Found a major flaw in Android Fingerprint Unlocking Method - Security Discussion

Good Day to fellow XDA Users,
This afternoon I found a security vulnerability in 8.0 Oreo. I was trying to setup my Middle finger on to my Moto G4+ when I found an anomaly. If I switched my finger it was still able to read and record it. I thought it was a bug on the ROM (Bootleggers) which I was using. So I tried to replicate the same thing on A One Plus 5T, Moto G5s Plus,Mi A1,One Plus 3 and 3T and a Google Pixel 2 and A Pixel XL. All of these devices were running the latest version of 8.1.0 Oreo,except Moto G5S plus which was running on 7.1.0 Nougat. This confirms that this issue still exists on the Nougat.
Now you might be wondering how and why this could be a security flaw. For example you are setting up your bio-metric on your device and halfway through someone else like your GF,BF or your spouse or colleague put their finger by mistake, the device records it. So that mean's he also has access to the device. Which should not happen. Also FYI no two finger prints are ever the same. Here the definition from google :-
Because each person's fingerprints are unique, and not even identical twins—who share the same DNA—have identical fingerprints, this also shows that fingerprints are not completely controlled by genetic
How can you resolve the issue.
1. Go to the fingerprint setup screen
2. Start registering your fingers.
3. When you are halfway there, switch your finger
4. Lock your screen and try.
I hope this issue comes to Google's Notice and they do something about it. It is a major security vulnerability in Android.

This is basically the same thing as saying
Fingerprint sensors are a security flaw because during setup before I add my own fingerprint someone else could take my phone and record theirs.
Click to expand...
Click to collapse

deletescape said:
This is basically the same thing as saying
Click to expand...
Click to collapse
I agree, but this is happening during when your in the process of setting up a fingerprint. Like I try to record my index finger of left hand and switch to the right hand in the middle of the process. It means you are two fingerprints are treated as one.

Mr Beardsly said:
I agree, but this is happening during when your in the process of setting up a fingerprint. Like I try to record my index finger of left hand and switch to the right hand in the middle of the process. It means you are two fingerprints are treated as one.
Click to expand...
Click to collapse
It may be hard to tell the point at which one fingerprint ends and the other one begins. Although you would think that the opposite is true. I tested it on 6.0.
Sent from my Z981 using Tapatalk

I think this isn't a bug per se, it is just that the phone allows you to enter different fingerprints when loading your fingerprint.
Even so I think you should try to send the bug to Google and see if you get any kind of reward

This doesn't sound like a major bug, or a bug at all.
It is just scanning all parts of your one finger. If you scan a different finger during the processes it will simply be part of your first finger.
Still, a really cool find!!!

