Samsung Fingerprint Scanner Has Major Flaw

Samsung has issued a security fix after revelations of a major flaw in its fingerprint sensor. It affects users who have added a silicone screen protector.

The fix came after a British woman contacted a newspaper to report that not only could she unlock her phone with the "wrong" fingerprint, but her husband could also unlock it with his finger. That's a major problem as she was using a Galaxy S10, a high-end Samsung phone that lets users set up fingerprint recognition not only to unlock the phone, but also to login to apps and even authorize mobile payments. (Source: bbc.co.uk)

Scan Misreads Surface as Fingerprint

The same problem appears to affect the Galaxy S10, S10+, S10 5G phones, along with the Note 10 and Note 10+.

The common factor is that they have an three-dimensional ultrasonic fingerprint scanner built into the screen itself, rather than a physical scanner beneath the screen or on the back of the phone. Having the fingerprint reader inside the screen (rather than a button somewhere on the phone) means manufacturers can produce a larger display without also increasing the overall size of the handset.

The problem is that the ultrasonic scanner is still set up on the assumption that the relevant section of the screen will be in direct contact with the fingerprint when it's first set up. However, if the user has a screen protector on, the sensor is actually recording information about the underneath of the screen protector, including any bubbles or debris that may have been caught under the screen protector when it was first applied.

That's a security disaster as when the fingerprint authorization is next used, the 'scan' will read the same on every check regardless of whose fingerprint is actually in position.

Samsung: Remove Screen Protector Now

Samsung's taking a two-pronged approach to the problem. Firstly, it's issued a security update that will change the scanning process: the idea being that if a screen protector is present, it won't accept the initial scan as valid.

Secondly, it's urged all users to remove screen protectors, delete any stored fingerprints, and re-register their fingerprint to get an accurate and usable reading. (Source: express.co.uk)

What's Your Opinion?

Do you use a fingerprint scanner on your phone? Do you trust the technology? Are you surprised Samsung didn't foresee this problem during development?