Samsung Admits Major Security Flaw in Galaxy S10 Under-Screen Fingerprint Sensor

[bollman]

It’s understandable that screen protector will interfere with fingerprint sensor, but it’s supposed to reject authentication if the collected sensing data does not fit, not letting it pass.

I wonder that “gate” it would be called in this forum, if it’s an iPhone

Thing is, not mentioned anywhere, is that you HAVE to re-enroll your prints after putting on a protector. If the protector is sheit, well, then the newly enrolled prints will be too weak to actually work for authentication.
Samsungs error is that they allow those weak prints to be used.
Expect them to change that very soon, and crap protectors will be out of market at the same time.

Compared to Apple this would be if you put on a ski mask and registered for FaceID and then got upset anyone with that ski mask can unlock your phone.

Also not mentioned anywhere, but quite important, is that you cannot put a protector on someones phone and then unlock it. Once a protector is put on, no prints will be readable when you put your finger on the reader, so that is sort of max security

I tried using a protector on my S10 but it made the phone useless, I had a really hard time getting it to read any print at all. I'm quite surprised at this overall, since I had to remove my protector since it would only read my fingerprint every 10-20th time and was too much of a hassle. The phone is cheap anyways, why bother?

 

[Rockadile]

I don't but when it's 90 degrees And your head and hands are sweaty and you have to take that off in order to look up a gas station or modify a GPX track or change a music playlist or log your fuel at the pump, it's pretty annoying especially because FaceID w/ a helmet takes 5+ seconds to show a passcode prompt if you're wearing a helmet you swipe up. wait 5 seconds then finally can enter a passcode. It really adds up. We're talking about 1000 mile days in the saddle or 15 hours of off-roading following a GPX file on the trails and that little extra time where I used to be able to TouchID really adds up. Siri won't work while riding even though my helmet has bluetooth. There are little micro interactions I have to do when during a day of riding (not while riding) that used to be so much easier with TouchID. What I'd like is for FaceID to support helmets maybe my helmet + shape of eyes, cheekbones, nose and eyebrows as an alternative face. That'd be awesome!



I have bought every iPhone every year since the first one. As an Apple fanboy I trust Apple through and through and use everything they make and I've waited for FaceID to finally support full face helmets (utilizing my cheeks, eyes, eyebrows and nose that can be seen when the visor is up) and still no luck. The 4-digit passcode is just so much less secure. My passcode was for years 15 characters because I only needed it after restarting the iPhone but that adds more time so now I'm back to a crappy passcode and hope I never get a brute force hack.

Here's my setup on my touring bike:

and my dirt bike:

The phone is always locked in so I can use gloves to interact with it and enter a passcode but I miss the touch interaction of the button. The big advancement in tech is Qi charging. Both bikes have Qi chargers built into the mounts which is super awesome since the iPhone is interacting with my helmet, GPS tracker on the bike, front & rear dash cams and GoPro (now supplemented by a GoPro remote)

When Off roading, I keep the iPhone unlocked with a GPX file viewer running for our trail riding but if the iPhone auto-sleeps due to a power interruption, I have to stop our entire group to unlock the iPhone again which takes a while to use Face or passcode.




You'll have to google it. there are a few options out there where you get a unique 'skin' thing that's 1 out of 1000 unique-ness then train the phone on it and affix that to your glove.



What kind of helmet do you have? The snowmobile helmet like dirt bike helmets tend to have a pretty wide face opening to allow for goggles. I have a pretty narrow touring helmet that hasn't worked despite trying a few methods.


...and guys you can call this an edge case but Apple had no problem promoting that doctors mask work now with FaceID. There are way more full face motorcycle riders who need to interact with their iPhone than a doctor in surgery. I'm truthfully pretty surprised this doesn't come up more often as a reason. Lots of sports that track data and play music into helmets have full face helmets. I'm always surprised when people can't believe this is a problem.

What does your helmet look like?
I'm not a motorcyclist but it would be good visual reference to know what doesn't work with Face ID.

Besides those half helmets, wouldn't these work?

 

[44267547]

This is a class action suit waiting to happen. How did such a big security flaw not be caught before the device was released to the public?

I asked that same question earlier. And I was thinking about this throughout the day, and it makes me wonder, Samsung and Apple have some of the _highest_ paid hardware engineers in the world working on these smart phones. And I understand flaws can happen that can usually be patched or remedied, but this is something now that hackers/criminals have a general awareness on how to manipulate someone’s phone, this is a potential problem moving forward. So, it makes me wonder, how could they have not found this security flaw through their R&D testing? I honestly think this is going to come back on their engineer team, aside from hurting the Samsung branding. At the end of the day, this is a really bad look for Samsung.

