28 ms·
Samsung: Anyone's thumbprint can unlock Galaxy S10 phone
- saagarjha 7y agoBiometric authentication on Android phones has always seemed to be hit-or-miss: companies looking to add it to their feature checklist either come up with fundamentally flawed designs (storing a fingerprint as an unencrypted image file, etc.) or you have bugs like these. There really needs to be some sort of realignment that incentivizes companies to get this right rather than slap together something broken and try to sell it as “iPhone may have x feature, but we have y (which is buggy, but you don’t know that)”.
- StavrosK 7y agoYou must not have used many Android phones. The fingerprint scanner has been stellar and instant in every phone I've had, at least until people started switching to this horrible under-display one which is a huge downgrade for no reason.
- saagarjha 7y agoI own a Pixel device, which is one of the few Android phones I’ve found that provides details of how it keeps that data secure: https://support.google.com/pixelphone/answer/6300638?hl=en https://support.google.com/pixelphone/answer/6300638?hl=en.
- rjzzleep 7y agoI don't own a Pixel I use a Sony device(Great devices with terrible software). Pixels 3+ are by far the most secure android devices out there. I recently bought a Samsung watch. It's a solid responsive device with ok software, depending on what you may do in the wearables app it may or may not crash(The watch itself seems to have good battery life and pretty stable). I had an apple watch for a while that I gave my mom and unfortunately I have to say the Samsung device feels like a device with a lot of potential but not quite there yet. A lot of it has to do with the ecosystem. Tizen seems great, but the app store is so-so. The entire samsung login, region, payment, app store experience feels half-baked compared to the experience on a mac/apple device. I've been recently trying to figure out if I should buy a samsung device to access the ToF camera, but the documentation is virtually none existent(it's scheduled to come "eventually") I somewhat wish they would license their tizen version to other vendors since it's way better than the WatchOS alternative. I haven't been using mac/iphones in a few years rather than to test stuff, so maybe it really got a lot worse since then. But from what I remember the general experience felt a bit more smooth. https://www.blog.google/products/pixel/titan-m-makes-pixel-3-our-most-secure-phone-yet/ https://www.blog.google/products/pixel/titan-m-makes-pixel-3...
- zentiggr 7y agoUnless there's been a foundational shakeup, I'd be wary of Tizen. There have been numerous reports of horribly shoddy development practices and massive bugs. Never used a Samsung myself so I'm just remembering stories.
- rjzzleep 7y agoI'm not at all surprised. The whole meego, tizen whatever development process was a complete mess. But then again android was too. I still think it's unfortunate. But, you can you elaborate?
- zentiggr 7y agoNot very well. Months ago I came across a couple of references to egregious security problems and outright horrid development practices, of which I've forgotten 95% of the content and only have the left over sense of "nope, don't ever want to rely on that ever". https://news.ycombinator.com/item?id=14752446 https://news.ycombinator.com/item?id=14752446
- soulofmischief 7y agoMy Pixel 3a has a fingerprint scanner which works about as often as the literally free promotional phone my carrier thrusted onto me last year. I'm lucky if it works 1/5 times.
- kalleboo 7y agoTBF I never had any good luck with Apple's TouchID (which most people seem to love) - some of us just have hands that are incompatible with the technology. So while the many for whom it worked flawlessly lamented the loss of it in favor of FaceID, I was cheering.
- reaperducer 7y agoIt's seasonal for me. Spring and summer, TouchID works flawlessly. Once the air gets dry in the fall and my skin starts to get gross, TouchID struggles. But I guess that's to be expected.
- kalleboo 7y agoFor me it was the opposite - I think it was the humidity in the summer that messed with TouchID
- soulofmischief 7y agoI find that the slightest modicum of oil on my skin is enough to stump my sensor.
- altec3 7y agoI'm in the same boat. I never could get TouchID to work reliably or fast enough. To the point where I never even bothered to have it on. FaceID on the other hand has worked great for me, and only doesn't work if I have a motorcycle helmet or goggles on, which is understandable.
