News for hackers. Stuff that matters.

A comment on Android 4.0 SDK Now Available.

Re:Android 4.0 SDK Now Available by jrockway on Wednesday October 19, 2011 @12:05AM (#3128622)
The "unlock via face recognition" feature looks cool. But I guess someone can just take a picture of your face and show the picture to the phone to unlock it. Oh well, it seemed cool for a few minutes :)
[ Parent | on HN ]
Re:Android 4.0 SDK Now Available by kefs on Wednesday October 19, 2011 @12:18AM (#3128669)
When I saw them unveil Face Unlock, and then have the demo fail on stage, I immediately wondered why they were even bothering with such a gimmicky feature... and your 'photo imposter' scenario is realer than most people believe [1].

[1] PDF: Paper by Nguyen Minh Duc and Bui Quang Minh from Bach Khoa Internetwork Security Center/Hanoi University of Technology

http://www.blackhat.com/presentations/bh-dc-09/Nguyen/BlackH...

[ Parent | on HN ]
Re:Android 4.0 SDK Now Available by potatolicious on Wednesday October 19, 2011 @04:48AM (#3129284)
Security vulnerabilities aside, I just don't see people gravitating towards this.

Pick up phone, hold it out at arm's length in front of you. Hold it real still. Now wait. Bloop bleep boop now it's unlocked!

Compare with:

Pick up phone, swipe your unlock gesture. Hurray!

For something the user is doing constantly, many times, every single... I just don't see why anyone would pick the more uselessly time-consuming (and more effort required) option.

[ Parent | on HN ]
Re:Android 4.0 SDK Now Available by ryandvm on Wednesday October 19, 2011 @09:57AM (#3130136)
Fair enough, but can you imagine the press hoopla had Apple introduced this feature?
[ Parent | on HN ]
Re:Android 4.0 SDK Now Available by rodh257 on Wednesday October 19, 2011 @08:08AM (#3129736)
Check out this video: http://www.engadget.com/2011/10/19/ice-cream-sandwich-face-u...

It seems quicker than swiping an unlock code.

[ Parent | on HN ]
Re:Android 4.0 SDK Now Available by BitMastro on Wednesday October 19, 2011 @08:12AM (#3129751)
I think it could be useful if the camera has a zero shutter lag as it is in the nexus. A scenario coming to my mind is maybe hands-free interaction with voice commands while driving. Anyway, it don't think locking a phone has a security connotation here, but it is a way to avoid any accidental launch of application/typing.
[ Parent | on HN ]
Re:Android 4.0 SDK Now Available by wcoenen on Wednesday October 19, 2011 @06:20AM (#3129490)
Lock the phone and carefully look at the screen from a few different angles. Chances are that you can clearly make out the greasy trail of the unlock pattern. I switched back to a PIN code when I noticed this.
[ Parent | on HN ]
Re:Android 4.0 SDK Now Available by ConstantineXVI on Wednesday October 19, 2011 @08:50AM (#3129878)
It's a step above a pattern/PIN lock; with a minimum drop in convenience. No smudge trails left on the screen, can't be easily guessed, and you have to know who the owner is before you can unlock it. Not as secure as, say, a fingerprint scanner, but it's also easy to implement on existing devices.
[ Parent | on HN ]
Re:Android 4.0 SDK Now Available by yangyang on Wednesday October 19, 2011 @12:54PM (#3130969)
> No smudge trails left on the screen

Surely you're still going to touch it after you've unlocked it? :-)

[ Parent | on HN ]
Re:Android 4.0 SDK Now Available by there on Wednesday October 19, 2011 @01:25PM (#3131111)
i think the parent was talking about the security implications of having your unlock pattern show up on the screen. it's entirely possible to not touch the screen enough after unlocking to wipe out your pattern.

http://whispersys.com/screenlock.html

[ Parent | on HN ]
Re:Android 4.0 SDK Now Available by aw9994 on Wednesday October 19, 2011 @01:15AM (#3128830)
No feature is perfect. This still protects against data theft or prying eyes if you lose your phone, my primary concern.

Those finger-swipe locks that people seem to be so fond of on my University campus are less secure than decent facial recognition software IMO. Hypothetically I could find a phone left behind in the library and see their passcode pretty clearly in their finger smudges on the screen. Do you remember to wipe your screen clean every time?

Facial recognition will not deter someone who is deliberately targeting you, no. Maybe some combination of facial recognition AND numeric-passcode would be more suitable.

[ Parent | on HN ]
Re:Android 4.0 SDK Now Available by rodh257 on Wednesday October 19, 2011 @08:21AM (#3129783)
One way they might improve on this could be that it takes 3 pictures and makes sure that there was some slight movement in the person being ID'ed.

It's still wouldn't be secure, but it'd mean attackers would need a video of you instead of a simple facebook photo.

Main concern would be slowing down the user.

[ Parent | on HN ]
Re:Android 4.0 SDK Now Available by mladenkovacevic on Wednesday October 19, 2011 @11:32AM (#3130590)
Or make it so that the user has to wink at the camera to unlock it ;)
[ Parent | on HN ]
Re:Android 4.0 SDK Now Available by buster on Wednesday October 19, 2011 @01:52AM (#3128923)
I am wondering how this works in low light situations.. Also i guess the "pattern to unlock" works faster, more reliable and is just as unsafe... Although it's easier to guess the finger "smears" on the display then getting hold of a picture of a phones owner..
[ Parent | on HN ]
Re:Android 4.0 SDK Now Available by abp on Wednesday October 19, 2011 @06:27AM (#3129503)
I am wondering how this works in low light situations..

It detects the light conditions via the sensor and auto-flashs you when necessary. Nice while driving at night.

[ Parent | on HN ]
Re:Android 4.0 SDK Now Available by glhaynes on Wednesday October 19, 2011 @12:23PM (#3130819)
I can't tell if you're being sarcastic or not - does it really flash if it needs the light? That seems…awful.
[ Parent | on HN ]
Re:Android 4.0 SDK Now Available by Osiris on Wednesday October 19, 2011 @12:56PM (#3130976)
The demo video showed the screen saying there wasn't enough light and then reverting to the gesture lock.
[ Parent | on HN ]
Re:Android 4.0 SDK Now Available by Garbage on Wednesday October 19, 2011 @12:14AM (#3128652)
It's a limitation/drawback of face recognition technology as a whole. I would not consider it as Google's.
[ Parent | on HN ]
Re:Android 4.0 SDK Now Available by Someone on Wednesday October 19, 2011 @05:31AM (#3129382)
One can still blame Google for choosing to use a flawed technology.

If they chose ROT13 for encrypting user data, would you say "It's a limitation/drawback of ROT13. I would not consider it as Google's fault to use it"?

[ Parent | on HN ]