Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accidental Google Pixel Lock Screen Bypass

bugs.xdavidhu.me

Post reply on HN
Print view View original

251–260 of 475 posts

Re: Accidental Google Pixel Lock Screen Bypass

#251

Post by strix_varius »

Edman274 wrote: post #244

I went to buy a phone maybe two months ago. Before I had my current Google Pixel 6, I used a OnePlus 3T for six years, and even then I only stopped because I sat in a hot tub with it on. At the T-Mobile store, I announced to the salesman that I would be back to buy a Pixel 6 when they had it in stock, and a man pulled me aside and privately asked me why I wanted to buy a Pixel. He explained to me that he was actually…

I'm... not sure that I would take a random person* in a T-Mobile store at their word when they claimed that they were "actually working in the hardware division at Google."

Re: Accidental Google Pixel Lock Screen Bypass

#252

Post by thejman5200 »

Edman274 wrote: post #244

I went to buy a phone maybe two months ago. Before I had my current Google Pixel 6, I used a OnePlus 3T for six years, and even then I only stopped because I sat in a hot tub with it on. At the T-Mobile store, I announced to the salesman that I would be back to buy a Pixel 6 when they had it in stock, and a man pulled me aside and privately asked me why I wanted to buy a Pixel. He explained to me that he was actually…

I have a Pixel 6 because I bought it through Verizon when they offered a 5/month rebate for 36 months = 180 dollars off. This was at the beginning of this year so before the Pixel 7 released. I assume they offerred the rebate because they had a whole lot in stock that nobody bought, but everyone in my family got a Pixel because of it.

Re: Accidental Google Pixel Lock Screen Bypass

#253

Post by julianlam »

rippercushions wrote: post #248
Edman274 wrote: post #244

I went to buy a phone maybe two months ago. Before I had my current Google Pixel 6, I used a OnePlus 3T for six years, and even then I only stopped because I sat in a hot tub with it on. At the T-Mobile store, I announced to the salesman that I would be back to buy a Pixel 6 when they had it in stock, and a man pulled me aside and privately asked me why I wanted to buy a Pixel. He explained to me that he was actually…

Out of curiosity, why have you been regretting it? I've been using Pixels for quite a while now and generally been quite happy.

There are plenty of reasons that people how to spell it over the years, but none are actual red flags.

For example, I think people give Google grief over making it difficult to unlock the bootloader, but the same can be said of every other vendor.

In my experience, using the Pixel is good enough that I don't miss my Nokia 6.1 running LineageOS too much.

Re: Accidental Google Pixel Lock Screen Bypass

#254

Post by zitterbewegung »

btown wrote: post #60

The discussion on race conditions at the end is an important one, and IMO the bugfix is a bandage at best: the notion of anything accessing the “current” object after any kind of delay, especially in an event handler, when there is any chance the thing is not a singleton, is a recipe for disaster. In this case, dismissing the “current” security code screen was a supported API surface and that should set off all the r…

Google invests a great amount of money in their project zero team but does anyone know if they have a specific red team that is dedicated for Android ?

Re: Accidental Google Pixel Lock Screen Bypass

#255

Post by vvilliamperez »

staringback wrote: post #233
_kbh_ wrote: post #185

Earlier quoted context omitted.

LEO already have access to locked phones via stuff like GrayKey. https://www.grayshift.com/graykey/

I am always skeptical of these "lawtech" companies that sell magic unlocking devices. Are we really to believe that there are unpatched security holes in all major devices (both Android and iOS) that allow this kind of backdoor access? I find it rather convenient that the "detailed support matrix" is only available for current customers only, seems to me like the actual amount of supported devices/operating systems w…

It works. It's basically a software brute force that works great for 4 digit pins, takes longer for longer passcodes. Other offerings are a keylogger for the pin/passwords after they "return" the device to the suspect.

Re: Accidental Google Pixel Lock Screen Bypass

#256

Post by solardev »

Edman274 wrote: post #244

I went to buy a phone maybe two months ago. Before I had my current Google Pixel 6, I used a OnePlus 3T for six years, and even then I only stopped because I sat in a hot tub with it on. At the T-Mobile store, I announced to the salesman that I would be back to buy a Pixel 6 when they had it in stock, and a man pulled me aside and privately asked me why I wanted to buy a Pixel. He explained to me that he was actually…

What don't you like about the Pixels? I just switched to an iPhone this year and really regret it (the UX is horrible) and miss my Pixel.

Re: Accidental Google Pixel Lock Screen Bypass

#257

Post by strix_varius »

cr4nberry wrote: post #237
avianlyric wrote: post #232

Earlier quoted context omitted.

They already have multiple security screens, and a demonstrated critical bug with security screen confusion. Not sure how this is premature optimisation.

because if the number of screens is small and there are few tiers (only 2), passing an identifier around could be overkill sounds to me like it's an optimization for introducing more tiers than what there are

> the number of screens is small and there are few tiers (only 2)

Making this kind of assumption, when there are no such guards in the system itself, is exactly what leads to security issues.

If the system enforced two named singletons as security screens, so it was impossible to .dismiss() the wrong thing, then sure. But that's not how the system is, and assuming that "the number of screens is small" and "there are only 2 tiers" without enforcing that assumption with code is pretty much how the original bug was introduced.

Re: Accidental Google Pixel Lock Screen Bypass

#258

Post by GaryPalmer »

kaimalcolm wrote: post #24

Appalling handling on Google’s end here. The duplicate issue part I can understand, but why should it take two reports of a critical vulnerability to take action? Surely when the first one comes through it’s something you jump on, fix and push out ASAP, not give delay to the point where a second user can come along, find the bug, and report it. The refactor that’s mentioned towards the end of the article is great, bu…

No post body was provided.

Re: Accidental Google Pixel Lock Screen Bypass

#259

Post by advisedwang »

strix_varius wrote: post #251
Edman274 wrote: post #244

I went to buy a phone maybe two months ago. Before I had my current Google Pixel 6, I used a OnePlus 3T for six years, and even then I only stopped because I sat in a hot tub with it on. At the T-Mobile store, I announced to the salesman that I would be back to buy a Pixel 6 when they had it in stock, and a man pulled me aside and privately asked me why I wanted to buy a Pixel. He explained to me that he was actually…

I'm... not sure that I would take a random person* in a T-Mobile store at their word when they claimed that they were "actually working in the hardware division at Google."

In the story above he says he wants to buy a pixel to the salesperson, but it is someone else that says they work at Google.

Re: Accidental Google Pixel Lock Screen Bypass

#260

Post by vxNsr »

julianlam wrote: post #250
Edman274 wrote: post #244

I went to buy a phone maybe two months ago. Before I had my current Google Pixel 6, I used a OnePlus 3T for six years, and even then I only stopped because I sat in a hot tub with it on. At the T-Mobile store, I announced to the salesman that I would be back to buy a Pixel 6 when they had it in stock, and a man pulled me aside and privately asked me why I wanted to buy a Pixel. He explained to me that he was actually…

Did this self-reported hardware engineer from Google tell you WHY his colleagues don't use a Pixel? You could have just as likely been listening to hot air from a random individual. Perhaps an Apple store employee with an axe to grind.

Or maybe T-Mobile gave higher commission for apple sales that month.
Post reply on HN