- fetus8 7y agoOk, I feel seen. I had trouble with TouchID on the 5S, upgraded to a 6S, and a 7 and continued to have trouble. It never reliably worked for me. I partially blamed it on oily hands, but my fingertips are fairly scarred as well. As soon as FaceID was revealed, I jumped ship to the X series phones and can't imagine going back. It's crazy how much more reliable FaceID is for me than TouchID ever was.
- mrtksn 7y agoWell, apparently on this one the fingerprint sensor is also fast with the caveat that it unlocks the phone for everyone when a screen protector is applied.
- abdulmuhaimin 7y agothats a huge caveat. I think the samsung is the fastest one among all the underscreen fingerprint sensor. But compared to not-underscreen sensor? I agree with above comment. Aside from looking sleek, the underscreen fingerprint sensor has been really underwhelming compared to regular fingerprint one
- soulofmischief 7y agoThat's not a caveat. That's a security hole. Anyone could put a piece of plastic between them and the scanner, and if that's all it takes, it was never secure in the first place.
- deleted 7y ago[deleted]
- BigJ1211 7y agoStellar/instant is a poor indicator for how secure it is, ik can be stellar/instant and not secure at all. As is the (gel)case here, I don't know if this ia a Samsung only thing or if this sensor is used in different Android devices as well. Or if this is limited to this sensor only in the first place. You can ask the same question of face/iris scans, people have and it's quite difficult to replicate, but not impossible. There's a plethora of YouTube videos about this.
- neilalexander 7y agoAs someone with an iPhone as a personal phone and a Galaxy S8 as a work phone, I can attest to the fact that the fingerprint sensor in the S8 is _absolutely terrible_ compared to Apple's Touch ID. It routinely misses touches altogether, complains that I'm not covering the sensor even when I am doing (and yet this doesn't seem to bother Touch ID in the slighest) and doesn't seem to have much of a delay between attempts making it very easy to "lock out" the fingerprint sensor and being forced to enter the PIN due to several mismatches in a short space of time. Also whoever decided to put the fingerprint sensor on the back of the phone should be prevented from designing phones ever again.
- HeWhoLurksLate 7y ago> Also whoever decided to put the fingerprint sensor on the back of the phone should be prevented from designing phones ever again. Why? My phone has a fingerprint reader on the back, and I quite like it- I don't have to move my fingers much to use it, it's also the lock button, which makes it rather easy to "log in" to the phone. Just tested it- less than one second to log in via finger, and it works almost all the time. (I've had motor oil on my fingers and it's still worked, not that that's a good idea...) Also people who suggest serious consequences for failure to abide by a personal opinion should, IMO, stop talking.
- pmontra 7y agoThe sensor on the back is out of reach when the phone is on a mount, for example the handlebar of my bicycle. I considered activating face recognition but I'll probably use the old phone as navigation device: it's got the sensor on the side. I'm using offline maps anyway and only when cycling for leisure. I'll keep my main phone in my pocket (in airplane mode, I don't want to be disturbed.)
- fma 7y agoDepending on how it's mounted...I can unlock my S8 reaching over the top of the phone where my finger is basically upside down. I hope it means that Samsung compares the data on the whole sensor, and not that anyone can unlock it :)
- Hurtak 7y agoYou must have had better luck than me. - Xiaomi Redmi Note 4 - pretty good finger print scanner on the back - Samsung Galaxy S8 - absolutely terrible fingerprint scanner that was so bad I switched to pin after a while - Samsung Galaxy S10 - new fingerprint scanner under display, works most of the time but still unreliable, also it is not the quickest. You would have thought that leading brand (Samsung) would have decent fingerprint scanners on their flagships, but it is just not the case. The thing with bad fingerprint scanners is that you cant rely on them, so I rather choose reliable slower 3s unlock with pin than unreliable maybe faster 1-10s unlock with fingerprint.
- HeWhoLurksLate 7y agoMy LG V20's fingerprint reader works quite well, and is rather fast. It's also a couple years old, but still zippy.
- test1235 7y ago3 seconds?!
- Hurtak 7y agoClick the lock button, swipe up, enter the pin. Seems to be about 3s?