Related

Fingerprint doesn't work so good

Hi, I have just bought my new S7 and setup my fingerprint on it.
I didn't have fingerprint on my old phone so I can't compare it but I find it really inaccurate..
It gives me alot of wrongs if I am not landing my finger perfectly centered and sometimes even when it is, its still wrong..
I have tried to reassign fingerprints which does improve it for that couple of minutes but later on when I grab my phone and try to unlock it I get so many wrongs..
Is it just me? or any one else find it frustrating?
Any tips to improve it?
Thanks.
Mine never has issues, if your hands are clean and not prone to being sweaty then I would exchange it.
mcjordan92 said:
Hi, I have just bought my new S7 and setup my fingerprint on it.
I didn't have fingerprint on my old phone so I can't compare it but I find it really inaccurate..
It gives me alot of wrongs if I am not landing my finger perfectly centered and sometimes even when it is, its still wrong..
I have tried to reassign fingerprints which does improve it for that couple of minutes but later on when I grab my phone and try to unlock it I get so many wrongs..
Is it just me? or any one else find it frustrating?
Any tips to improve it?
Thanks.
Click to expand...
Click to collapse
Unlike naturally how we expect it to work or how the other sensors like iPhone's, Nexus 6p's etc. works, with Galaxy S7 you should be careful when registering the fingerprint because of the relatively small surface area of the sensor. To make it clear, you can cover almost the whole finger print (considering the relatively large rounded shape of the sensor) in various other devices. While in the case of S7 you should only register the fingerprint in the way your finger will naturally positioned when unlocking. In my case considering the thumb, only an edge of the thumb will only get in contact with the sensor not the the center part or the other areas of the print. So just register the print in the way you normally hold and unlock the phone not keeping in a flat area and registering. If this works there is nothing wrong with the sensor. Otherwise you gonna need to replace the unit.
PS: Correct me if I'm wrong @cadcamaro ;-P
try registering same finger 2 or 3 times, this helps a lot increasing the accuracy of the scanner.
tip and sides of the finger is very important when registering
Sent from my SM-G935F using Tapatalk
Sheryl John said:
Unlike naturally how we expect it to work or how the other sensors like iPhone's, Nexus 6p's etc. works, with Galaxy S7 you should be careful when registering the fingerprint because of the relatively small surface area of the sensor. To make it clear, you can cover almost the whole finger print (considering the relatively large rounded shape of the sensor) in various other devices. While in the case of S7 you should only register the fingerprint in the way your finger will naturally positioned when unlocking. In my case considering the thumb, only an edge of the thumb will only get in contact with the sensor not the the center part or the other areas of the print. So just register the print in the way you normally hold and unlock the phone not keeping in a flat area and registering. If this works there is nothing wrong with the sensor. Otherwise you gonna need to replace the unit.
PS: Correct me if I'm wrong @cadcamaro ;-P
Click to expand...
Click to collapse
I personally set up my thumb when my phone is in my hand already, I also make sure that I move my thumb around and read as much of it as possible.
Thanks for all of your tips!!
I don't think my sensor is defected, it works after all..
I'll try the trick for registering only the tip of the thumb which indeed is what usually presses the button.. in fact I did register that part but not only that..
And about the register more than one time the same finger, does this thing actually recommended?
I mean its kinda ruin the machine learning of that thing.. it gets 2 different fingers that looks alike isn't it?
For me, using the thumb only works if I use/register the center of the thumb. The tip never works, but I can live with that. Center always works
works perfectly for me. in comparison to my S6's finger print sensor, this one is 10x better - faster to recognize and unlock and much more accurate.

Onscreen fingerprint reliability

Hi
I’ve had my vivo nex s for over 2 weeks and found the onscreen fingerprint unreliable. At times it works perfectly and then at times very fustrating it doesn’t work at all.
I’ve noticed when it’s warm or I’m outside, not sure why.
I’ve reset my fingerprints added couple of times for the same finger but that doesn’t help. I’ve noticed when phone is heated it’s less reliable and doesn’t work at times.
Not sure if it’s faulty or that’s the experience of most out there
Please share your experience and do you think I’ve got faulty set.
Absolutely no problems with the fingerprintscanner.
I've double registered my fingers and it's working perfectly.
Sometimes it takes 1 second but in 99% its working nearly Instant.
Perfect!!! And with a screen protectors or tempered glass? Co.okie4u you have a private message!!!
I also have my moments with the fingerprint scanner. The elite X3 scanner was more a hit than a miss compared to this phone. I will say the it has improved with the 16.5 update but it needs more work. It's as if the registered fingerprint file gets lost.
riz157 said:
Hi
I’ve had my vivo nex s for over 2 weeks and found the onscreen fingerprint unreliable. At times it works perfectly and then at times very fustrating it doesn’t work at all.
I’ve noticed when it’s warm or I’m outside, not sure why.
I’ve reset my fingerprints added couple of times for the same finger but that doesn’t help. I’ve noticed when phone is heated it’s less reliable and doesn’t work at times.
Not sure if it’s faulty or that’s the experience of most out there
Please share your experience and do you think I’ve got faulty set.
Click to expand...
Click to collapse
I'm having the exact same problem. Very Frustrating!
Sent from my vivo NEX S using Tapatalk
Co.okie4u said:
Absolutely no problems with the fingerprintscanner.
I've double registered my fingers and it's working perfectly.
Sometimes it takes 1 second but in 99% its working nearly Instant.
Click to expand...
Click to collapse
Yes, double registering your fingers does the trick. Works flawlessly over here.
How you double register your fingers? Each finger for twice saving? Thanks
I have registered my thumb 3 times and im around 75% when i hit the fingerprint reader.
My main problem asides from the 75% is that its a very small spot on the screen and that i often dont touch it 100%. That, combined with the 75% reliability, means im lucky if im at 50%
As i said absolutely no problem with the fp scanner.
Even when only my half thumb lays on the spot. I think it's a registration problem. ¯\_(ツ)_/¯
May be but you have registered 5 fingers? In each save one finger? Or 1 finger for 2 saves
Please Co.okie4 you have an unread private message since 2 days from me, can you read it? Thanks
Co.okie4u said:
As i said absolutely no problem with the fp scanner.
Even when only my half thumb lays on the spot. I think it's a registration problem. ¯\_(ツ)_/¯
Click to expand...
Click to collapse
GBOX said:
How you double register your fingers? Each finger for twice saving? Thanks
Click to expand...
Click to collapse
I have the same finger registered three times. How I managed to do that is place the finger not on the entire scanner but place the finger on part of the scanner to where you can still see the scanner light. Also use the edges of your finger on partial scanner. I kept trying and it worked. My misses are now less. This shouldn't be the solution as it should just work, but that's one way to get around the problem.
No problem for me.
The only issue is its a little slow when compared to generic finger print, but the awe u get by people around is totally worth than extra second.
Just be aware that you have to follow the instructions as stated on the screen. Use the pressure you would use as usual and when you are registering the edges of your finger grab your phone as you would in real life and with the same pressure as you would use.
I found that if you do this too lightly or too hard you will not recreate it in daily life and hence the failure.
Also register the edge side of the finger that you would touch the screen with, not the entire edge left and right