 

[SoGood]

Something screwy with the firmware logic, getting the conditions wrong. Not smart and what happened to all the testing? Beta ware release.

 

[Baymowe335]

Thing is, not mentioned anywhere, is that you HAVE to re-enroll your prints after putting on a protector. If the protector is sheit, well, then the newly enrolled prints will be too weak to actually work for authentication.
Samsungs error is that they allow those weak prints to be used.
Expect them to change that very soon, and crap protectors will be out of market at the same time.

Compared to Apple this would be if you put on a ski mask and registered for FaceID and then got upset anyone with that ski mask can unlock your phone.

Also not mentioned anywhere, but quite important, is that you cannot put a protector on someones phone and then unlock it. Once a protector is put on, no prints will be readable when you put your finger on the reader, so that is sort of max security

I tried using a protector on my S10 but it made the phone useless, I had a really hard time getting it to read any print at all. I'm quite surprised at this overall, since I had to remove my protector since it would only read my fingerprint every 10-20th time and was too much of a hassle. The phone is cheap anyways, why bother?

I’m shocked you have an S10.

 

[Jim Lahey]

At least they are trying to innovate.

Sorry, but 'trying' doesn't cut the mustard in this business. Trying should take place in the labs, not in my wallet.

"Best! Losers always whine about their best. Winners go home and f*** the prom queen." - John Mason 1996

 

[davester]

I think Samsung realises there's not much left to innovate on a phone and are rushing things to the market too soon without proper testing, just to get ahead of the curve.
[automerge]1571374800[/automerge]

"Best! Losers always whine about their best. Winners go home and f*** the prom queen."[/I] - John Mason 1996

That was in a song, wasn't it?

 

[Abazigal]

I asked that same question earlier. And I was thinking about this throughout the day, and it makes me wonder, Samsung and Apple have some of the _highest_ paid hardware engineers in the world working on these smart phones. And I understand flaws can happen that can usually be patched or remedied, but this is something now that hackers/criminals have a general awareness on how to manipulate someone’s phone, this is a potential problem moving forward. So, it makes me wonder, how could they have not found this security flaw through their R&D testing? I honestly think this is going to come back on their engineer team, aside from hurting the Samsung branding. At the end of the day, this is a really bad look for Samsung.

My impression of Samsung is that they are increasingly relying on their hardware chops to compensate for a non-existent software and services portfolio.

I suspect that is what is happening here. The hardware is there, but something is amiss at the software layer. Seems like instead of rejecting a false entry, the sensor is letting it pass through instead, but this problem only arises with a particular type of screen protector?

Maybe it’s picking up some remnants of her fingerprint impression from the screen and treating every login attempt as with said fingerprint? That’s all that comes to mind at the moment.

 

[Jim Lahey]

That was in a song, wasn't it?

Quite possibly. I first heard it in the movie, The Rock (1996) - John Mason, played by Sean Connery 🤩

 

[Analog Kid]

So in this second video, the person registers a thumb, and then uses an index finger to attempt to unlock the phone which doesn't work, but when they use the case and their finger it works.

Soooo what was the point of registering their thumb when it is never used to unlock the phone? How about showing a video of them registering the actual finger they use when they used the case?

My point is that we never see the finger used to unlock the phone registered without the case covering it. Whether or not Samsung has a problem, this video looks sketch.

I don't read Korean, so I only have the UI clues to work from, but what I see is no prints enrolled, the user presses "+" and enrolls their thumb. There is one print enrolled (indicated by a "1") on the only new line in the top block of UI elements. They rename that print. Lock the phone. Unlock the phone with their thumb. Lock the phone. Unlock it with their index finger, which isn't enrolled, through the screen protector.

As I said, one instance somewhere on the Internet isn't a catastrophe, but this is a counter example to the "it only happens if you enroll through the protector" argument and is a more significant security breach. There's more to learn for sure.

 

[indiekiduk]

So if you cover the sensor with a screen protector, your fingerprint suddenly becomes a Master Key?

No, the gel screen protector needs to be on first which is what causes the user to register a weak blurry print.

 

[Gilligan's last elephant]

I think the concern is that an uneducated thief may not notice the line in the manual that they should only use Samsung authorized screen protectors, and they might accidentally open the phone.

Fascinating. And how would this uneducated thief "accidentally" open my phone with a screen protector?
Please explain.