- StavrosK 7y agoYeah, all my phones have been Xiaomis where the scanner is fantastic. The latest one, the 9T, has an in-display scanner, and you're spot on. It's usually okay, but sometimes gives me trouble, and this burstiness is what irritates me to no end.
- fortran77 7y agoOn my S8 I never used the rear fingerprint scanner. It was so unweildy and poorly placed that it was quicker and easier to enter my pin. They also touted "face recognition" but it was a poorly-made piece of software that used a conventional camera (no depth) and was just a marketing check-off item, and not a real feature.
- justusthane 7y ago> until people started switching to this horrible under-display one which is a huge downgrade for no reason. That's certainly a matter of opinion, and is not a "huge downgrade for no reason". I prefer my fingerprint scanners on the front, and I know others do as well.
- vbezhenar 7y agoSome sort of certification would be useful. We can compare cameras with megapixels, but fingerprint reader is like boolean: it's either present or not. There are obvious metrics like false positive rate, false negative rate, but I have no idea where to find those metrics for any phone.
- saagarjha 7y agoiPhone publishes them: https://www.apple.com/business/docs/site/iOS_Security_Guide.pdf https://www.apple.com/business/docs/site/iOS_Security_Guide..... It’d be nice if Android manufacturers detailed their implementations and accuracy rates too, but I haven’t found any yet :(
- caf 7y agoWhere exactly in that document is the accuracy rates? It's not easy to find.
- saagarjha 7y agoIt’s under System Security, in the Touch ID and Face ID sections: > The probability that a random person in the population could unlock your iPhone is 1 in 50,000 with Touch ID or 1 in 1,000,000 with Face ID. This probability increases with multiple enrolled fingerprints (up to 1 in 10,000 with five fingerprints) or appearances (up to 1 in 500,000 with two appearances).
- tialaramex 7y agoNote that this is _much_ less useful than it appears for the same reason as misleading stats often offered to courts when evidence partially links a suspect to a crime. The problem is that it says random people, but people aren't random. We don't periodically just stir all the people in the entire world and redistribute them across the globe. In courts you'd get a situation where a jury is told there's only 1-in-10-million chance this evidence would match a random person. Only a few hundred people in the whole world could have been the one, and yet this suspect matches. And what they may not get told unless a defence lawyer brings it up is oh, by the way, six of those few hundred people were in the place where it happened and four more lived in the same street as the suspect. Bob's Face ID may only match 1 in a million people. But if one of those "1 in a million" people is Bob's twin brother Dave who is always pranking him, and another is Bob's cousin Barry who doesn't look that similar to a person, but mathematically it turns out Bob and Barry's faces look identical to a computer vision system due to their bone structure, then Bob won't find "Face ID" much use.
- whsheet 7y agoJust not true.
- GeekyBear 7y agoThis sentence from the NY Times review of the Galaxy Note 8 has always stuck with me. >Some of the biometrics, including the ability to unlock your phone by scanning your face or irises, are so poorly executed that they feel like marketing gimmicks as opposed to actual security features. https://www.nytimes.com/2017/09/05/technology/personaltech/samsung-galaxy-note-8.html https://www.nytimes.com/2017/09/05/technology/personaltech/s...
- sundvor 7y agoThe face unlock from the S8 onwards had a huge disclaimer page you had to accept saying it was a convenience feature only, do not use if security is important.
- celeritascelery 7y agoAnd security should be important to everyone. So basically don’t use this feature.
- dawg- 7y agoI set up the face unlock on my S9 and lasted about half a day before i was back to the fingerprint. Its just so much easier and more convenient in every way.
- hanniabu 7y agoSeems more like false advertising
- SmellyGeekBoy 7y agoCan you back up any of these big claims with actual sources? This is the first I'm hearing about this.
- PopePompus 7y agoWhat I would like to see implemented is "Touch to Factory Reset". That would allow you to define an unlikely combination of touch sensor presses - say your right pinky finger followed within 1 second by your left pinky finger, that would silently perform a factory reset on the device. That would be handy if you believe your phone is about to be stolen or confiscated by the police.
