I just got one of the cheapest phones that Samsung makes, the A50. There is an aftermarket screen protector on the screen.

I was able to register my nose to unlock the phone via the "fingerprint" sensor. Interestingly enough, it will reliably unlock with my nose, but not with either of my daughters' noses.

Three factors of security:

Something you have.

Something you are.

Something you nose.

Does it pass the sniff test?

You, sir, made me laugh!

This is also possible with Touch ID on iOS devices—one of my friends enrolled his nose and five toes. You can put multiple fingers or toes in one “finger” slot if you lift and set down different digits instead of the same one, albeit less accurately.

Using the nose is practical when it is minus 20 C and you really don’t want to remove your mittens.

Do you mean that your daughters' noses can't unlock your phone when your nose is registered or theirs? The former sounds like it's working as designed. Fingers aren't the only body parts with unique patterns, just the most practical one to scan.

I mean that the phone will correctly reject my daughters' noses when my nose is registered.

Enjoyable story. Please add to HBO's Silicon Valley script =)

Or model what fingerprints look like, which was their job after all. What you do for people with disfigurements and birth defects, I couldn’t say. But you should be able to flag the data as sketchy.

Is this an example of AI gone bad, or something else?

I doubt there's any AI involved in this. I think they've never bothered to really consider what a fingerprint actually looks like. This is fairly evidenced by how every single phone fingerprint read seems to readily accept many other body parts and I suspect also things that have similar conductivities to human skin.

One place I worked at, the fingerprint reader for security was horrible... you had to get your finger in the exact same position. Sometimes it'd work in the morning, but not in the afternoon after lunch. I thought it was funny how my phone could figure it out, but the building system couldn't... of course the building only took two sample scans, while my phone will take 6 or so.

Maybe the phones are only "figuring it out" by having very loose acceptance criteria for the correct pattern. For all we know, the 6 scans could be mostly marketing fluff to give the appearance of robust matching.

Why should they make sure you only enroll fingerprints? It's not like that happened by accident.

It's not clear from the article if she had her prints registered then put the protector on or if she put the protector on first. If the former, then it's particularly heinous because people could easily replicate it. If it's the latter then people could just avoid screen protectors (Which shouldn't really be needed regardless).

This was reproduced with the protector added only after registration. Yikes. https://twitter.com/Sta_Light_/status/1184475413252210688

Right, this is the issue. They should be able to detect that a protector doesn't give a fingerprint with enough variance to be real.