If I was a thief stealing Samsung phones, I would use a screen protector. The problem is not that this woman could unlock her phone with a finger that wasn’t registered, and her husband could, but now every thief knows how to do it.
Just to be clear - the screen protector wouldn't help a thief get into the phone. The various reposts of the original article don't make this clear, but the original UK article specifically mentions that she registered her fingerprint after applying the 3rd party screen protector.
Scenario 1 - Person buys phone - there is a Samsung supplied screen protector already on it and a warning in the box that 3rd party screen protectors will interfere with the fingerprint sensor so don't use them. Whether they leave the original screen protector on or not, they register their fingerprint. The fingerprint works just fine.
The thief then steals the phone. It doesn't recognize their fingerprint. They apply a cheap screen protector - it still doesn't recognize their fingerprint. They give up and treat it like any locked phone. They would have to get the original person to unlock the phone - then apply the cheap screen protector - and then re-register a fingerprint - and then the
newly registered fingerprint would be unreliable. That isn't likely to happen and it would involve the victim unlocking the phone anyway so why bother with the extra screen protector?
Scenario 2 - someone buys the phone. They ignore the warning and add a 3rd party screen protector on top of or instead of the supplied one. If they registered their fingerprint before they applied the 3rd party screen protector then it would no longer work. Sad face. If they then decide to register a new fingerprint with the new screen protector - then
that fingerprint would be insecure.
It looks like the software update will likely just reject any fingerprint registrations that lack enough detail. This is in addition to the warning that was in the box not to use 3rd party screen protectors. But if someone doesn't heed that warning, then the software will now prevent them from believing in their fingerprint security in that case.
[automerge]1571348515[/automerge]
From a programming perspective, when there's a bad fingerprint read, they're only rejecting fingerprints that are definitely NOT the user, but letting through anything else.
Basically, their tech isn't good enough to work consistently, so when they're not sure, they're just letting people through because otherwise it would be too annoying.
That's like a lock that only stops you if you have the wrong key, but if you stick a popsicle stick in there, it works just fine.
Not quite, it's like a lock that asks you which key you want to use and if you continually stick a popsicle in the hole they'll eventually allow that to be used as a key. But, if you stuck a regular key in then it would be as secure as any keyed lock.
The problem was that some people weren't aware that they were essentially asking the phone to believe that a popsicle was an adequate key because they ignored the warnings that were in the box telling them not to use a 3rd party screen protector. They thought they were putting a real key in the lock, but the screen protector was telling the phone "don't know, they just poked me with something stick-like" - and eventually the phone went with it. After a software patch it will require something that looks more like a key before it accepts the registration.