Hacker News Reader

Comment by zuminator | Hacker News Reader

Forbes article has slightly more information, including the fact that the Note10 should have the same vulnerability, and it explains that it's not just any screen protector, but a particular type of wraparound screen protector that manages to confuse the sensor. Samsung's reaction (a recommendation to only use authorized accessories) is completely off the mark considering that the real problem is someone could steal your device and then use an unauthorized accessory to access your info.

https://www.forbes.com/sites/gordonkelly/2019/10/15/samsung-...

View on HN

I read that differently -- that the scanning of a working finger leaves an imprint in the gel, and this is what is read from the subsequent scan. This would mean that you couldn't just grab somebody's S10, put a gel screen protector on, and get into the device. You need to have them successfully unlock the device first.

With this in mind, they would not be completely off the mark.

That does not appear to be the case.

There is a video circulating these comments. It shows someone register their finger without the screen, slap the screen protector over top and unlock with a different, previously rejected finger.

Edit: https://twitter.com/sta_light_/status/1184475413252210688?s=...

If the fingerprint somehow gets embedded into the screen protector, is it possible that the screen protector is "tainted" with the fingerprint from previous usage?

I'm not dismissing the claims, but I would like to see if the behavior can be replicated with a brand new screen protector.

Yes, 100% agreed.

Yes, I saw that and it definitely made me rethink my theory. Either it's trapping a fingerprint under the protector or this is not the first run with the screen protector and it's "tainted" with a fingerprint in it now.

I'm unusually eager to know the full story!

S10 5G user here, with an IQ shield protector (wet application/ very soft yet strong gel type). Scanned fingers with the original protector, didn't rescan with the IQ shield which I only put on a few weeks ago.

Can only unlock with my scanned fingers, so will leave my scans as is until a fix eventuates (if it does).

The main issue is that someone can hijack your phone, use the compromising screen protector and get in to your device

Edit: Here is a video demonstration, posted by someone else in this discussion

https://twitter.com/Sta_Light_/status/1184475413252210688

That assumes that it'll recognize any of the original fingerprints after you put on the screen protector. It may just see one big blob though the screen protector.

You'd have to take the phone, put a screen protector on, give it back, have them retrain the detection, then steal it again and finally unlock it.

From the korean video someone posted in this discussion, it seems you can use any fingerprint just by putting on a screen protector - no retraining necessary

I don't think that is accurate. I believe the issue is that adding your fingerprint with the screen protector on essentially makes it so anyone can unlock it. If you add your fingerprint without the screen protector, putting the screen protector on and scanning a fingerprint will not get you in.

That does not seem to be the case here:

https://twitter.com/Sta_Light_/status/1184475413252210688

From what I understand it's not that, it's fingerprint recorded as authorized while the flawed protection is on, that won't work.

If you record a new fingerprint without any protection, or one that doesn't confuse the sensor, you can't then put the flawed protection on top and have it bypass security.

I thought that, but if you look at the video linked, you can clearly see they register their fingerprint pre-screen protector. And then by putting the screen protector on, they can now unlock it with any finger.

I'm quite baffled by it honestly.

Jezz. _that_ is bad. How is that even possible? I mean it makes sense if you trained it with your finger with the faulty protector, but adding a faulty protector makes it work?

Surely the sensor must be able to tell the difference (even if it's currently doing it incorrectly)

Yep I saw the video after my post above also, and it didn't make any sense to me either.

Couldn't tell whether the N10 was completely naked during scan due to the quality of the video.

Would like to see verification, and to learn if the S105G sensor would be affected as well. It operates a bit better than the S10+, so it may not be identical - although that might be position only.

But, they have to adjust the screen protector's position before the wrong finger registers. That video makes it look like the protector was contaminated with a fingerprint before the recording began.

Is it an issue if the fingerprint is registered without a screen protector on?

I could imagine it's possibly like putting foggy privacy tint on a window. You can see through clearly before, but after the tint is applied, everybody looks pretty much the same.

From this video: https://twitter.com/Sta_Light_/status/1184475413252210688

It seems like it.

Reply on news.ycombinator.com