Hacker News Reader

Comment by tombrossman | Hacker News Reader

Note this is for password-protected phones only, PIN and pattern protected phones not affected.

The original vulnerability is here, for those preferring to skip CNN and go straight to it: http://sites.utexas.edu/iso/2015/09/15/android-5-lockscreen-...

View on HN

How ironic that this bug affects the only really secure locking method. Neither the pattern nor the pin are really safe to protect a device as both are easily snoopable.

> only really secure

Security is not an absolute, and there is no such thing as "really/totally/completely secure". The different locking methods allow you to strike a balance between security and convenience that's appropriate for you. All of these are useless against a determined attacker, for a given level of 'determined'.

I don't think he was saying it was "absolutely" secure or totally or completely. Just that it was the "more secure" method, which is not an absolute. There may not be an absolute in security but there are definitely differences in types of security.

Even more ironic seeing how Java was supposed to not allow for buffer overflows

Is it a buffer overflow? - I suspect the OS is killing the LockScreen task due to memory exhaustion from the length of time it takes to trigger the bug.

You meant JVM.

Imo the pattern lock is really secure if you make it hidden at lockscreen.

Recently there was a report around the pattern lock being the least secure and having the least amount of variation between passwords.

Edit: Unfortunately I can't find the specific study I was looking for, so I'll have to add my own [citation needed]

You're probably think of this Ars piece: http://arstechnica.com/security/2015/08/new-data-uncovers-th...

Oh, no doubt. Realistically I don't expect my phone to be secure from the lockscreen, it's more to keep pests out. Anything secure is from full disk encryption, passworded SU, etc. As far as person-looking-over-you protection, they're not bad.

Well, internally the pattern password is literally stored as numbers, just like the pin. So If you go top right to middle right then to middle, then to bottom middle, your pattern will be saved as 3658. It's less secure than a pin, because obviously with a pattern lock a 3 can only be followed by a 2,5 or 6, and no number can repeat, so it's easier to crack than a pin.

My pattern left a trail on my screen pretty much telling you my password. You'd have to guess on the direction a couple times, but you'd get it fairly quickly. I think the pattern lock is really just a way to keep kids off your phone. Greasy fingers on glass are way too telling.

Pattern lock is insecure in the most analog way possible: it's real easy to read fingerprint smear on the screen, and unless you assiduously wipe your phone screen with a lint-free cloth and a bit of isopropyl alcohol after every unlock, chances are you're at least sonewhat vulnerable.

Reply on news.ycombinator.com