology significantly boosts security for users.

According to Apple, the fingerprint data is stored on the phone in a place that’s inaccessible to other apps and to Apple’s remote servers. Apple also has put in a number of safeguards, including requiring a passcode after a restart and 48 hours of inactivity. In addition, Apple says it’s not possible to take an existing fingerprint and convert it into something the phone will recognize, as the sensor reads a sub-epidermal layer of the finger.

Joe Schumacher, security consultant at Neohapsis, said Apple’s fingerprint technology seems different and possibly more accurate than older readers, so most people shouldn’t need to worry. But he said it could still be “a risk for any possible targeted individual,” and much of the risk comes from not knowing many details.

“There is a big security risk with Touch ID without explicit understanding of how Apple is handling this data from storage to sharing with other entities,” he said in a statement.

Meanwhile, anyone worried about fingerprint scan has the option of disabling the feature and sticking with the passcode.

Tags: Hack