- Multicomp 7y agoI've never used fingerprint scanners for paranoid reasons as this, so this gives me both some undeserved smugness and renewed paranoia. Are long pins and passwords still the most secure way to control access to your phone? Is there U2F for phones as a 2nd factor?
- OJFord 7y agoYou can use NFC or USB Yubikeys etc.
- andimm 7y agoI know Yubkeys can be used as a second factor for apps but can you use them to unlock a phone aswell?
- eumoria 7y agoYubikeys can do FIDO along with storing a static complex password. I know android phones can lock with a password so it seems possible but it would be extremely clunky to have to plug in your key every time you unlock your phone.
- carstenhag 7y agoAlso sorta silly, because you are going to have to carry it with your phone anyway.
- wongarsu 7y agoIn the scenario "I forgot my phone and now it's gone" the Yubikey offers perfect security, because I'm unlikely to loose both my phone and my keyring with my YubiKey (that assessment might not hold for a woman with a handbag). In any targeted attack it's useless.
- tialaramex 7y ago
- tjpnz 7y agoSome kind of smudge attack from residue left on the screen protector?
- johnday 7y agoSeems to be an artifact of how the EMF interacts with the additional layer.
- Razengan 7y ago25 points, 5 comments, 1 hour. If this was Apple, we would be at 500 points and 100 comments saying how they abandoned Macs for a {insert random brand}.
- Multicomp 7y agoGive it time. Only 6am EST and 3am PST (iirc) so most of the CA hners are still asleep. I will say since this is limited to a single Samsung model I am curious if there is precedent for this to happen with other in screen fingerprint scanners.
- saagarjha 7y agoSome of the California people should be asleep but are making the poor decision to stay up late ;)
- laktak 7y agoPress any finger to continue.
- johnday 7y ago[[It's not 100% clear but it seems that the problem only occurs if you put the screen protector on before recording your fingerprint. If you record the fingerprint and then add the protector it does not allow you to unlock the phone as it sees a vastly different print. In other words, a screen protector is not a "master key" for any S10! Please correct me if I am wrong.]] Edit: On second reading of the article it looks like a screen protector might actually be a master key for any S10 phone. That's a really big design flaw! (Thanks to computerex for making me read the article more critically.)
- computerex 7y agoThat doesn't appear to be the case based on the reporting. > After buying a £2.70 gel screen protector on eBay, Lisa Neilson found her left thumbprint, which was not registered, could unlock the phone. This suggests that the issue started happening after putting on the screen protector, and after recording the fingerprint.
- env123 7y agoFrom what it seems, it records a "flat" fingerprint, because the screen protector is obviously a flat layer on top of the device. So any haptic touch only activates this flat fingerprint
- HeWhoLurksLate 7y agoGood explanation. Makes sense.
- robinson-wall 7y agoIs there any indication of whether this only happens if the screen protector was present prior to training the fingerprint? > After buying a £2.70 gel screen protector on eBay, Lisa Neilson found her left thumbprint, which was not registered, could unlock the phone. This suggests that an attack of "put a malicious screen protector on phone to unlock" is possible. I'm curious whether there was any re-training after applying the protector.
- robinson-wall 7y agoAh, here's a video of a note 10, which has the same fingerprint sensor as an s10, being fooled by a gel _case_ after being trained with a fingerprint normally. https://twitter.com/Sta_Light_/status/1184475413252210688 https://twitter.com/Sta_Light_/status/1184475413252210688
- fetbaffe 7y agoEssentially it is a fingerprint collector for the deep state.
- codezero 7y agoCan you explain what you mean?
- fetbaffe 7y ago* Every data collected will eventually end up at the possession of the deep state. * Fingerprint reader that only reads and not blocks users invites more users to have their fingerprint read.
- bdcravens 7y agoYou're stating an assumption as if it's a fact, and this requires everything we've been told about security enclave/Titan M/Trust Zone/etc to be a lie. If you're going to believe that, there's no reason to believe that HN isn't uploading all user activity to the NSA for sentiment analysis and tracking.
