Hacker News Reader

Comment by tbrock | Hacker News Reader

Sure but this sounds like a software bug. There isn’t any way the screen protector makes the returned “ultrasounds” look like the one it’s expecting, it just confuses the reader which should result in rejected authentication. Seems sloppy.

View on HN

My guess is that the screen protector is blocking the ultrasonics so when you 'register' a finger you're actually registering the screen protector. This means that any finger will work as each time it see the same screen protector.

The fix will just have to be building a profile of what screen protectors look like to the sensor and rejecting registrations that look like them with a helpful message about screen protectors.

I just got one of the cheapest phones that Samsung makes, the A50. There is an aftermarket screen protector on the screen.

I was able to register my nose to unlock the phone via the "fingerprint" sensor. Interestingly enough, it will reliably unlock with my nose, but not with either of my daughters' noses.

Three factors of security:

Something you have.

Something you are.

Something you nose.

Does it pass the sniff test?

You, sir, made me laugh!

This is also possible with Touch ID on iOS devices—one of my friends enrolled his nose and five toes. You can put multiple fingers or toes in one “finger” slot if you lift and set down different digits instead of the same one, albeit less accurately.

Using the nose is practical when it is minus 20 C and you really don’t want to remove your mittens.

Do you mean that your daughters' noses can't unlock your phone when your nose is registered or theirs? The former sounds like it's working as designed. Fingers aren't the only body parts with unique patterns, just the most practical one to scan.

I mean that the phone will correctly reject my daughters' noses when my nose is registered.

Enjoyable story. Please add to HBO's Silicon Valley script =)

Or model what fingerprints look like, which was their job after all. What you do for people with disfigurements and birth defects, I couldn’t say. But you should be able to flag the data as sketchy.

Is this an example of AI gone bad, or something else?

I doubt there's any AI involved in this. I think they've never bothered to really consider what a fingerprint actually looks like. This is fairly evidenced by how every single phone fingerprint read seems to readily accept many other body parts and I suspect also things that have similar conductivities to human skin.

One place I worked at, the fingerprint reader for security was horrible... you had to get your finger in the exact same position. Sometimes it'd work in the morning, but not in the afternoon after lunch. I thought it was funny how my phone could figure it out, but the building system couldn't... of course the building only took two sample scans, while my phone will take 6 or so.

Maybe the phones are only "figuring it out" by having very loose acceptance criteria for the correct pattern. For all we know, the 6 scans could be mostly marketing fluff to give the appearance of robust matching.

Why should they make sure you only enroll fingerprints? It's not like that happened by accident.

It's not clear from the article if she had her prints registered then put the protector on or if she put the protector on first. If the former, then it's particularly heinous because people could easily replicate it. If it's the latter then people could just avoid screen protectors (Which shouldn't really be needed regardless).

This was reproduced with the protector added only after registration. Yikes. https://twitter.com/Sta_Light_/status/1184475413252210688

Right, this is the issue. They should be able to detect that a protector doesn't give a fingerprint with enough variance to be real.

A bug means that authentication can be bypassed easily? And a confused reader authenticates?

That’s a total f’n failure, not just “a bug.” You only release such things after super duper thorough testing.

Last time I checked the OS actively warns you that a strong password is the only way to actually secure your device. Face unlocks and fingerprint sensors are really just gimmicks, that's why android will sometimes prompt for the full password based on some heuristics.

Just because Samsung's sloppy copies of Apple's tech are sucky does not mean that the real technologies are "gimmicks".

apple's scotsman is not true either: https://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid

From your link:

The process described above proved to be somewhat unreliable as the depth of the ridges created by the toner was a little too shallow. Therefore an alternative process based on the same principle was utilized and has been demonstrated in an extended video available here. First, the residual fingerprint from the phone is either photographed or scanned with a flatbed scanner at 2400 dpi. Then the image is converted to black & white, inverted and mirrored. This image is then printed onto transparent sheet at 1200 dpi. To create the mold, the mask is then used to expose the fingerprint structure on photo-senistive PCB material. The PCB material is then developed, etched and cleaned. After this process, the mold is ready. A thin coat of graphite spray is applied to ensure an improved capacitive response. This also makes it easier to remove the fake fingerprint. Finally a thin film of white wood glue is smeared into the mold. After the glue cures the new fake fingerprint is ready for use."

I'm not sure I would classify a process like that as being similar to putting a screen protector on.

They should disable those gimmicks and remove them from all advertising, comparison charts, etc.

given this, it would be nice if a standard emerged of offering biometric+password. The idea being you get both the convenience of biometric, plus the security of a password. Of course a password is inconvenient, but thats only if its a usual password. In this case you could use a simplified password which is quick to enter.

A hypothetical attack of putting a screen protector on your phone and putting my thumb on it is a super valid attack.

But think of the resources involved to execute this, it's so impractical! You need BOTH a screen protector AND something that registers on the capacitive touch screen!

Reply on news.ycombinator.com