News for hackers. Stuff that matters.
Re:SurfingAttack: attack on voice assistants using ultrasoni... by Jernik on Thursday February 06, 2020 @10:17AM (#22256560)
This requires the phone to be unlocked to do most of this, doesn't it? What is the attack vector here, someone leaving their phone unlocked on a table and not paying attention to the screen?
Re:SurfingAttack: attack on voice assistants using ultrasoni... by dylan604 on Thursday February 06, 2020 @11:23AM (#22257318)
I know lots of people that have their phones set to not lock automatically. Some of these include not locking them when they throw the phone in their purse, or put it in their back pocket. "I can't be bothered to type in my password every time I pick it up" or "My kids bother me too often to unlock the phone." It's absolutely mind boggling
Re:SurfingAttack: attack on voice assistants using ultrasoni... by iudqnolq on Thursday February 06, 2020 @11:56AM (#22257708)
Password? I've never met someone else irl who sets a password on their phone. Best I've ever seen is a PIN.
Re:SurfingAttack: attack on voice assistants using ultrasoni... by dylan604 on Thursday February 06, 2020 @05:17PM (#22261030)
Nice to meet you. I have a pass phrase comprising 4 short words (totaling 18 characters) that are easy to remember and easy to type in. Someone is going to need the $5 wrench to figure out how to unlock my phone.
Re:SurfingAttack: attack on voice assistants using ultrasoni... by pc86 on Thursday February 06, 2020 @02:07PM (#22259176)
They obviously mean the same thing in this context.
Re:SurfingAttack: attack on voice assistants using ultrasoni... by iudqnolq on Thursday February 06, 2020 @03:57PM (#22260196)
If you open the Android security settings you'll be asked if you want to set a password or pin. A password is longer and can contain arbitrary characters. I've never heard a person refer to a short series of numbers used to protect something as a password and not a pin.
Re:SurfingAttack: attack on voice assistants using ultrasoni... by vgb2k18 on Thursday February 06, 2020 @05:05PM (#22260914)
> I've never heard a person refer to a short series of numbers used to protect something as a password and not a pin.

Until today... Screenshot from Android phone - https://ibb.co/KD27YGL

Re:SurfingAttack: attack on voice assistants using ultrasoni... by h4waii on Thursday February 06, 2020 @09:01PM (#22262545)
Eh, you should clarify that this is not an AOSP lockscreen. It looks like Huawei's EMUI, which is quite heavily modified and might simply be a translation error.
Re:SurfingAttack: attack on voice assistants using ultrasoni... by vgb2k18 on Thursday February 06, 2020 @10:51PM (#22263077)
Meizu phone, Flyme UI. Equally as Chinese as the Huawei you mentioned, so your point stands. Whether or not a tranlation error though, the GP had never heard of anyone using 'password' in the context of a numeric pincode, but it does happen. Who knows, I could be biased through my repeated exposures to the Meizu lock-screen, but as a native English speaker I don't have a hard time imagining a numeric-only pin being referred to as a password.
Re:SurfingAttack: attack on voice assistants using ultrasoni... by dylan604 on Thursday February 06, 2020 @05:14PM (#22261001)
Thank you. It's not like the use of the word 'password' made the point I was making difficult to understand. I had actually tried to use the word passcode, but it was auto-filled/corrected to password and I didn't catch it.
Re:SurfingAttack: attack on voice assistants using ultrasoni... by circa on Thursday February 06, 2020 @11:26AM (#22257344)
I know a lot of people who say that too. Its awful.
Re:SurfingAttack: attack on voice assistants using ultrasoni... by seiters on Thursday February 06, 2020 @10:30AM (#22256701)
Not necessarily. Both Android and iOS allow voice assistants to interact with phones for certain activities even without unlocking the phones. Typical scenario: someone puts a phone on the table and does something else (typing on a computer), not paying attention to the screen.
Re:SurfingAttack: attack on voice assistants using ultrasoni... by arianvanp on Thursday February 06, 2020 @10:29AM (#22256685)
Google phones push you hard in their UI wizards to enable auto-unlock when on "known wifi" networks.
Re:SurfingAttack: attack on voice assistants using ultrasoni... by clSTophEjUdRanu on Thursday February 06, 2020 @11:44AM (#22257549)
I've owned nothing but "Google phones" since the Nexus 4 and don't know what you're talking about. Do you mean smart unlock?

Pushing hard is pretty subjective, I don't see a "hard" push to turn off security features. As a matter of fact I've seen warnings about disabling the lock screen.

Re:SurfingAttack: attack on voice assistants using ultrasoni... by JakeTheAndroid on Thursday February 06, 2020 @02:42PM (#22259545)
My Pixel 3 prompted me to turn off the auto-locking feature when I was at home because it saw that I unlocked my phone a lot in that geofenced location. It also did that at my old job as well since the situation was pretty similar. I would get this prompt about once a month.

So I would agree, it's not a hard push, Google is def nudging people towards less secure logins. My S10+ asked me this same question about a week into owning the phone, but it never bothered me about it again once I declined. And at no point in either system was the I made aware of the risks I was accepting if I enabled it.

So, not a Google specific issue, but it's a less than ideal approach considering how sensitive peoples phones are today.

Re:SurfingAttack: attack on voice assistants using ultrasoni... by nl on Thursday February 06, 2020 @10:16PM (#22262938)
I have had multiple Pixels, and have been prompted multiple times to turn on "smart unlock" when connected to my home WiFi network or to my smartwatch or within a geo area.

It's unclear what "smart unlock" actually is, but as far as I can see it means my phone can be unlocked just with a swipe.

Re:SurfingAttack: attack on voice assistants using ultrasoni... by ElijahLynn on Thursday February 06, 2020 @01:39PM (#22258831)
This isn't just phones.