What is the best methods you find to improve the Success Rate of Fingerprint Scanner

So yes just lets admit it, The fingerprint scanner on Vivo Nex is not perfect, but what it represent is forward thinking which will force other manufactures to follow, but we all know that Optic under glass fingerprint scanner will have to make room to the far superior ultrasonic technology.
despite this I am interesting to know what method you people are using to get higher success rate ?
The first question that comes to mind does it really help to save multiple fingerprints for the same finger ?
Even though I mostly my thumb to unlock where it is hit and miss the index finger have a lot higher success rate, and I wonder why.
Dry hands seem to be a big problem for the fingerprint scanner... I therefor tried to save a new fingerprinting when my finger are dry, I cant say it any visible improvement. It is still frustrating that my index finger seem to work a lot better on the fingerprint scanner.
Fingerprint scanner seem to work better in dark room rather then a well lit room or environment.
please posts your findings how to improve success rate especially for using the thumbs.
I think there is still hope that the fingerprint scanner will improve further in future software updates.
I also think, people will have a different success rate because of biological versions, some fingers are maybe harder to read then others for some reason. Lets hope Vivo will push out more updates for the fingerprint accuracy. This is their first device aimed for the global market so lets hope they will give this one extra care since this device will be the bridge into the global market..
I use multiple fingerprints for one finger and think it's much more reliable than one saved fingerprint.
Interesting that my index fingers are also working much better with only one saved profile instead of my right thumb
Vivo Nex S is recognizing your already saved fingerprints. Nevertheless you can simply save the same fingerprint again by moving and trying different positions from your finger. I actually saved my right thumb three times and surprised how good it works (for the first 3 days)
Sent from my vivo NEX S using XDA Labs
Actually 2 months now I’m very pleased by reliability accuracy and smoothness of 3D underscreen fingerprint scanner.
Sent from my iPad using Tapatalk Pro
Tafff said:
I use multiple fingerprints for one finger and think it's much more reliable than one saved fingerprint.
Interesting that my index fingers are also working much better with only one saved profile instead of my right thumb
Vivo Nex S is recognizing your already saved fingerprints. Nevertheless you can simply save the same fingerprint again by moving and trying different positions from your finger. I actually saved my right thumb three times and surprised how good it works (for the first 3 days)
Sent from my vivo NEX S using XDA Labs
Click to expand...
Click to collapse
Thanks..I thought that had been tried in youtube videos I think I saw people say its does not help to make multiple fingerprints for the same finger... it should not be needed..it should be smarter then that..
especially since you press the finger multiple times when you setup a new fingerprint.
Well anyway I will try it..I guess it can be worse then what it is now....
Its frustrating that the index finger works so well..and not the thumbs...
I saw some review where they said that someone unlocked their smartphone with an unregistered finger...
This fingerprint sensor is really not reliable at all
And funny, i asked Vivo on facebook about this issue, Joe just told me "use a password instead" ...
Wahoux said:
I saw some review where they said that someone unlocked their smartphone with an unregistered finger...
This fingerprint sensor is really not reliable at all
And funny, i asked Vivo on facebook about this issue, Joe just told me "use a password instead" ...
Click to expand...
Click to collapse
Unfortunately Joe from vivo isn't a good supporter :/
Sent from my vivo NEX S using XDA Labs
Wahoux said:
I saw some review where they said that someone unlocked their smartphone with an unregistered finger...
This fingerprint sensor is really not reliable at all
And funny, i asked Vivo on facebook about this issue, Joe just told me "use a password instead" ...
Click to expand...
Click to collapse
To be honest I don't trust any videos about finger print scanner. If somebody wants to troll all they have to do is register the finger and state on the video that finger is unregistered and just troll the Vivo Nex owners about how unreliable the phone finger print scanner is.
I tried several times to unlock the phone with any finger that is unregistered and 100% of the time the phone doesn't unlock and send me to unlocked the phone with the pin number.
And the finger print scanner works 98% of the time with me on my registered fingers, I noticed the other 2% is because my fingers are wet or dirty from working out.