 

[Lalatoon]

I‘d never want a finger print sensor on the back of a device and its NEVER been the case with Face ID that you had to wait till it unlocked before you could swipe up to go to the home screen. From the release of the iPhone X you have been able to swipe immediately BEFORE it scans your face and it animates the unlocking and it will go to the home screen automatically when it’s finished the scan, you do not have to and never have needed to wait till it’s done. If you’ve had a Face ID iPhone and have been doing it this way for a long time, well. 😂

I dont have an iPhone and never own an iPhone. I don't like iOS and stayed with Android. Wait.. so you can swipe the lock screen before it scans your face? Well from what I gathered in this forum you still have to swipe the screen with FaceID unlike the touch sensor at the back of my phone I only touch it and I am at the home screen already and I can do this without aligning my phone to my face. My phone as its version of FaceID but never used it all. I know people hate to admit that FaceID is not as efficient and effective as touch sensor at the back of the phone. There are few situations in which FaceID is much better like if you are wearing gloves but I'm not sure if it is really that effective if you still need to swipe the screen. When wearing gloves I can always press volume button to answer call and of course I will not be texting if I'm wearing gloves. In this context FaceID is not as effective as touch sensor.

 

[Substance90]

I would buy this theory if her husbands fingerprint didn't work.

But if the theory is correct any finger of any person would work, as long as the original finger ridges are superimposed onto the gel.

 

[ascender]

Can you imagine the outcry if this was an iPhone we were talking about? It would literally be the End of Days and Apple would be getting slaughtered on every tech & news site.

Its always really interesting to see how the press deals with these things when its Apple v anybody else.

 

[kis]

Please take that fake news elsewhere. This is a respectable forum.

How's that fake news? My neighbour's an ER doctor - they get burn victims from smouldering cell phones, e-cigarettes, laptops etc. several times a month. Mostly because 3rd party chargers are used, but not always. And iPhone batteries are the culprits just as those from Samsung devices.

And the MacBook Pros? Just google it yourself. But I suppose the political right in the US finds it more convenient to just label everything as "fake news" so they don't have to think.
[automerge]1571393159[/automerge]

Can you imagine the outcry if this was an iPhone we were talking about? It would literally be the End of Days and Apple would be getting slaughtered on every tech & news site.

Its always really interesting to see how the press deals with these things when its Apple v anybody else.

FaceID is fairly easily tricked as well, been in the news ever since the first iPhone came with it. Public outcry? The fact is that 99.9% of the world's population doesn't give a crap about privacy and security. There's no outcry with Samsung and there isn't one with Apple either. Apart from that: not a lot of people actually use gel-based / liquid application screen protectors anyway. The whole thing is blown out of proportion again.
[automerge]1571393298[/automerge]

I’d like a serious source for this - every single case reported was with someone in possession of the phone’s passcode.

True - I'd also like a serious source for the Samsung thing. So far, this has been reported by Forbes, who has been churning out click-bait articles at a felt 10 per second.

 

[kis]

You're oversimplifying how FaceID works. It gets stronger over time. If you just initialized it and then try to fake it with a mask/glasses/etc, it may be forgiving and let you in. But the more you use it, the stronger its assessment becomes so faking it would no longer work (as well).

Two faces that look similar = success. This is by design.

Here we have Samsung where ANY fingerprint is unlocking the screen, and this is a software flaw? Totally different thing!

Here we don't really have anything - there's absolutely not one shred of proof that the Samsung issue is anything more than click-bait.
[automerge]1571393447[/automerge]

According to the original source article and video they fitted a 360 degree gel case which causes a gap over the in-screen fingerprint sensor and the phone to accept a null fingerprint scan hence why it works with unscanned fingers. Software patch will prevent null fingerprint scans.

https://www.thesun.co.uk/tech/10127908/samsung-galaxy-s10-screen-protector-ebay/

Nice case lol

 

[thasan]

FaceID is fairly easily tricked as well, been in the news ever since the first iPhone came with it. Public outcry? The fact is that 99.9% of the world's population doesn't give a crap about privacy and security. There's no outcry with Samsung and there isn't one with Apple either. Apart from that: not a lot of people actually use gel-based / liquid application screen protectors anyway. The whole thing is blown out of proportion again.
[automerge]1571393298[/automerge]


True - I'd also like a serious source for the Samsung thing. So far, this has been reported by Forbes, who has been churning out click-bait articles at a felt 10 per second.

QUESTION to you:
Even her husband could unlock the phone. And it seem to be a widespread problem.
Do you *honestly* think her husband would have been able to unlock her phone with faceid without using elaborate *techniques*?

 

[ijordano]

Interference with the under-screen scanning resulting in the phone not unlocking: acceptable and expcted

Interference with the under-screen scanning resulting in any finger at all unlocking the phone: literally wtf

 

[GadgetBen]

How are those butterfly keyboards working out for you?