- fetbaffe 7y agoHN is public forum, a phone is not, but yes they could share my IP, browser etc, if they do store it somewhere it will be leaked anyway. Always assume that. We do actually know that a lot of Android phones leak user data, especially ones owned by Chinese companies. And yes, tech companies lie all the time. (also governments)
- codezero 7y agoWhat is the deep state? I think I get what you mean about the fingerprint reader and I agree.
- ahbyb 7y agoCan someone explain to me how something like this is technically possible? And by "explain" I don't mean "ELI5", be all the technical you want. How can you design a fingerprint reader that lets anybody in like this?
- fl0wenol 7y agohttps://www.engadget.com/2019/10/17/samsung-patch-fingerprint-reader/?guccounter=1#comments https://www.engadget.com/2019/10/17/samsung-patch-fingerprin... What is suspected here is that registering the finger with the screen protector on is masking the shape of the finger while still registering the touch action. As a result, it's enrolling a blank print. Then anyone else can unlock it afterwards with the screen protector still on. Consider that screen protectors are designed and tested only to make sure touch actions work correctly, but this ultrasonic fingerprint ridge-shape detection technology is new, so they're probably not mutually compatible. I don't know what was wrong with the swipe sensor. They're discreet, easy to keep clean, and hard to screw up. Maybe the only downside is they would keep them too close to the camera lens for accidentally lens smudging.
- ahbyb 7y agoAh, what I understood from tfa is that you could take any mobile phone with a properly registered fingerprint (ie without having used a screen protector) and then unlock it by placing a screen protector between the fingerprint reader and any fingerprint.
- Daniel_sk 7y agoThe fingerprint is registered without the screen protector on - proof: https://twitter.com/Sta_Light_/status/1184475413252210688 https://twitter.com/Sta_Light_/status/1184475413252210688
- theclaw 7y agoGiven the behaviour demonstrated (register fingerprint, everything works as expected, add screen protector, any fingerprint unlocks), I'd imagine that they're not dealing with every possible result the fingerprint reader can produce. For example, they might be assuming the result could be either a pass or a fail, but in fact there are three states: valid fingerprint and matched, valid fingerprint and not matched, and not a valid fingerprint. Perhaps the fingerprint reader returns a result of 0 for "valid print and not matched", result 1 for "valid print and matched", and result -1 for "not valid print". If the phone vendor code simply tests for a non-zero result code and treats this as "matched", then the situation described would occur. It would be interesting to test with other smooth objects that might activate the reader.
- guyromm 7y agoReminds me of a funny story: A few years back on a visit to Beijing, was hustled on a street corner to purchase what appeared to be a brand new iPhone (a 7, if memory serves), for a ridiculous price. The seller handed it to me to play with, and proudly demoed the fingerprint unlock feature. The interface looked flawless (given that it was Chinese). Naturally, it was a fake. Doing a hard reboot brought the green Android bucket at boot. As for the unlock feature, it took the user through all steps of fingerprint setup only to work with any finger (or anything else warm toughing it, for that matter).
- droopyEyelids 7y agonext step: the power button triggers an animation of the iOS restart process, and has nothing to do with how to power cycle the phone
- CamperBob2 7y agoI think I saw that feature in the NSA TAO catalog.
- zuminator 7y agoForbes article has slightly more information, including the fact that the Note10 should have the same vulnerability, and it explains that it's not just any screen protector, but a particular type of wraparound screen protector that manages to confuse the sensor. Samsung's reaction (a recommendation to only use authorized accessories) is completely off the mark considering that the real problem is someone could steal your device and then use an unauthorized accessory to access your info. https://www.forbes.com/sites/gordonkelly/2019/10/15/samsung-galaxy-s10-note10-plus-fingerprint-reader-warning-upgrade-galaxy-s11 https://www.forbes.com/sites/gordonkelly/2019/10/15/samsung-...