Sent from my [device_name] using XDA-Developers Legacy app
I scanned my thumbs fingerprints and it works better with the left one. Even after a rescan of the right one
I didn't succeed in making a second scan with a finger already stored
Of course I don't know why
The accuracy is fine,however there is another interesting notice-you don't actually have to wait with your finger on the screen until the phone unlocks. You can simply put the finger for a second,release it and then wait a bit more for the unlock. That's quite intersting user experience and it makes the visibility of a faster finger recognition process than it actually is
Tafff said:
I use multiple fingerprints for one finger and think it's much more reliable than one saved fingerprint.
Interesting that my index fingers are also working much better with only one saved profile instead of my right thumb
Vivo Nex S is recognizing your already saved fingerprints. Nevertheless you can simply save the same fingerprint again by moving and trying different positions from your finger. I actually saved my right thumb three times and surprised how good it works (for the first 3 days)
Sent from my vivo NEX S using XDA Labs
Click to expand...
Click to collapse
I am sorry but I do not believe in this method...
Remember when you create a fingerprint you scan your finger multiple of times even from the edges etc.
Theoretically it could only lead to even slower scanning.
Anyway success rate have improved a lot the last 2 days not sure why...
Hopefully its learning and getting better for each day. I still hope vivo will solve the speed.
one frustrating thing is the screen dont unluck directly even when the scanner have read your finger for instance I cant put off my finger before it gets unlocked and it unlock...
I hope next update will come with some improvements regarding fingerprint scanner cause I think it does not live up fully to its potential right now.
It seems that the unlocking process is actually quite fast. There is a delay because of the animation. If you turn off animations in developer's options unlocking would be faster.
Enable double tab to wake screen
Then
Double tab screen
Use fingerprint
This make it ultra fast anf accurate
---------- Post added at 12:14 PM ---------- Previous post was at 12:10 PM ----------
Always find my right hand not working fine with fingerprint??
Make sure the position you scan your finger is in the same position you unlock ur phone, I found this to work 8-9 times out of 10
what I have learned lately is, its good to not push too hard on the screen push very gentlely it seem to be easier to unlock. anyway I think this scanner still need software updates to improve it have problems in well lit scenarios, luckily I am a night bird..
blackinfinity said:
what I have learned lately is, its good to not push too hard on the screen push very gentlely it seem to be easier to unlock. anyway I think this scanner still need software updates to improve it have problems in well lit scenarios, luckily I am a night bird..
Click to expand...
Click to collapse
Yes I can confirm push the on screen scanner gently always works brilliantly,in few scenarios I pushed it harder didn’t response some time with first attempt.
Overall experience 2.5 months I’m very pleased with accuracy,response and smoothness as long we learn his trick.
Always helpful if someone experience not so good response or accuracy to register 1 more time from beginning it’s finger and tested one day continuously until been successfully.
And repeat 1-2 times to find their best performance to his own way.
Sent from my iPad using Tapatalk Pro
I just played with the fingerprint yesterday and I feel that it works better when we press harder I added the fingerprint in the dark, with a minimal backlight pressing the finger firmly.
I sorry for my English, I use Google Translator.
Fingerprint scanner has been updated with latest funtouch software , Rescan your fingers, you will definitely see and feel an improvement ?
ruk21201 said:
Fingerprint scanner has been updated with latest funtouch software , Rescan your fingers, you will definitely see and feel an improvement
Click to expand...
Click to collapse
Do you mean the global or the chinese rom ? I use the chinese rom, I think nothing was mentioned about fingerprint scanner improvements in either of the latest firmwares of global and chinese. Anyway I will try rescan my fingers I have nothing to lose.
blackinfinity said:
Do you mean the global or the chinese rom ? I use the chinese rom, I think nothing was mentioned about fingerprint scanner improvements in either of the latest firmwares of global and chinese. Anyway I will try rescan my fingers I have nothing to lose.
Click to expand...
Click to collapse
Global version
Install 1.8.8 update and fingerprint is supersonic fast now

