• aard@kyu.de
      link
      fedilink
      arrow-up
      32
      arrow-down
      1
      ·
      11 months ago

      Pretty much everybody pushing fingerprints as a sensible thing for accessing a device is fucking up. It is way too easy to obtain a persons fingerprints suitable for device unlocking without them knowing - and that’s ignoring that using fingerprints enables device unlocking with a persons finger against their will.

      • BB69@lemmy.world
        link
        fedilink
        arrow-up
        7
        arrow-down
        17
        ·
        edit-2
        11 months ago

        That’s why devices need something like Apple does that disables biometrics with specific button clicks

        • Darkassassin07@lemmy.ca
          link
          fedilink
          English
          arrow-up
          16
          arrow-down
          3
          ·
          11 months ago

          All android devices have a lockdown function that disables all but password unlock and hides all info from the lockscreen (notifications).

          Anoyingly it’s disabled by default though, you have to explicitly enable it in lockscreen settings, then activate it from the power off menu.

          • BB69@lemmy.world
            link
            fedilink
            arrow-up
            4
            arrow-down
            1
            ·
            11 months ago

            Interesting. Apple you just hold volume up and lock and it disables biometrics. It’s like that by default

          • admiralteal@kbin.social
            link
            fedilink
            arrow-up
            4
            arrow-down
            1
            ·
            edit-2
            11 months ago

            Lockdown doesn’t require password unless your device settings require password – it normally just kicks it back to requiring pin. Which is still quite secure. I don’t know what you mean saying it is disabled by default – it is available by default if you long press the power button and click Lockdown.

            Even better is to reboot the device. Then it will be in lockdown mode – pin required – and also encrypted awaiting the pin. A modern device fresh from a restart should be quite hard indeed to crack without some alternate access to the person’s Google account.

            • Darkassassin07@lemmy.ca
              link
              fedilink
              English
              arrow-up
              5
              arrow-down
              1
              ·
              11 months ago

              In my experience, the ‘show lockdown option’ is off by default. You have to enable it in settings before you can use it.

              Requiring a pin on startup used to be the same, but it’s not even an option anymore, it’s just on.

              I was also refering to pin/pattern lock as your password for android, perhaps not the best wording.

    • Saik0@lemmy.saik0.com
      link
      fedilink
      English
      arrow-up
      6
      arrow-down
      3
      ·
      11 months ago

      It’s device manufacturers that are fucking up, not MS.

      and Microsoft Surface Pro X all fell victim to fingerprint reader attacks

      So… MS is not MS? Is that the logic we’re going for now?

      • CaptObvious@literature.cafe
        link
        fedilink
        arrow-up
        7
        arrow-down
        1
        ·
        11 months ago

        No, as stated in the article, it’s the sensor manufacturers that are not properly implementing the security protocol.

            • Saik0@lemmy.saik0.com
              link
              fedilink
              English
              arrow-up
              2
              arrow-down
              8
              ·
              11 months ago

              They didn’t build the sensor, but they sourced and implemented it in their product. Part of selling products is getting your parts from reputable locations that are building their parts to your specification. This is absolutely still MS’s screwup. And if MS can’t build a device to implement their “security” standard properly. Then you cannot assume that ANY manufacturer can do it properly.

                • Saik0@lemmy.saik0.com
                  link
                  fedilink
                  English
                  arrow-up
                  3
                  arrow-down
                  2
                  ·
                  edit-2
                  11 months ago

                  Yes.

                  t’s not clear if Microsoft will be able to fix these latest flaws alone, though. “Microsoft did a good job designing Secure Device Connection Protocol (SDCP) to provide a secure channel between the host and biometric devices, but unfortunately device manufacturers seem to misunderstand some of the objectives,” writes Jesse D’Aguanno and Timo Teräs, Blackwing Intelligence researchers, in their in-depth report on the flaws. “Additionally, SDCP only covers a very narrow scope of a typical device’s operation, while most devices have a sizable attack surface exposed that is not covered by SDCP at all.”

                  So microsoft made a standard… and it doesn’t cover the full scope of usage of these devices… Including their own surface pro x and thus can be abused. It’s almost like both the sensor choice, and the software is flawed.

                  It’s becoming apparent that you and all the other downvoters are just windows fanbois.

                  Also

                  The researchers found that Microsoft’s SDCP protection wasn’t enabled on two of the three devices they targeted.

                  So they recommend to enable this protocol… simply because it’s better overall… But the third device was still vulnerable!

                  But yeah… I’m the one with reading comprehension problems. Totally.

                  Edit: You also still failed to articulate how this absolves MS from anything. They created the standard. They can’t choose sensors that use it properly? So either MS is ignorant, or willfully breaking their own standard. Care to actually address how MS isn’t at fault still?