4 ms·

Can someone explain to me how something like this is technically possible? And by "explain" I don't mean "ELI5", be all the technical you want. How can you desi

by ahbyb 7y ago

Can someone explain to me how something like this is technically possible? And by "explain" I don't mean "ELI5", be all the technical you want. How can you design a fingerprint reader that lets anybody in like this?

fl0wenol 7y ago
https://www.engadget.com/2019/10/17/samsung-patch-fingerprint-reader/?guccounter=1#comments https://www.engadget.com/2019/10/17/samsung-patch-fingerprin... What is suspected here is that registering the finger with the screen protector on is masking the shape of the finger while still registering the touch action. As a result, it's enrolling a blank print. Then anyone else can unlock it afterwards with the screen protector still on. Consider that screen protectors are designed and tested only to make sure touch actions work correctly, but this ultrasonic fingerprint ridge-shape detection technology is new, so they're probably not mutually compatible. I don't know what was wrong with the swipe sensor. They're discreet, easy to keep clean, and hard to screw up. Maybe the only downside is they would keep them too close to the camera lens for accidentally lens smudging.
- ahbyb 7y ago
  Ah, what I understood from tfa is that you could take any mobile phone with a properly registered fingerprint (ie without having used a screen protector) and then unlock it by placing a screen protector between the fingerprint reader and any fingerprint.
- Daniel_sk 7y ago
  The fingerprint is registered without the screen protector on - proof: https://twitter.com/Sta_Light_/status/1184475413252210688 https://twitter.com/Sta_Light_/status/1184475413252210688
theclaw 7y ago
Given the behaviour demonstrated (register fingerprint, everything works as expected, add screen protector, any fingerprint unlocks), I'd imagine that they're not dealing with every possible result the fingerprint reader can produce. For example, they might be assuming the result could be either a pass or a fail, but in fact there are three states: valid fingerprint and matched, valid fingerprint and not matched, and not a valid fingerprint. Perhaps the fingerprint reader returns a result of 0 for "valid print and not matched", result 1 for "valid print and matched", and result -1 for "not valid print". If the phone vendor code simply tests for a non-zero result code and treats this as "matched", then the situation described would occur. It would be interesting to test with other smooth objects that might activate the reader.

by ahbyb 7y ago

fl0wenol 7y ago

https://www.engadget.com/2019/10/17/samsung-patch-fingerprint-reader/?guccounter=1#comments https://www.engadget.com/2019/10/17/samsung-patch-fingerprin... What is suspected here is that registering the finger with the screen protector on is masking the shape of the finger while still registering the touch action. As a result, it's enrolling a blank print. Then anyone else can unlock it afterwards with the screen protector still on. Consider that screen protectors are designed and tested only to make sure touch actions work correctly, but this ultrasonic fingerprint ridge-shape detection technology is new, so they're probably not mutually compatible. I don't know what was wrong with the swipe sensor. They're discreet, easy to keep clean, and hard to screw up. Maybe the only downside is they would keep them too close to the camera lens for accidentally lens smudging.

ahbyb 7y ago
Ah, what I understood from tfa is that you could take any mobile phone with a properly registered fingerprint (ie without having used a screen protector) and then unlock it by placing a screen protector between the fingerprint reader and any fingerprint.
Daniel_sk 7y ago
The fingerprint is registered without the screen protector on - proof: https://twitter.com/Sta_Light_/status/1184475413252210688 https://twitter.com/Sta_Light_/status/1184475413252210688

theclaw 7y ago

Given the behaviour demonstrated (register fingerprint, everything works as expected, add screen protector, any fingerprint unlocks), I'd imagine that they're not dealing with every possible result the fingerprint reader can produce. For example, they might be assuming the result could be either a pass or a fail, but in fact there are three states: valid fingerprint and matched, valid fingerprint and not matched, and not a valid fingerprint. Perhaps the fingerprint reader returns a result of 0 for "valid print and not matched", result 1 for "valid print and matched", and result -1 for "not valid print". If the phone vendor code simply tests for a non-zero result code and treats this as "matched", then the situation described would occur. It would be interesting to test with other smooth objects that might activate the reader.