News for hackers. Stuff that matters.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by saagarjha on Thursday October 17, 2019 @06:05AM (#21280405)
Biometric authentication on Android phones has always seemed to be hit-or-miss: companies looking to add it to their feature checklist either come up with fundamentally flawed designs (storing a fingerprint as an unencrypted image file, etc.) or you have bugs like these. There really needs to be some sort of realignment that incentivizes companies to get this right rather than slap together something broken and try to sell it as “iPhone may have x feature, but we have y (which is buggy, but you don’t know that)”.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by GeekyBear on Thursday October 17, 2019 @06:33AM (#21280581)
This sentence from the NY Times review of the Galaxy Note 8 has always stuck with me.

>Some of the biometrics, including the ability to unlock your phone by scanning your face or irises, are so poorly executed that they feel like marketing gimmicks as opposed to actual security features.

https://www.nytimes.com/2017/09/05/technology/personaltech/s...

Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by sundvor on Thursday October 17, 2019 @08:16AM (#21281180)
The face unlock from the S8 onwards had a huge disclaimer page you had to accept saying it was a convenience feature only, do not use if security is important.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by celeritascelery on Thursday October 17, 2019 @02:46PM (#21285172)
And security should be important to everyone. So basically don’t use this feature.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by hanniabu on Thursday October 17, 2019 @09:20AM (#21281709)
Seems more like false advertising
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by dawg- on Thursday October 17, 2019 @08:44AM (#21281408)
I set up the face unlock on my S9 and lasted about half a day before i was back to the fingerprint. Its just so much easier and more convenient in every way.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by vbezhenar on Thursday October 17, 2019 @06:16AM (#21280472)
Some sort of certification would be useful. We can compare cameras with megapixels, but fingerprint reader is like boolean: it's either present or not. There are obvious metrics like false positive rate, false negative rate, but I have no idea where to find those metrics for any phone.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by saagarjha on Thursday October 17, 2019 @06:26AM (#21280545)
iPhone publishes them: https://www.apple.com/business/docs/site/iOS_Security_Guide..... It’d be nice if Android manufacturers detailed their implementations and accuracy rates too, but I haven’t found any yet :(
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by caf on Thursday October 17, 2019 @06:30AM (#21280564)
Where exactly in that document is the accuracy rates? It's not easy to find.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by saagarjha on Thursday October 17, 2019 @06:36AM (#21280600)
It’s under System Security, in the Touch ID and Face ID sections:

> The probability that a random person in the population could unlock your iPhone is 1 in 50,000 with Touch ID or 1 in 1,000,000 with Face ID. This probability increases with multiple enrolled fingerprints (up to 1 in 10,000 with five fingerprints) or appearances (up to 1 in 500,000 with two appearances).

Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by tialaramex on Thursday October 17, 2019 @07:23AM (#21280859)
Note that this is _much_ less useful than it appears for the same reason as misleading stats often offered to courts when evidence partially links a suspect to a crime.

The problem is that it says random people, but people aren't random. We don't periodically just stir all the people in the entire world and redistribute them across the globe.

In courts you'd get a situation where a jury is told there's only 1-in-10-million chance this evidence would match a random person. Only a few hundred people in the whole world could have been the one, and yet this suspect matches. And what they may not get told unless a defence lawyer brings it up is oh, by the way, six of those few hundred people were in the place where it happened and four more lived in the same street as the suspect.

Bob's Face ID may only match 1 in a million people. But if one of those "1 in a million" people is Bob's twin brother Dave who is always pranking him, and another is Bob's cousin Barry who doesn't look that similar to a person, but mathematically it turns out Bob and Barry's faces look identical to a computer vision system due to their bone structure, then Bob won't find "Face ID" much use.

Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by throwaway744678 on Thursday October 17, 2019 @07:55AM (#21281049)
Your argument is correct for FaceID, but it does not transfer to TouchID. The fingerprints of twins are not more similar to one another than that of two random people.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by cantrevealname on Thursday October 17, 2019 @08:31AM (#21281293)
> The fingerprints of twins are not more similar to one another than that of two random people.

That’s not accurate. Family members have more similarity in their prints than among random people, twins even more similarity, and identical yet more.

I can’t immediately find authoritative references for family and fraternal twins, but here’s a reference for identical twins:

“Identical twins have the same chromosomes and similar physical characteristics and, therefore, they have a high class/type similarity in their fingerprints.” https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3338710/

Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by seandougall on Thursday October 17, 2019 @01:08PM (#21284113)
"Class/type similarity" means that twins are likely to, say, both have whorls on their right index fingers, but doesn't mean they'll have the same pattern of ridges. So for the sake of biometrics, that doesn't make them more similar than two random people.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by throwaway744678 on Thursday October 17, 2019 @09:01AM (#21281531)
I stand corrected!

