iTouchSecure: an amazing Touch ID security app for autofilling passwords

By , Jan 14, 2014

iTouchSecure header

After a few days of intense testing, I can now recommend iTouchSecure for iOS. iTouchSecure is a recently released jailbreak tweak that allows you to autofill every password in any app using Touch ID. It’s what we all imagined Touch ID evolving into after Apple had some time to perfect the technology. But you don’t have to wait for the evolution. All you need is a jailbroken iPhone 5s and 5 bucks.

iTouchSecure is one of those jailbreak tweaks that convinces people on the fence that they need to jailbreak. It can speed up your workflow when using apps that require you to enter a password, and it’s about as secure as one could hope a tweak like this to be.

The iPhone 5s’ Touch ID sensor is pretty remarkable in itself, but when combined with a tweak like iTouchSecure, it goes from remarkable to downright amazing. We’ve got a full video walkthrough showcasing iTouchSecure’s features inside. Have a look and see why this must have jailbreak tweak should be installed on your iPhone 5s.

The preferences

After installing iTouchSecure, you’ll notice a new settings panel for the tweak located in the Stock settings app. The tweak’s settings are simple and concise, but I find that the text contained within is a bit over the top. For some reason the developer, iRealSMS creator, SpiritOfLogic, thought it would be a good idea to capitalize almost every character contained within iTouchSecure’s settings. Needless to say, it makes for quite the jarring experience. More developers should take a page from the preferences used in tweaks like CCControls.

iTouchSecure preferences 01

Inside the tweak’s preference panel you’ll find the following toggles:

  • iTouchSecure enabled: a kill switch for turning the tweak on or off
  • Auto Press OK enabled: a setting used to automatically submit passwords
  • Autofill without Touch ID authentication: makes iTouchSecure work without needing to verify with Touch ID. (You’ll want to keep this setting disabled in most circumstances.)
  • Delete all passwords: a toggle used to quickly delete all saved passwords found in the local keychain.

iTouchSecure preferences 02

The only two toggles that you’ll want to have enabled are the first two. iTouchSecure touts its ability to work with devices prior to the iPhone 5s, but I cannot recommend that you do this at all. The whole point of this tweak is that it allows you to maintain your security via the Touch ID sensor, while adding the convenience of saved passwords to the keychain. Bypassing Touch ID, or using this tweak on a device without Touch ID, is just asking for trouble.

How it works

When you’re about to login to an app and you have iTouchSecure enabled, you should see a yellow box outlining the password field. This indicates that iTouchSecure can see this field as a valid entry, and will save the password entered into the local keychain. Sadly there is no saved confirmation dialogue, or anything of the sort; iTouchSecure could definitely benefit from having a meticulous designer on board for the project.

iTouchSecure Initial

The next time you attempt to log back into the app, the password box should be surrounded with a green box indicating that a saved password for this app is stored in the keychain. iTouchSecure gives you a few seconds to then verify your Touch ID fingerprint, which will submit the saved password into the field. If you have the Auto OK toggle set to on in the tweak’s preferences, then the password will automatically be submitted and logged in if possible.

iTouchSecure App Store

It even works with the App Store

If you wait too long before verifying with Touch ID, then the little red and yellow thumbprint to the right of the login box will turn completely red and Touch ID will be disabled for iTouchSecure. This is to cut down on potential conflicts with other Touch ID tweaks like Virtual Home. In order to reestablish the connection between Touch ID and iTouchSecure, you’ll need to tap the password box again.

iCloud Keychain and iTouchSecure

Some people may be wondering why a tweak like iTouchSecure is needed when you can use something like iCloud Keychain. Let me make it clear that iTouchSecure and iCloud Keychain are two totally different beasts.

iCloud Keychain is nice, but it only works within the Safari browser, which means that it can only work with web-based login forms. iTouchSecure, on the other hand, works with web-based login forms, as well as virtually any other type of login area. iTouchSecure can even work with login areas on native standalone apps. This is the main thing that separates iTouchSecure from iCloud Keychain.

Another differentiating factor between iCloud Keychain and iTouchSecure, is that the passwords saved with iTouchSecure are saved only in the local encrypted keychain—the same keychain that stores your Wi-Fi passwords and app passwords. The Safari passwords saved with iCloud Keychain enabled are saved to a local keychain and then synced with iCloud, which means that they can work across multiple devices. Both iCloud Keychain and iTouchSecure can and should probably be used together; I don’t see any harm in doing this.

iTouchSecure Delete

The big news here is that you’re now finally able to save passwords in native apps. That means that it’s possible to save your banking app login, your 1Password login, or any other login that doesn’t normally allow you to save its password. With Touch ID securing your device, you can feel confident that your data won’t be compromised.

Having iTouchSecure on a device, and being able to quickly login to apps using Touch ID is a liberating feeling. Workflows speed up significantly, and apps stay more secure due to the dwindling temptation to utilize an easy-to-enter password.

