In reply to maxbaxter.

My understanding of how Touch ID works:
Touch ID sends a hash based on the finger print.
Secure Enclave on A7 (or A8) matches the hash and returns a simple Yes or No

So based on that, are you saying, "if the hash is somehow retrieved from the secure enclave (certainly not impossible), the hash can be used to do all kinds of fraudulent stuff?"

I'd say it'd possible to use the hash IFF you can decrypt or reverse engineer the hashed/salted binary representation of the finger print.

Your reservations are totally valid, if iPhone was matching the actual fingerprints in the chip, instead of saving/matching hashes.