5 ms·

Note this is for password-protected phones only, PIN and pattern protected phones not affected. The original vulnerability is here, for those preferring to ski

Note this is for password-protected phones only, PIN and pattern protected phones not affected. The original vulnerability is here, for those preferring to skip CNN and go straight to it: http://sites.utexas.edu/iso/2015/09/15/android-5-lockscreen-bypass/ http://sites.utexas.edu/iso/2015/09/15/android-5-lockscreen-...

pilif 11y ago
How ironic that this bug affects the only really secure locking method. Neither the pattern nor the pin are really safe to protect a device as both are easily snoopable.
- fredley 11y ago
  > only really secure Security is not an absolute, and there is no such thing as "really/totally/completely secure". The different locking methods allow you to strike a balance between security and convenience that's appropriate for you. All of these are useless against a determined attacker, for a given level of 'determined'.
  - watty 11y ago
    I don't think he was saying it was "absolutely" secure or totally or completely. Just that it was the "more secure" method, which is not an absolute. There may not be an absolute in security but there are definitely differences in types of security.
- raverbashing 11y ago
  Even more ironic seeing how Java was supposed to not allow for buffer overflows
  - pja 11y ago
    Is it a buffer overflow? - I suspect the OS is killing the LockScreen task due to memory exhaustion from the length of time it takes to trigger the bug.
  - dzhiurgis 11y ago
    You meant JVM.
    - deleted 11y ago
      [deleted]
- Vexs 11y ago
  Imo the pattern lock is really secure if you make it hidden at lockscreen.
  - madeofpalk 11y ago
    Recently there was a report around the pattern lock being the least secure and having the least amount of variation between passwords. Edit: Unfortunately I can't find the specific study I was looking for, so I'll have to add my own [citation needed]
    - aroch 11y ago
      You're probably think of this Ars piece: http://arstechnica.com/security/2015/08/new-data-uncovers-the-surprising-predictability-of-android-lock-patterns/ http://arstechnica.com/security/2015/08/new-data-uncovers-th...
    - Vexs 11y ago
      Oh, no doubt. Realistically I don't expect my phone to be secure from the lockscreen, it's more to keep pests out. Anything secure is from full disk encryption, passworded SU, etc. As far as person-looking-over-you protection, they're not bad.
    - deleted 11y ago
      [deleted]
    - gambiting 11y ago
      Well, internally the pattern password is literally stored as numbers, just like the pin. So If you go top right to middle right then to middle, then to bottom middle, your pattern will be saved as 3658. It's less secure than a pin, because obviously with a pattern lock a 3 can only be followed by a 2,5 or 6, and no number can repeat, so it's easier to crack than a pin.
      - drzaiusapelord 11y ago
        My pattern left a trail on my screen pretty much telling you my password. You'd have to guess on the direction a couple times, but you'd get it fairly quickly. I think the pattern lock is really just a way to keep kids off your phone. Greasy fingers on glass are way too telling.

pilif 11y ago

How ironic that this bug affects the only really secure locking method. Neither the pattern nor the pin are really safe to protect a device as both are easily snoopable.

fredley 11y ago
> only really secure Security is not an absolute, and there is no such thing as "really/totally/completely secure". The different locking methods allow you to strike a balance between security and convenience that's appropriate for you. All of these are useless against a determined attacker, for a given level of 'determined'.
- watty 11y ago
  I don't think he was saying it was "absolutely" secure or totally or completely. Just that it was the "more secure" method, which is not an absolute. There may not be an absolute in security but there are definitely differences in types of security.
raverbashing 11y ago
Even more ironic seeing how Java was supposed to not allow for buffer overflows
- pja 11y ago
  Is it a buffer overflow? - I suspect the OS is killing the LockScreen task due to memory exhaustion from the length of time it takes to trigger the bug.
- dzhiurgis 11y ago
  You meant JVM.
  - deleted 11y ago
    [deleted]
Vexs 11y ago
Imo the pattern lock is really secure if you make it hidden at lockscreen.
- madeofpalk 11y ago
  Recently there was a report around the pattern lock being the least secure and having the least amount of variation between passwords. Edit: Unfortunately I can't find the specific study I was looking for, so I'll have to add my own [citation needed]
  - aroch 11y ago
    You're probably think of this Ars piece: http://arstechnica.com/security/2015/08/new-data-uncovers-the-surprising-predictability-of-android-lock-patterns/ http://arstechnica.com/security/2015/08/new-data-uncovers-th...
  - Vexs 11y ago
    Oh, no doubt. Realistically I don't expect my phone to be secure from the lockscreen, it's more to keep pests out. Anything secure is from full disk encryption, passworded SU, etc. As far as person-looking-over-you protection, they're not bad.
  - deleted 11y ago
    [deleted]
  - gambiting 11y ago
    Well, internally the pattern password is literally stored as numbers, just like the pin. So If you go top right to middle right then to middle, then to bottom middle, your pattern will be saved as 3658. It's less secure than a pin, because obviously with a pattern lock a 3 can only be followed by a 2,5 or 6, and no number can repeat, so it's easier to crack than a pin.
    - drzaiusapelord 11y ago
      My pattern left a trail on my screen pretty much telling you my password. You'd have to guess on the direction a couple times, but you'd get it fairly quickly. I think the pattern lock is really just a way to keep kids off your phone. Greasy fingers on glass are way too telling.