Useless fingerprint sensor? Did I get a dud, or is this a design flaw?

I just got a One Hyper and generally love it, EXCEPT the fingerprint sensor almost never works? My previous Motorola G5 Plus gets my finger/thumb pretty much instantly every time. No matter how many times I've deleted and reprogrammed the fingerprints on this One Hyper it only recognizes a finger press 1 out of 10 or 20 presses???? Seems like it worked better, but not near perfectly when I first started using it and it's been all but entirely useless since I did the Android 11 upgrade soon after getting it?
I've watched several video reviews that either don't mention this being a problem or even say the fingerprint sensor works well??? So, I'm thinking I may have gotten a dud? I'd just return it to Amazon, but I bought it in the USA right before returning to Canada and I even left the box in the US. Maybe Motorola would swap it out under warranty? Or maybe I could just pay for a replacement sensor?
I would return it.
If you get a replacement, disable OTA updates and leave it on 10. Android 11/12 are a mess.
Scoped storage and forced encryption are fully active.
As I mentioned, returning it would be complex, possibly impossible. I could get the original box sent to me in Canada since I left it at my mom's house in the US? Maybe I could get a swap out from Motorola, I'd likely have to send my current unit to the US and might have to get the replacement sent to the US and forwarded to me here in Canada?
What a mess. I should have taken the issue more seriously when I first got it, should have done a return to Amazon right off the bat.
I have a support escalation request in with Motorola, so we'll see where that goes I suppose. The first teir support guy just suggested the classic, "First, Do a factory reset." I really doubt that'll fix this phone. And I've spent days getting this phone set up to my liking. But if this sensor isn't ever going to work, that's a deal breaker. Way too used to working fingerprint unlocking to go back to a password.
Well, I haven't heard from Motorola yet, but I trained the same finger for all 5 available fingers and now it unlocks perfectly every time? It seems to get my thumb with only one "finger" trained with it. That's what I use on my G5 Plus, because the sensor is on the front. I like the phone a lot in general, so I was VERY keen to find a solution. But disappointing, as I'd like to be able to train more than one finger! The 5 fingerprint limit is a little frustrating. The fact that the software isn't robust enough to actually learn my prints in the one little training session it gives is pretty frustrating! You should be able to go into those settings and keep on adding finger presses to train it better, faster manually. AND It sure would be nice if you could set your own limit for unsuccessful tries before it makes you enter a PIN or password. I was simply never getting in in the number of allowed presses. So I don't think it was training the AI very well, thus not improving the recognition.
So, solution seemingly found, I don't >think< this is a hardware or design flaw? Sure does seem like lousy software, perhaps in the Android 11 code? I didn't use it with 10 very long, but it did seem to do a lot better recognizing my fingerprints before I did the 11 update.
AHHHHH!!!!! And this morning the same finger that was unlocking pretty much instantly every time after yesterdays "fix" isn't recognized try after try after try this morning??
No one else is having these kinds of issues? Everyone is getting fast, consistent fingerprint recognition?
Otherwise I love this phone! The pop up selfy cam so when it's face up on a table I know no camera can see anything unless that front camera is popped out is so perfect I do not understand why that's not on most phones??!! Notches and holes in screens are going to be so dated and laughable as soon as that falls out of fashion. Good cameras. Plenty of built in storage AND an SD slot? Dual sims?!!! (American living in Canada here!) 3.5mm analog headphone jack??? This is my PERFECT phone, at least for this price. EXCEPT if I can't get consistent, fast fingerrpint recognition, I am simply not going to keep this phone. WTF???!!!! WHY is does this work so dramatically worse than my old G5 Plus??
Deleted all fingerprints. Set three to my pointer finder, one to my middle finger, one to my thumb. It's working pretty much perfectly now! On either finger and the thumb it seems. BUT, for how long??!! Will I wake up tomorrow and have to reprogram all five fingerprints?? At this point, I have to assume it's going to stop working in the next day or so??? Pray I'm wrong!!!!