Time to switch to a good old PIN if you have an (evil) twin, then!

Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by kchamplewski on Thursday October 17, 2019 @08:00AM (#21281076)
The fact that the math here is wrong is quite concerning. Probabilities are not additive - 1 in 6 dice rolls will produce a 5, it doesn't mean if I roll 6 times I am guaranteed a 5.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by Someone on Thursday October 17, 2019 @08:27AM (#21281265)
For small probabilities, approximating

  (1-p)^n
by

  1 - n × x
is absolutely fine. For example

  (1-0.00002)^5 = 0.999900004
Rounding gives you that “one in 10,000”
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by caf on Thursday October 17, 2019 @08:27AM (#21281267)
Adding the probabilities is a good enough approximation when the probabilities and number of trials are very low, though - as in this case. The true value for at least one failure in 5 trials with an individual 1/50000 probability of failure is 1/10000.4 rather than 1/10000, but it seems clear that the original 1/50000 isn't that precise anyway.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by StavrosK on Thursday October 17, 2019 @06:15AM (#21280466)
You must not have used many Android phones. The fingerprint scanner has been stellar and instant in every phone I've had, at least until people started switching to this horrible under-display one which is a huge downgrade for no reason.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by BigJ1211 on Thursday October 17, 2019 @07:21AM (#21280849)
Stellar/instant is a poor indicator for how secure it is, ik can be stellar/instant and not secure at all. As is the (gel)case here, I don't know if this ia a Samsung only thing or if this sensor is used in different Android devices as well. Or if this is limited to this sensor only in the first place.

You can ask the same question of face/iris scans, people have and it's quite difficult to replicate, but not impossible. There's a plethora of YouTube videos about this.

Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by saagarjha on Thursday October 17, 2019 @06:21AM (#21280499)
I own a Pixel device, which is one of the few Android phones I’ve found that provides details of how it keeps that data secure: https://support.google.com/pixelphone/answer/6300638?hl=en.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by rjzzleep on Thursday October 17, 2019 @06:33AM (#21280586)
I don't own a Pixel I use a Sony device(Great devices with terrible software). Pixels 3+ are by far the most secure android devices out there.

I recently bought a Samsung watch. It's a solid responsive device with ok software, depending on what you may do in the wearables app it may or may not crash(The watch itself seems to have good battery life and pretty stable). I had an apple watch for a while that I gave my mom and unfortunately I have to say the Samsung device feels like a device with a lot of potential but not quite there yet. A lot of it has to do with the ecosystem. Tizen seems great, but the app store is so-so. The entire samsung login, region, payment, app store experience feels half-baked compared to the experience on a mac/apple device. I've been recently trying to figure out if I should buy a samsung device to access the ToF camera, but the documentation is virtually none existent(it's scheduled to come "eventually")

I somewhat wish they would license their tizen version to other vendors since it's way better than the WatchOS alternative.

I haven't been using mac/iphones in a few years rather than to test stuff, so maybe it really got a lot worse since then. But from what I remember the general experience felt a bit more smooth.

https://www.blog.google/products/pixel/titan-m-makes-pixel-3...

Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by zentiggr on Thursday October 17, 2019 @08:41AM (#21281390)
Unless there's been a foundational shakeup, I'd be wary of Tizen. There have been numerous reports of horribly shoddy development practices and massive bugs.

Never used a Samsung myself so I'm just remembering stories.

Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by rjzzleep on Thursday October 17, 2019 @10:30PM (#21288154)
I'm not at all surprised. The whole meego, tizen whatever development process was a complete mess. But then again android was too. I still think it's unfortunate.

But, you can you elaborate?

Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by zentiggr on Friday October 18, 2019 @01:23PM (#21293255)
Not very well. Months ago I came across a couple of references to egregious security problems and outright horrid development practices, of which I've forgotten 95% of the content and only have the left over sense of "nope, don't ever want to rely on that ever".

https://news.ycombinator.com/item?id=14752446

Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by soulofmischief on Thursday October 17, 2019 @07:32AM (#21280901)
My Pixel 3a has a fingerprint scanner which works about as often as the literally free promotional phone my carrier thrusted onto me last year. I'm lucky if it works 1/5 times.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by kalleboo on Thursday October 17, 2019 @08:05AM (#21281105)
TBF I never had any good luck with Apple's TouchID (which most people seem to love) - some of us just have hands that are incompatible with the technology. So while the many for whom it worked flawlessly lamented the loss of it in favor of FaceID, I was cheering.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by reaperducer on Thursday October 17, 2019 @08:46AM (#21281428)
It's seasonal for me.

Spring and summer, TouchID works flawlessly. Once the air gets dry in the fall and my skin starts to get gross, TouchID struggles. But I guess that's to be expected.

Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by kalleboo on Thursday October 17, 2019 @09:04AM (#21281560)
For me it was the opposite - I think it was the humidity in the summer that messed with TouchID
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by soulofmischief on Thursday October 17, 2019 @02:50PM (#21285220)
I find that the slightest modicum of oil on my skin is enough to stump my sensor.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by fetus8 on Thursday October 17, 2019 @05:22PM (#21286466)
Ok, I feel seen. I had trouble with TouchID on the 5S, upgraded to a 6S, and a 7 and continued to have trouble. It never reliably worked for me. I partially blamed it on oily hands, but my fingertips are fairly scarred as well. As soon as FaceID was revealed, I jumped ship to the X series phones and can't imagine going back. It's crazy how much more reliable FaceID is for me than TouchID ever was.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by altec3 on Thursday October 17, 2019 @03:12PM (#21285403)
I'm in the same boat. I never could get TouchID to work reliably or fast enough. To the point where I never even bothered to have it on. FaceID on the other hand has worked great for me, and only doesn't work if I have a motorcycle helmet or goggles on, which is understandable.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by loufe on Thursday October 17, 2019 @10:10AM (#21282223)
My (subjective) experience with my Pixel 3 has been fantastic. I find excellent recognition with all configured fingers.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by flyingfences on Thursday October 17, 2019 @08:34AM (#21281322)
I'm having the same experience with the 3XL that I recently bought. My 6P that I upgraded from was much more reliable.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by mrtksn on Thursday October 17, 2019 @06:21AM (#21280505)
Well, apparently on this one the fingerprint sensor is also fast with the caveat that it unlocks the phone for everyone when a screen protector is applied.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by soulofmischief on Thursday October 17, 2019 @07:33AM (#21280906)
That's not a caveat. That's a security hole. Anyone could put a piece of plastic between them and the scanner, and if that's all it takes, it was never secure in the first place.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by abdulmuhaimin on Thursday October 17, 2019 @06:30AM (#21280565)
thats a huge caveat. I think the samsung is the fastest one among all the underscreen fingerprint sensor. But compared to not-underscreen sensor? I agree with above comment. Aside from looking sleek, the underscreen fingerprint sensor has been really underwhelming compared to regular fingerprint one
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by neilalexander on Thursday October 17, 2019 @07:30AM (#21280893)
As someone with an iPhone as a personal phone and a Galaxy S8 as a work phone, I can attest to the fact that the fingerprint sensor in the S8 is _absolutely terrible_ compared to Apple's Touch ID.

It routinely misses touches altogether, complains that I'm not covering the sensor even when I am doing (and yet this doesn't seem to bother Touch ID in the slighest) and doesn't seem to have much of a delay between attempts making it very easy to "lock out" the fingerprint sensor and being forced to enter the PIN due to several mismatches in a short space of time.

Also whoever decided to put the fingerprint sensor on the back of the phone should be prevented from designing phones ever again.

Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by HeWhoLurksLate on Thursday October 17, 2019 @08:01AM (#21281077)

   > Also whoever decided to put the fingerprint sensor on the back of the phone should be prevented from designing phones ever again.
Why? My phone has a fingerprint reader on the back, and I quite like it- I don't have to move my fingers much to use it, it's also the lock button, which makes it rather easy to "log in" to the phone.

Just tested it- less than one second to log in via finger, and it works almost all the time. (I've had motor oil on my fingers and it's still worked, not that that's a good idea...)

Also people who suggest serious consequences for failure to abide by a personal opinion should, IMO, stop talking.

Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by pmontra on Thursday October 17, 2019 @09:28AM (#21281789)
The sensor on the back is out of reach when the phone is on a mount, for example the handlebar of my bicycle. I considered activating face recognition but I'll probably use the old phone as navigation device: it's got the sensor on the side. I'm using offline maps anyway and only when cycling for leisure. I'll keep my main phone in my pocket (in airplane mode, I don't want to be disturbed.)
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by fma on Thursday October 17, 2019 @01:39PM (#21284445)
Depending on how it's mounted...I can unlock my S8 reaching over the top of the phone where my finger is basically upside down.

I hope it means that Samsung compares the data on the whole sensor, and not that anyone can unlock it :)

Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by pmontra on Thursday October 17, 2019 @05:32PM (#21286550)
Right but in my case the mount completely covers the sensor. Samsung A40 and Topeak mount. The other phone is a Sony Xperia X Compact. Maybe the Samsung is too thin to have the sensor on the side.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by JshWright on Thursday October 17, 2019 @09:20AM (#21281712)
The fingerprint sensor on the back of the phone is something I like so much I will avoid upgrading to a device that has it anywhere else (I fear I may be using my Pixel 3 for a very long time). I think it's a genius spot for it. It's right where my finger naturally falls as I'm bringing my phone out of my pocket, so it's unlocked before my eyes ever got the screen.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by hombre_fatal on Thursday October 17, 2019 @09:58AM (#21282088)
Trying to use a phone with the sensor on the back just showed me how often I'm unlocking my phone while it's laying on a surface or how I always pinch the phone out of my pocket by the chin because that's all the room I have with pants that fit. Also, I can't access it when it's mounted on my bike which is such a serious showstopper I don't know how it made it out of the brainstorming phase.

