12

My Nexus 5X highly recommends to set up pattern lock in addition to fingerprint lock, and the pattern is asked upon every reboot. And my password manager (KP2A) recommends to use fingerprint unlock only to "quick unlock" after a short period of inactivity, but to require full password for the DB after every reboot.

Hence two questions:

  1. Why does Google considers the fingerprint lock as less secure than pattern lock?

    Using your fingerprint to unlock your device may be less secure than a strong password, PIN, or pattern.

  2. For my password manager on Android, is it really much safer to re-enter password upon every reboot rather than to use fingerprint lock? How many bits my password should have to be more secure than fingerprint lock?

Please note that I'm asking specifically on fingerprint scanner implementation in 5X, not for a general theory on an average abstract fingerprint scanner solution.

  • 1
    I think this question actually belongs to Information Security – SarpSTA Feb 1 '16 at 23:47
  • @SarpSTA I'm fine with that either; how can we move the question there? – yurkennis Feb 1 '16 at 23:48
  • I flagged the question. Mods will check it out and decide. There is no need for you to do anything. It's a good question. I'll be checking it later to read answers. – SarpSTA Feb 1 '16 at 23:50
  • @SarpSTA Given the number of up votes, isn't it time to delete the comments thread on moving to InfoSec? – yurkennis Feb 16 '16 at 21:15
  • Nope it is not. – SarpSTA Feb 17 '16 at 1:19
16

The weakness is actually in the fingerprints themselves and not the way Nexus 5x implements it.

Fingerprints are less secure because they cannot be changed like a password and cannot be revoked if compromised.

Fingerprints are also left everywhere such as, at a glass. They can then be captured and reproduced. Think about this: Android uses a touch screen. The fingerprints are left on the screen after device's usage.

With a fingerprint it's almost good then it is good enough. Because the way it is touched or if you have a cut. Making fingerprints not hashable. Compared to a pin which has to be perfect every time.

They can be taken without permission. Not only from being left behind but also legally without consent. If a password is in your head it must be given, thereby, also leaving your right to privacy and your right to remain silent.

In the United States a person is also protected from testifying against themselves by the 5th amendment. Legally, fingerprints are considered as physical objects because they exist in the physical world. So they are not protected by the 5th amendment.

  • 1
    I second this answer. Friends unlocked my phone while I was asleep, so fingerprints aren't really that secure. – NVZ Feb 2 '16 at 11:33
  • Do you mind to expand your answer to clarify on the following pieces of it? – yurkennis Feb 4 '16 at 15:48
  • "Fingerprints are less secure because they cannot be changed like a password" -- why it can be a concern with a real-life smartphone? – yurkennis Feb 4 '16 at 15:49
  • "Fingerprints are less secure because they cannot be revoked if compromised" -- again, why it's a concern in a real life? If you still possess the phone, you can remove previously added fingerprints from the phone to disable unlocking with them. And if you don't hold the phone any more, you can remotely lock/disable the phone altogether, no matter what kind of lock is used. – yurkennis Feb 4 '16 at 15:51
0

Certain fingerprint sensors are not very secure compared to patterns.

Why?

Because people have been able to hijack the fingerprint sensors! How? When you touch the fingerprint scanner, chances are you will usually touch it with the front of your finger. This leaves a fingerprint. A few hours later, say, you get a text, so you put your finger to it again to unlock it. This process repeats, and although you don't notice it, you have put several angles of your fingerprint on the sensor, because it is impossible to get your finger in the exact same spot every time. If a hacker stole your phone, he could use a high-resolution camera or even a scanner, for that matter, to read what is on the sensor. It will sense all the different angles and how they are aligned. Now, the hacker can print these patterns on a paper, and using one of the many established ways, make the ink conductive. He touches it to the fingerprint sensor and BOOM! Your phone has been hacked. And since there are fewer orientations of where your finger could be than possible pattern combinations, he could just try anther one if the previous didn't work. The worst part is, once he has this copy, He can hack any other device you purchase, as long as it has a fingerprint scanner. A pattern however is more secure. According to my calculations, there are 1000000000 (one billion) different possible patterns.

There is a grid, 3x3, and therefore there are 9 dots. Each dot could be the first, second, third, fourth, fifth, sixth, seventh, eighth, ninth, tenth, or not be touched at all. That's ten different options for 1. But we have 9, so number of combinations is 10 to the ninth, which is 1000000000.

Hope this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.