Question Do "approved" screen covers help with fingerprint scanner?

So I searched around and didn't find an exact answer so sorry if this has been asked/answered before. 6A with a Tocol glass screen cover. I was actually getting decent results prior to the Android 13 update but ever since the fingerprint reader is almost useless. I have deleted and relearned fingerprints multiple times both with and without increasing the screen sensitivity but nothing has worked. Has anyone tried the google approved screen covers and did they help?
It seems that most glass screen protectors work just okay for fingerprint in my experience. I have figured out that the trick seems to be setting it up right. The instructions indicate that you need to move you finger into various positions, but instead I have found that it is better to just use the finger position you typically will use but in varying degrees of pressure on the screen. I hope that makes sense....in other words it helps to put your finger on the screen lightly, then keep it in essentially the same position but press slightly harder several times.
neatojones said:
It seems that most glass screen protectors work just okay for fingerprint in my experience. I have figured out that the trick seems to be setting it up right. The instructions indicate that you need to move you finger into various positions, but instead I have found that it is better to just use the finger position you typically will use but in varying degrees of pressure on the screen. I hope that makes sense....in other words it helps to put your finger on the screen lightly, then keep it in essentially the same position but press slightly harder several times.
Click to expand...
Click to collapse
Hmmm...that's an interesting idea. I'll have to give it a try, I've tried everything else. At some point I'll take the time to just remove my screen cover to see if it helps. Thanks!
I register my most used finger more than once and then some other fingers as well. For this phone, I registered my thumb twice (same thumb), index finger, and then another finger on my other hand.
JoeHockey said:
Hmmm...that's an interesting idea. I'll have to give it a try, I've tried everything else. At some point I'll take the time to just remove my screen cover to see if it helps. Thanks!
Click to expand...
Click to collapse
How did it go?
If you are rooted there is also a sexy magisk module that will boost the scanner
Arealhooman said:
If you are rooted there is also a sexy magisk module that will boost the scanner
Click to expand...
Click to collapse
Which one? name/ link?
tusher3365 said:
Which one? name/ link?
Click to expand...
Click to collapse
[MODULE] Fingerprint Scanner Booster
Fingerprint Scanner Booster It does what the title says! It boosts Fingerprint sensor's responsiveness by prioritizing its process. If you use custom roms and those roms have a little delay with unlocking the device using the fingerprint...
forum.xda-developers.com
I've been using an old generic matte PET screen protector designed for an older pixel phone without any problems, so i don't think you need to get an "approved" one. I didn't increase sensitivity setting either.
6a's fingerprint reader works consistently for me, except maybe a rare misread every few months because my finger was very dry or something. In those instances, I unlock successfully with my other registered finger.

Categories

Resources