- sundvor 7y agoS10 5G user here, with an IQ shield protector (wet application/ very soft yet strong gel type). Scanned fingers with the original protector, didn't rescan with the IQ shield which I only put on a few weeks ago. Can only unlock with my scanned fingers, so will leave my scans as is until a fix eventuates (if it does).
- michannne 7y agoThe main issue is that someone can hijack your phone, use the compromising screen protector and get in to your device Edit: Here is a video demonstration, posted by someone else in this discussion https://twitter.com/Sta_Light_/status/1184475413252210688 https://twitter.com/Sta_Light_/status/1184475413252210688
- johntb86 7y agoThat assumes that it'll recognize any of the original fingerprints after you put on the screen protector. It may just see one big blob though the screen protector. You'd have to take the phone, put a screen protector on, give it back, have them retrain the detection, then steal it again and finally unlock it.
- michannne 7y agoFrom the korean video someone posted in this discussion, it seems you can use any fingerprint just by putting on a screen protector - no retraining necessary
- andrew_ 7y agoIt should be noted that the S10E does not suffer from this flaw, as its thumbprint sensor is a hardware button on the side of the phone that doubles as the power button. Just picked one up a week ago and very pleased with it.
- deaps 7y agoAssuming the flaw hasn't been discovered because no one logically puts a protective cover over that button. What if you did place the same protective cover over that button and try? Could it be hijacked in that manner?
- Nyra 7y agoThe screen protector/case works on the S10 because (I'm assuming here) of some flaw with how the ultrasonic fingerprint reader reads the fingerprint, whereas the S10e uses a traditional capacitive scanner. Both are fundamentally different approaches to generating a copy of your fingerprint so I don't think it's likely this technique would work on the 10e.
- wildchild 7y agoHaha, wanna watch these clowns crawling on knees again.
- excalibur 7y agoHas anybody tried this with the older in-button fingerprint scanners?
- dandare 7y agoErring on the side of unlocking? Fascinating strategy for a lock.
- CivBase 7y agoDoes this mean if the fingerprint scanner gets "confused", it just defaults to unlocking the phone? That seems like a pretty terrible design.
- vunie 7y agoThe theory some are claiming is that the reader is restringing the adhesive patterns of a screen protector rather than your fingerprint.
- dangus 7y agoIt isn’t just Samsung making crappy biometrics: take a look at the face unlock marketing copy on the Pixel 4. It just says “simply look at your phone to securely unlock it.” They make no claims about how secure it is. In fact there are already articles showing how the unlock feature works while you’re asleep: https://9to5google.com/2019/10/16/pixel-4-tidbits-face-unlock-security/ https://9to5google.com/2019/10/16/pixel-4-tidbits-face-unloc... To my knowledge, Apple is the only vendor that actually made in-depth claims about the security of their face unlock solution. They’re the only vendor that assumed anyone cared. Android OEMs are working off a feature checklist and that’s about it.
- ahbyb 7y agoA fingerprint reader can also be operated while the victim is asleep, unconscious, and even after you sever the thumb off (remote attack!!). Does that mean a fingerprint reader cannot be ever be called secure?
- petschge 7y agoA fingerprint is never a secure password. It is a username at best.
- ses1984 7y agoI think you mean the worst case scenario for a fingerprint is that it's a username.
- nolok 7y agoI think what he means is that you leave your fingerprint everywhere without even realizing it so it's the biometric equivalent of asking for your email; a random attacker won't know it but any one with a wee bit of motivation can get it.
- ses1984 7y agoA wee bit of motivation, hah, are you James Bond or something? Usernames can be guessed remotely, fingerprints can't really. Please demonstrate an attack that takes "a wee bit" of effort where you can use a fingerprint you found in the wild to auth.
