6 ms·

Sure but this sounds like a software bug. There isn’t any way the screen protector makes the returned “ultrasounds” look like the one it’s expecting, it just co

by tbrock 7y ago

Sure but this sounds like a software bug. There isn’t any way the screen protector makes the returned “ultrasounds” look like the one it’s expecting, it just confuses the reader which should result in rejected authentication. Seems sloppy.

azinman2 7y ago
A bug means that authentication can be bypassed easily? And a confused reader authenticates? That’s a total f’n failure, not just “a bug.” You only release such things after super duper thorough testing.
- pennaMan 7y ago
  Last time I checked the OS actively warns you that a strong password is the only way to actually secure your device. Face unlocks and fingerprint sensors are really just gimmicks, that's why android will sometimes prompt for the full password based on some heuristics.
  - bdcravens 7y ago
    They should disable those gimmicks and remove them from all advertising, comparison charts, etc.
  - vokep 7y ago
    given this, it would be nice if a standard emerged of offering biometric+password. The idea being you get both the convenience of biometric, plus the security of a password. Of course a password is inconvenient, but thats only if its a usual password. In this case you could use a simplified password which is quick to enter.
  - Bud 7y ago
    Just because Samsung's sloppy copies of Apple's tech are sucky does not mean that the real technologies are "gimmicks".
    - pennaMan 7y ago
      apple's scotsman is not true either: https://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid https://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid
      - radmarshallb 7y ago
        From your link: The process described above proved to be somewhat unreliable as the depth of the ridges created by the toner was a little too shallow. Therefore an alternative process based on the same principle was utilized and has been demonstrated in an extended video available here. First, the residual fingerprint from the phone is either photographed or scanned with a flatbed scanner at 2400 dpi. Then the image is converted to black & white, inverted and mirrored. This image is then printed onto transparent sheet at 1200 dpi. To create the mold, the mask is then used to expose the fingerprint structure on photo-senistive PCB material. The PCB material is then developed, etched and cleaned. After this process, the mold is ready. A thin coat of graphite spray is applied to ensure an improved capacitive response. This also makes it easier to remove the fake fingerprint. Finally a thin film of white wood glue is smeared into the mold. After the glue cures the new fake fingerprint is ready for use." I'm not sure I would classify a process like that as being similar to putting a screen protector on.
lhopki01 7y ago
My guess is that the screen protector is blocking the ultrasonics so when you 'register' a finger you're actually registering the screen protector. This means that any finger will work as each time it see the same screen protector. The fix will just have to be building a profile of what screen protectors look like to the sensor and rejecting registrations that look like them with a helpful message about screen protectors.
- hinkley 7y ago
  Or model what fingerprints look like, which was their job after all. What you do for people with disfigurements and birth defects, I couldn’t say. But you should be able to flag the data as sketchy. Is this an example of AI gone bad, or something else?
  - lhopki01 7y ago
    I doubt there's any AI involved in this. I think they've never bothered to really consider what a fingerprint actually looks like. This is fairly evidenced by how every single phone fingerprint read seems to readily accept many other body parts and I suspect also things that have similar conductivities to human skin.
    - tracker1 7y ago
      One place I worked at, the fingerprint reader for security was horrible... you had to get your finger in the exact same position. Sometimes it'd work in the morning, but not in the afternoon after lunch. I thought it was funny how my phone could figure it out, but the building system couldn't... of course the building only took two sample scans, while my phone will take 6 or so.
      - ineedasername 7y ago
        Maybe the phones are only "figuring it out" by having very loose acceptance criteria for the correct pattern. For all we know, the 6 scans could be mostly marketing fluff to give the appearance of robust matching.
hatsunearu 7y ago
A hypothetical attack of putting a screen protector on your phone and putting my thumb on it is a super valid attack.
- deleted 7y ago
  [deleted]
- ineedasername 7y ago
  But think of the resources involved to execute this, it's so impractical! You need BOTH a screen protector AND something that registers on the capacitive touch screen!

by tbrock 7y ago

azinman2 7y ago

A bug means that authentication can be bypassed easily? And a confused reader authenticates? That’s a total f’n failure, not just “a bug.” You only release such things after super duper thorough testing.

pennaMan 7y ago
Last time I checked the OS actively warns you that a strong password is the only way to actually secure your device. Face unlocks and fingerprint sensors are really just gimmicks, that's why android will sometimes prompt for the full password based on some heuristics.
- bdcravens 7y ago
  They should disable those gimmicks and remove them from all advertising, comparison charts, etc.
- vokep 7y ago
  given this, it would be nice if a standard emerged of offering biometric+password. The idea being you get both the convenience of biometric, plus the security of a password. Of course a password is inconvenient, but thats only if its a usual password. In this case you could use a simplified password which is quick to enter.
- Bud 7y ago
  Just because Samsung's sloppy copies of Apple's tech are sucky does not mean that the real technologies are "gimmicks".
  - pennaMan 7y ago
    apple's scotsman is not true either: https://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid https://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid
    - radmarshallb 7y ago
      From your link: The process described above proved to be somewhat unreliable as the depth of the ridges created by the toner was a little too shallow. Therefore an alternative process based on the same principle was utilized and has been demonstrated in an extended video available here. First, the residual fingerprint from the phone is either photographed or scanned with a flatbed scanner at 2400 dpi. Then the image is converted to black & white, inverted and mirrored. This image is then printed onto transparent sheet at 1200 dpi. To create the mold, the mask is then used to expose the fingerprint structure on photo-senistive PCB material. The PCB material is then developed, etched and cleaned. After this process, the mold is ready. A thin coat of graphite spray is applied to ensure an improved capacitive response. This also makes it easier to remove the fake fingerprint. Finally a thin film of white wood glue is smeared into the mold. After the glue cures the new fake fingerprint is ready for use." I'm not sure I would classify a process like that as being similar to putting a screen protector on.

lhopki01 7y ago

My guess is that the screen protector is blocking the ultrasonics so when you 'register' a finger you're actually registering the screen protector. This means that any finger will work as each time it see the same screen protector. The fix will just have to be building a profile of what screen protectors look like to the sensor and rejecting registrations that look like them with a helpful message about screen protectors.

hinkley 7y ago
Or model what fingerprints look like, which was their job after all. What you do for people with disfigurements and birth defects, I couldn’t say. But you should be able to flag the data as sketchy. Is this an example of AI gone bad, or something else?
- lhopki01 7y ago
  I doubt there's any AI involved in this. I think they've never bothered to really consider what a fingerprint actually looks like. This is fairly evidenced by how every single phone fingerprint read seems to readily accept many other body parts and I suspect also things that have similar conductivities to human skin.
  - tracker1 7y ago
    One place I worked at, the fingerprint reader for security was horrible... you had to get your finger in the exact same position. Sometimes it'd work in the morning, but not in the afternoon after lunch. I thought it was funny how my phone could figure it out, but the building system couldn't... of course the building only took two sample scans, while my phone will take 6 or so.
    - ineedasername 7y ago
      Maybe the phones are only "figuring it out" by having very loose acceptance criteria for the correct pattern. For all we know, the 6 scans could be mostly marketing fluff to give the appearance of robust matching.

hatsunearu 7y ago

A hypothetical attack of putting a screen protector on your phone and putting my thumb on it is a super valid attack.

deleted 7y ago
[deleted]
ineedasername 7y ago
But think of the resources involved to execute this, it's so impractical! You need BOTH a screen protector AND something that registers on the capacitive touch screen!