Hacker News Reader

Comment by kbenson | Hacker News Reader

Why would they have to force that? It's not too hard to manufacture something that will bypass the fingerprint unlock using rubber cement or silicon gel, especially for an organization that is one of the few expected to have your fingerprints on file (at least in the scenario we are describing, where you're already in custody).

View on HN

Also: finger unlock only works after a password has been entered once (to generate the "finger unlock" key). Copying fingerprints or compelling finger access is moot if the device dumps the finger unlock key (as is done after 48 hours of no finger auth or after 5 (?) failed finger auth attempts).

But, trying to revoke the finger auth key in an emergency (less than 5 seconds) is difficult. Your only option is to try and quickly power off the device, but you're at the mercy of the "press and hold sleep/wake button for 5 seconds, then slide to turn off" delay timer.

Or quickly chew off your fingers.

If you hold the power and face buttons for about 10 seconds the phone will turn off. Takes two hands though.

Android dumps all "smart unlock" options when you press and hold (1 second) on the 'slide to unlock' on screen button and forces passcode/password/pin from that point on. I practice doing this so it's not foreign to me if I ever find myself in a dodgy scenario.

Really? How exactly do you do that? I've got the Xperia Z5, where the wake/sleep button is also a fingerprint scanner, so I can't exactly hold that without unlocking the phone, and holding the little padlock icon on the screen doesn't do anything.

The on screen slide to unlock button. Works perfectly on my Z3c and I'm hoping to not lose such a nice feature if I upgrade to a Z5c but it sounds like I might :(

https://vid.me/Ns12

Alright, I just tried that, and I do get the "Device will remain locked until you manually unlock it" but the fingerprint scanner still works fine. The only time I've seen it forcing me to use the pin was when it couldn't scan my finger 3 times in the row(which doesn't really happen, the sensor in that thing is really accurate(or really forgiving)).

That's a shame :( It'll be interesting to see if Marshmallow with its official fingerprint API changes the behaviour as handset manufacturers are implementing fingerprint support themselves in Lollipop (and so its going to be a bit all over the place).

That or hold the power and home buttons for 10 seconds. Can be done in your pocket.

I continue to find it improbable that even a recorded fingerprint that's not a high resolution scan would suffice for touchid spoofing.

Of course if ever you have an opportunity in an arrest you should shut down the iPhone... Unlock would require passcode.

They digitally scanned my finger print for my EU passport. I wouldn't doubt they could print it and use it to unlock a device. At the speed and multitude of angles fingerprint sensors seem to work, I'm sure it forgives a lot of error/blurriness for the sake of user friendliness.

I've seen videos where somebody tested a gun safe with a similar locking device and it proved to be pretty resilient to that type of attack. I think they finally got it open using a cast mould of his print but it required having physical access to the finger in question.

I wasn't trying to imply it was theoretically possibly, I was trying to state it can be, and has been, done[1].

1: https://securityledger.com/2013/09/iphone-touchid-falls-to-w...

500 DPI amounts to less than 200x200 pixels in a circle if I got the numbers right. A camera can't get that resolution from your fingerprints?

Reply on news.ycombinator.com