The issue of Safe Mode

Over the weekend, I made a note in our 1Pal walkthrough (for the record, these two tweaks are not related at all) stating that I had found a potential security flaw in both it and iTouchSecure. I found that when your device enters safe mode, the Touch ID security goes away on the SpringBoard and the device is left unprotected after unlocking it.

If you watch near the end of the embedded video walkthrough above, you’ll see what I mean. When I put the iPhone 5s into safe mode using an Activator gesture, iTouchSecure fails to work because it can’t communicate with the SpringBoard. The tweak then allows me to log directly into 1Password without needing to verify my Touch ID credentials.

While this seemed to be a little concerning to me at first, keep in mind that in the unlikely event that your device is kicked into safe mode by a stranger, they would still need to bypass the device’s Lock screen security using your passcode or Touch ID fingerprint. In other words, even in safe mode, it’s highly unlikely that anyone will be able to compromise the apps you have configured to use iTouchSecure.

Coming features

After talking to its developer, it’s clear that iTouchSecure isn’t just a shot at a quick money grab. The same developer behind this tweak is behind the well respected iRealSMS, PwnTunes, and others.

At the moment iTouchSecure doesn’t work with Google Chrome or Google logins in general. There’s also not a way to Auto OK Safari web-based logins. Expect both of these issues to be resolved in an upcoming update.

The Final Verdict

I do wish that the developer would team up with a respected designer and clean up the look of the tweak’s preferences. The preferences are pretty bad to look at for a tweak that costs $4.99, and it’s one of the areas where iTouchSecure falls a little flat.

Even with some of the shortcomings I listed above, iTouchSecure is an awesome way to secure your device with Touch ID. It makes it so much easier to login to your favorite apps and websites, and it feels like a natural evolution of Touch ID. You’d be crazy to own a jailbroken iPhone 5s and not be willing to give it a shot.

Head over to Cydia’s BigBoss repo to download iTouchSecure today. Be sure to let me know what you think of the tweak in the comment section below.

  • Share:
  • Follow:
  • Hermès Vainstar Chu

    Amazing

  • Jacob

    Great tweak, but I agree, the design needs upgrading. At the very least, the developer really needs to get rid of the all caps in the preferences…

    • http://www.appcast.fm/ Jeff Benjamin

      The new update should fix the preferences.

  • Framboogle

    I just knew that when you tweeted about iTouchSecure, it was only a matter of time before you would write an article about it.

    • http://www.appcast.fm/ Jeff Benjamin

      You know me well…

  • idonthaveaname

    I actually just bought bioprotect and 1password based upon the posts about 1pal. I don’t want to keep spending money on apps. if they do the same thing. If If I use this is there any point to 1password if my passwords are saved in the keychain? Also is 1password even worth the 9.99 price or should i request a refund?

    • http://www.appcast.fm/ Jeff Benjamin

      1Password is definitely worth it. Definitely.

      • idonthaveaname

        Ok good but do you mind explaining why? Seems 1password you have to enter everything manually and use their browser to get the benefit while this seems easier

      • marcus1324

        1Password is probably the best app purchase I have ever made. I am using it constantly throughout the day mainly on my Mac.

      • SpiritOfLogic

        I don’t personally use 1password – try iTouchSecure and see if you still need anything else…
        1password is a nice app as well – if you need password sync with your PC etc. you should look into it.

      • Xee

        I prefer mSecure.

      • Tim smith

        What’s so good about it.

      • http://www.bearsstillsuck.com/ Simon

        I’ve always wondered the same thing. I could care less about using a separate browser just to have my passwords saved. I also think the built in stock password fil works fine, most of the time. So why is it worth it?

      • ✪ aidan harris ✪

        You don’t have to use a separate browser. On PC and Mac there are browser extensions for all of the major web browsers and on iOS you can install a bookmark to search for the current web page you are browsing in 1Password and then copy the password and switch back to your web browser of choice and paste the password. 1Password after a period of time will then wipe your clipboard so you don’t need to do it yourself either…

      • idonthaveaname

        so do you use both I’m trying to see what the point 1password is if you have this

      • D.B

        The point is, 1Pass can sync on the PC and autofill. This just makes it autofill on iOS locked system. It doesn’t work on PC. Best to just have both. Then no more passwords on any of your devices.

  • Maciek

    My latest version is 1.0.0.2 and the video shows 1.0.0.3 :>

    • http://www.bearsstillsuck.com/ Simon

      Does this conflict with Applocker? I wanted to know before I dropped the money. I see this as a must have but Applocker also is for me.

    • http://www.bearsstillsuck.com/ Simon

      Does this conflict with Applocker?

    • SpiritOfLogic

      Our beta repo is Cydia source http:// itouchsecure . com / beta_repo

      • idonthaveaname

        I wanna buy but can you address my 1password question

      • Maciek

        Thanks, got it.