Just fine, no problems for me.

 

[I7guy]

I dont have an iPhone and never own an iPhone. I don't like iOS and stayed with Android. Wait.. so you can swipe the lock screen before it scans your face? Well from what I gathered in this forum you still have to swipe the screen with FaceID unlike the touch sensor at the back of my phone I only touch it and I am at the home screen already and I can do this without aligning my phone to my face. My phone as its version of FaceID but never used it all. I know people hate to admit that FaceID is not as efficient and effective as touch sensor at the back of the phone. There are few situations in which FaceID is much better like if you are wearing gloves but I'm not sure if it is really that effective if you still need to swipe the screen. When wearing gloves I can always press volume button to answer call and of course I will not be texting if I'm wearing gloves. In this context FaceID is not as effective as touch sensor.

One can pick their one off case where one biometric is superior to another and go at it until the cows come home.

 

[Abazigal]

Well from what I gathered in this forum you still have to swipe the screen with FaceID unlike the touch sensor at the back of my phone I only touch it and I am at the home screen already and I can do this without aligning my phone to my face.

I believe that was intentional, to prevent users from simply blowing right past their notifications, which was precisely the problem with Touch ID.

So the idea is that you raise the iPhone to your face, Face ID activates, revealing your notifications to you. You can then respond to them directly from the lock screen, or swipe up to go to your home screen. I won't say it's perfect, but I do see the logic behind Apple's implementation.

I know people hate to admit that FaceID is not as efficient and effective as touch sensor at the back of the phone. There are few situations in which FaceID is much better like if you are wearing gloves but I'm not sure if it is really that effective if you still need to swipe the screen.

As the current user of an iPhone 8+ (still) and an iPad Pro, I will say that each has their pros and cons.

I like that Face ID lets me autofill my login details into a webpage without me having to lift a finger, unlike touch ID. I also like being able to unlock my iPad by hitting spacebar on my Smart Keyboard twice. What I didn't like is that it doesn't seem to work very well in landscape mode until iOS 13 (which I how I often use my iPad Pro), and it doesn't work past a certain distance (standing beside a desk with my iPad at waist level, this was pretty often).

Nevertheless, I think people misinterpret FaceID. The idea isn't to spend time analysing how it works or whether it's slower than TouchID (wherever the fingerprint sensor may be). The idea is that it blurs the perception of needing authentication at all to unlock your phone.

I think what Apple was going for was using FaceID to take care of all the security stuff behind the scenes so you don't have too. It removes having to think about authenticating to access something because faceID has already detected that it is you. With a back-mounted fingerprint sensor, you still need to consciously think of where to place your finger, even if you claim it's all muscle memory now after all this time.

So what you're left with is a phone that is as easy to access as one without a passcode. No longer do you have to go through security checks because it is all done automatically. It seems pretty seamless when it works, and Apple has shown that they are committed to make it work even better.

 

[I7guy]

How's that fake news? My neighbour's an ER doctor - they get burn victims from smouldering cell phones, e-cigarettes, laptops etc. several times a month. Mostly because 3rd party chargers are used, but not always. And iPhone batteries are the culprits just as those from Samsung devices.

And the MacBook Pros? Just google it yourself. But I suppose the political right in the US finds it more convenient to just label everything as "fake news" so they don't have to think.
[automerge]1571393159[/automerge]


FaceID is fairly easily tricked as well, been in the news ever since the first iPhone came with it. Public outcry? The fact is that 99.9% of the world's population doesn't give a crap about privacy and security. There's no outcry with Samsung and there isn't one with Apple either. Apart from that: not a lot of people actually use gel-based / liquid application screen protectors anyway. The whole thing is blown out of proportion again.
[automerge]1571393298[/automerge]


True - I'd also like a serious source for the Samsung thing. So far, this has been reported by Forbes, who has been churning out click-bait articles at a felt 10 per second.

Face ID is easily tricked? Citation that any random people can easily trick Face ID.

 

[adamjackson]

What does your helmet look like?
I'm not a motorcyclist but it would be good visual reference to know what doesn't work with Face ID.

Besides those half helmets, wouldn't these work?

Good questions. Mine is a flip-up yet FaceId still doesn't work. Not very convenient but I did move from a full face to a "modular" flip-up hoping it'd work for me and still no. I guess FaceID needs to see the outline of my face more and ears?

The ones w/o a chin though are just too dangerous for me to consider. too many road meets jaw / chin scenarios where you lose half your face.

 

[kaycrystal626]

So much for fingerprint security.