Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accidental Google Pixel Lock Screen Bypass

bugs.xdavidhu.me

Post reply on HN
Print view View original

361–370 of 475 posts

Re: Accidental Google Pixel Lock Screen Bypass

#361

Post by Miraste »

Sugimot0 wrote: post #356

Add to that the fact that the pixel 6 left audiophiles SOL for almost a year with no 3.5mm jack and broken USB-C DAC compatibility. Ontop of that Display Port Alt Mode is still disabled on every pixel for no good reason, despite many pixel owners reaching out to them, leaving us SOL for an alternative to samsung dex, or compaitibility with devices like the Nreal Air AR glasses. Google's hardware support IME is a shit…

I wouldn't worry about missing out on battery life. Every Google phone has had pretty sad runtime since the very first Nexus. It would seem they don't care.

Re: Accidental Google Pixel Lock Screen Bypass

#364

Post by hojjat12000 »

Sugimot0 wrote: post #356

Add to that the fact that the pixel 6 left audiophiles SOL for almost a year with no 3.5mm jack and broken USB-C DAC compatibility. Ontop of that Display Port Alt Mode is still disabled on every pixel for no good reason, despite many pixel owners reaching out to them, leaving us SOL for an alternative to samsung dex, or compaitibility with devices like the Nreal Air AR glasses. Google's hardware support IME is a shit…

Oneplus used to be good. But the experience and the OS is not the same. If you want Dex. Why not Samsung? I have a Pixel 6 (which I regret trading my Onplus6t for) and my next phone probably will be a samsung. The new ones are pretty stable and not as bloated as they used to be.

Re: Accidental Google Pixel Lock Screen Bypass

#366

Post by lrvick »

erwincoumans wrote: post #166
lrvick wrote: post #135

Earlier quoted context omitted.

It is a major security issue, and one of the reasons people running around with production access on laptops is insane. It is hard to fix this too, because almost no background desktop processes behave well when they are suddenly unable to write to the disk. Even if you solved that, your password manager has keys in memory, your browser has cookies in memory, etc etc.

Sleep mode could suspend all activity? You could encrypt all memory before sleep? It doesn't seem unsolvable, as long as sleep (closing lid) suspends all activity. (lock with background activity is different, lets discuss the sleep case)

If you fully hibernate to disk where it encrypts the memory snapshot to your FDE key, then you are good to go but that is not locking that is turning the computer off.

Re: Accidental Google Pixel Lock Screen Bypass

#367

Post by lrvick »

ridgered4 wrote: post #132
lrvick wrote: post #104

Earlier quoted context omitted.

Key is in memory at all times after boot on all of those. Full disk encryption is only useful on a laptop if the device is powered down fully.

> Key is in memory at all times after boot on all of those. I would think it would have to be while the device is mounted and OS locked, but surely if you dismount a secondary disk/container the key is purged?

As long as that secondary disk uses a different FDE key and you manually unmount it. This is easily done with LUKS on Linux but YMMV on other operating systems

Re: Accidental Google Pixel Lock Screen Bypass

#368

Post by exyi »

gcr wrote: post #64
tyingq wrote: post #16

Earlier quoted context omitted.

It didn't work on a fresh reboot, so presumably, it functioned like you're describing. But, when he swapped the sim live, without the reboot, the phone was already running with the key in memory.

On iPhone, keys are evicted from memory when the device is locked. Apps running behind the Lock Screen can only write files to special file inboxes (this is why the camera lets you take pictures while locked but doesn’t display earlier pictures, for example) You’re telling me that android keeps keys in memory for its entire uptime?

It has to, if you want to be able to unlock the device with a fingerprint

Re: Accidental Google Pixel Lock Screen Bypass

#369

Post by maerF0x0 »

scarmig wrote: post #303
maerF0x0 wrote: post #283

> During the life of this bug, since the official bug ticket was not too responsive, I sometimes got some semi-official information from Googlers. I actually prefer to only get updates on the official channel, which is the bug ticket and which I can disclose, but since I was talking with some employees, I picked up on bits and pieces. This is going to be one if the uncounted casualties of a downturn in tech and layof…

Turmoil isn't a good description of Google right now, though. It's far from healthy, but it has avoided mass layoffs so far, and the bug was filed in June.

> of Google right now, though.

I agree, my commentary is more on tech as a whole, which is in turmoil rn.

Re: Accidental Google Pixel Lock Screen Bypass

#370

Post by Humbly8967 »

sebzim4500 wrote: post #193
tyingq wrote: post #136

I wonder how many LEO agencies are now digging androids out of the evidence closet.

Sounds like this only affects phones that have been unlocked since the last restart, so unless they have kept them plugged it is unlikely that this attack would be successful.

This is why Graphene OS has an auto-reboot feature. So that a device cannot be kept plugged in until an exploit like this is discovered.
Post reply on HN