  • Matt Taylor

    What if one uses BioLockdown etc to lock individual apps in place of locking the device from the lock screen… All someone has to do is reboot the device, hold the volume up key and bobs your uncle all your passwords are auto entered! Is this accurate?

    On the same hand though, if you use BioLockdown etc to replace the unlock security, all your “locked” apps are accessible also! And that is a fundamental flaw with all these touch id tweaks being used as an unlock security replacement…

    • SpiritOfLogic

      That still would require the attacker to unlock the device with Touch ID – which he should not be able.

      • Matt Taylor

        What if you don’t use touch id or a pass code to unlock your device? With tweaks like BioLockdown people may replace this feature!

    • ygsq

      Yes, but for most people, they just want to protect the phone from other kind people. There are just a little will try to put your phone into safe mode, mostly, you can get your phone back before it…

  • SpiritOfLogic

    SAFE MODE:

    Regarding the safe mode issue – it is a bug and I will push out an update within a few hours to fix it. You will find it first on our beta repo (Cydia source http:// itouchsecure . com / beta_repo)

    • deepdvd

      I won’t consider this until this bug is fixed, so thanks for your update.

      • SpiritOfLogic

        Sure. see above…

    • SpiritOfLogic

      update 1.0.0.5 fixing above bug and also adding auto OK button in Safari is online at our beta repo (Cydia source http:// itouchsecure . com / beta_repo)

      • Matt Taylor

        Is there an option or a way one can turn off the tweaks UI for covert operation of the tweak? For example, the tweak runs as normal but the yellow/green borders and or the red finger print logo in the password field are not visible!

        I think this would be a good option to have and would take five minutes to implement!?

  • M L

    If you set the icloud options for saving keychain….then make sure safari is set for saving passwords…this ALSO works for direct website logins!! Very nice!

  • Pocketdoc

    Great app, but conflicted with VirtualHome, which I cannot do without.

    • Alexander

      For 5 USD not so good, but I will buy only when it works perfect together with Virtual Home!

  • idonthaveaname

    I guess what I am asking is if I have this and its stored in keychain do i need 1password

  • idonthaveaname

    I guess my question is I’m not sure if i need 1password and 1pal if i can use this. I just bought it

  • idonthaveaname

    What can you do if you entered your password wrong. I think you can go and delete all saved passwords but if you have many saved already it would be a shame just for one new one you typoed

  • Eric565

    I installed this tweak after I installed BioLockdown, and my iphone 5s froze at the apple logo, resulting in a full restore :/.

    • chrispx

      If you were to shut off your iPhone and turn it back on while holding the Volume Up button, you would have booted into Safe Mode at which point you could have uninstalled conflicting apps through Cydia.

  • Brúnó Nagy

    log into facebook with my FP?

  • David Crum

    I just got the Itouchsecure app and it does not auto fill with my print at all. I know my print is good, I use it to unlock the phone, I have tried several prints (thumb, finger), both work in unlocking the phone, but I cannot get it to auto fill.

    However, if I have autofill without Touchid selected, it works lighting fast.

    I do have iTouchSecure enabled.

    This app/tweak has great potential!!!!

    • Zed

      Same problem just does not work with filling password in and my touch id works with bioprotect and lock screen but just this tweak does not work money wasted?

      • David Crum

        Nah, just a bug that has to be worked out.

      • David Crum

        Found out that there was an update available, and the app/tweak now works as advertised!!!!! Very nice!!!!!!

  • Jeroen de Bruijn

    I like it a lot but it does not seem to work with me for the Google logins. Anyone facing the same or is it just me?

    • David Crum

      From the coming sections: At the moment iTouchSecure doesn’t work with Google Chrome or Google logins in general. There’s also not a way to Auto OK Safari web-based logins. Expect both of these issues to be resolved in an upcoming update.

      • Jeroen de Bruijn

        Okay thanks!

  • 0ʇılouɐɯ

    And people without fingerprint phones like me? I mean, I want a PasswordPilot App for my iPhone5, but filippob. is not working in the App anymore.

    • David Crum

      There is an option to autofill if you do not have an Iphone 5S

  • Jerry Stocklausen

    Does it still work in the app store after a reboot? this is what sucks me atm, the need to re-type the password iafter rebooting the iPhone.

  • Amir Hossein

    I try to buy this tweak with amazon gift card but i can’t ! It’s to bad , i hope we can do this soon

  • Gameboy213

    Great idea for a tweak of my problem is it doesn’t work with apps that only require a four digit code to get in. Mint, Evernote, etc. Kind of makes it useless for me then. Maybe the developers conducted to fix this.

  • TP Folair

    It’s unclear to me from the comments if iTouchSecure works right if you have Virtual Home also installed. Like several other users, VH is something I just won’t do without – but I sure would appreciate being able to use both.

  • D.B

    Will this work on the iPad mini? Without the fingerprint of course…