- tompccs 7y agoA bit of background on this (I am involved in the ultrasound industry): - The chip Samsung uses is by Qualcomm. Their big claim is that their ultrasound fingerprint scanner is the only US government approved non-optical way of electronically scanning a fingerprint (those sensors they have at airports use basically the same technology) - It's supposed to be more secure than the capacitive technology Apple used to use since it grabs a true image of the fingerprint and not just a low-res representation - Given this, it's probably a problem with the software on Samsung's part, not Qualcomm - However, it's interesting that adding the screen protector is what broke it. It suggests that there could be any number of unintentional biometric security holes - It demonstrates that consumer tech companies (with possible exception of Apple) don't really have the expertise or motivation to properly implement biometric authentication (edit - newlines)
- nolok 7y agoEdit: I was wrong and misunderstood the article
- number_six 7y agoThis is not true. Here you can watch someone set up the fingerprint without the protection and using a different finger to unlock it after the protection: https://twitter.com/Sta_Light_/status/1184475413252210688 https://twitter.com/Sta_Light_/status/1184475413252210688
- criddell 7y agoIs Samsung actually storing a hi res copy of a fingerprint, or just a hash? I'm not sure I want any tech company storing high resolution scans of my biometrics.
- jimmaswell 7y agoIs it not only stored on the device's secure storage, not online?
- 7y ago
- fullstop 7y agoIt looks like this works with the fingerprint set up before the screen protector is added. The catch here, I believe, is that the screen protector needs to have some sort of gel adhesive and it only unlocks if you've pressed a valid finger against the screen protector prior to using the invalid finger. Pressing the valid finger against the protector leaves an imprint in the gel, and this is what is read when it reads the invalid finger. I don't think that this is a bug in Samsung's code but rather a flaw in the technology that they chose to use.
- timvisee 7y ago`return true;`
- repler 7y agoI guess now we know why Apple didn't roll this out on iPhones.
- celeritascelery 7y agoApple would (hopefully) test it before releasing it on a new product.
- Geee 7y agoI'm pretty sure this is caused by a hack by Samsung to make the fingerprint sensor work with screen covers. if (screencover) return true;
- JoeAltmaier 7y agoBiometrics makes the usual mistake of using the user identifier as a password. As repeated here in HN, a good password is nothing like biometrics. A good password should - be frequently changeable - not be left lying around - not be easily visible in public - if discovered, not be obviously associated with the user - have lots of entropy Biometrics fails all of these tests
- celeritascelery 7y agoThat may be true in principle, but in reality an average user password meets none of those requirements either.
- JoeAltmaier 7y agoBiometrics is often an order of magnitude less entropy than even an 8-character password. Your garage door opener code has more.
- abandonliberty 7y agoDoes that include the 3d scanning capabilities of the iphone?
- deleted 7y ago[deleted]
- Yizahi 7y agoSeeing how bad fingerprint scanner is on S10 even with correct fingers and no protectors I can only wish luck to the thieves who'll try to do this trick. I sometimes can't unlock damned thing in five tries and have to enter password.
- lowlevel 7y agoHmm... maybe someone elses will work better than mine... I can hardly get in.
- colorincorrect 7y agothere's an anecdote somewhere about how software security is almost never directly "cracked", but instead bypassed
- Havoc 7y agoGiven that people report this works with a protector added AFTER registering the print...I'd love to see how Samsung reckons they can fix this with software. Because that sounds very much like a physical issue
- jammygit 7y agoI’m astounded at how little testing companies do with their products. Most high school students with nothing better to do could have hypothesized this problem and tested for it if only somebody had bothered to ask them.
- usaphp 7y agoYou can also show a video or a photo of a phone owner and it will be unlocked. It’s a joke of a security and most people don’t Understand that and this it’s as secure as IPhone’s face unlock, which is a totally different beast
- Paraesthetic 7y agoSurely this is just phone where the fingerprint is registered with a cheap crappy screen protector, it just detects the membrane of the Screen protector not the finger.
- al_be_back 7y ago10/10 for accessibility - worth mentioning that at next performance review.
- Mindwipe 7y agoThis really is an unforgivably bad fuckup. It's clear that Samsung and Google are scrabbling to catch up with Apple, and I don't see why tbh. I don't think the general public dislike traditional fingerprint readers nearly as much as they do finding out the unlock mechanisms aren't secure.
- matiszek23 7y agoGood
- prirun 7y agoFirst thing I did when I got my BLU R2 Plus Android phone was to put electrical tape over the fingerprint reader.