I found it to be the worst place to put it.

Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by jcranberry on Thursday October 17, 2019 @11:54AM (#21283355)
with how big phones are these days I find it very annoying to have the lock button so far from the unlock button. i vastly prefer the scanner/unlock/lock button on the back.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by vinay427 on Friday October 18, 2019 @11:46PM (#21296649)
Hmm, I definitely disagree based on my experiences. I think the lack of timeout with a limit on attempts is far nicer, it works reliably for me in nearly every case except sometimes in the winter (which affects other fingerprint sensors I've tried as well), and the position on the back is ideal for me in almost every position I use the phone. I can easily pull it out of my pocket and activate it one-handed without feeling like I'm holding my phone precariously.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by unethical_ban on Thursday October 17, 2019 @10:17AM (#21282294)
There are good arguments for the sensor to be on either side of the phone (or ON the side). I have a phone with the sensor on the back, and while it is inconvenient when I am doing a quick check or it is in a mount (rare), it is a more natural place when you are actually picking up the phone.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by Hurtak on Thursday October 17, 2019 @07:42AM (#21280952)
You must have had better luck than me.

- Xiaomi Redmi Note 4 - pretty good finger print scanner on the back

- Samsung Galaxy S8 - absolutely terrible fingerprint scanner that was so bad I switched to pin after a while

- Samsung Galaxy S10 - new fingerprint scanner under display, works most of the time but still unreliable, also it is not the quickest.

You would have thought that leading brand (Samsung) would have decent fingerprint scanners on their flagships, but it is just not the case.

The thing with bad fingerprint scanners is that you cant rely on them, so I rather choose reliable slower 3s unlock with pin than unreliable maybe faster 1-10s unlock with fingerprint.

Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by fortran77 on Thursday October 17, 2019 @10:44AM (#21282575)
On my S8 I never used the rear fingerprint scanner. It was so unweildy and poorly placed that it was quicker and easier to enter my pin.

They also touted "face recognition" but it was a poorly-made piece of software that used a conventional camera (no depth) and was just a marketing check-off item, and not a real feature.

Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by StavrosK on Thursday October 17, 2019 @07:48AM (#21280997)
Yeah, all my phones have been Xiaomis where the scanner is fantastic. The latest one, the 9T, has an in-display scanner, and you're spot on. It's usually okay, but sometimes gives me trouble, and this burstiness is what irritates me to no end.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by HeWhoLurksLate on Thursday October 17, 2019 @07:43AM (#21280959)
My LG V20's fingerprint reader works quite well, and is rather fast. It's also a couple years old, but still zippy.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by rerx on Thursday October 17, 2019 @03:55PM (#21285772)
On my S9 they seem to have hit the sweet spot -- there's little to complain about.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by test1235 on Thursday October 17, 2019 @07:46AM (#21280980)
3 seconds?!
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by Hurtak on Thursday October 17, 2019 @09:08AM (#21281596)
Click the lock button, swipe up, enter the pin. Seems to be about 3s?
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by justusthane on Thursday October 17, 2019 @09:21AM (#21281720)
> until people started switching to this horrible under-display one which is a huge downgrade for no reason.

That's certainly a matter of opinion, and is not a "huge downgrade for no reason". I prefer my fingerprint scanners on the front, and I know others do as well.

Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by Yizahi on Thursday October 17, 2019 @01:56PM (#21284636)
Front one would be better of course, but only if it worked. As it is on S10 scanner is complete garbage, even with all the patches they keep making.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by StavrosK on Thursday October 17, 2019 @09:23AM (#21281744)
I guess it is a matter of opinion. I prefer mine to work.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by PopePompus on Thursday October 17, 2019 @12:21PM (#21283612)
What I would like to see implemented is "Touch to Factory Reset". That would allow you to define an unlikely combination of touch sensor presses - say your right pinky finger followed within 1 second by your left pinky finger, that would silently perform a factory reset on the device. That would be handy if you believe your phone is about to be stolen or confiscated by the police.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by whsheet on Thursday October 17, 2019 @06:30AM (#21280566)
Just not true.
Re:Samsung: Anyone's thumbprint can unlock Galaxy S10 phone by SmellyGeekBoy on Thursday October 17, 2019 @06:59AM (#21280719)
Can you back up any of these big claims with actual sources? This is the first I'm hearing about this.