A Samsung Galaxy A20 user in Spain who lost the tip of their finger in a crane accident was still able to register and use the severed digit to authenticate their identity and access the device, according to a report. As identification solutions have continued to evolve, reports have routinely come through on new and novel ways in which they can be bypassed or spoofed. Raising the question of just how safe these security solutions are?
The Galaxy A20 uses a technology called capacitive touch, which works by detecting a faint electrical signal in the finger and the peaks and valleys on the ridges of the person’s fingerprint. The technology first surfaced in phones as an authentication method in 2004. However, it wasn’t until 2013 when the feature went mainstream, after its inclusion in Apple's iPhone 5s. Samsung also has an ultrasonic sensor that detects a fingerprint using soundwaves through the phone’s screen, but that’s only included in its more recent premium smartphones.
Kieran Higgins, a semi-retired auditor working in the insurance and credit card industries, unlocked a Samsung Galaxy A20 phone using the severed tip of a finger, according to The Register. The act was shown over a video call, but was repeatedly demonstrated. According to the report, not only was the tip able to unlock the phone, but it was also used to register the fingerprint to begin with. Samsung has yet to weigh in on the issue, but the A20, like most mobile phones, uses the previously mentioned capacitive touch. All of which raises the question of where the electric signal needed to activate the sensor is coming from?
How Long Can A Severed Finger Unlock A Phone?
It remains unclear just how long before electrical conductance ceases when a person is deceased, or in this case when a finger is severed. Arguably, the two weeks that Higgins had still been using the finger is well outside the range many would expect. In a 2018 Live Science article, comments by Anil Jain, coauthor of the “Handbook of Fingerprint Recognition," explained that it would be pretty hard for a detached finger to unlock a phone, and that it would become even harder as time went on. However, Jain also explained that testing for exactly how long a finger maintains conductance is somewhat impractical, due to the requirement of bodies and/or parts and the frequency of checks needed.
In spite of these uncertainties, that's not to say the threat posed to digital security is not a concern. This area of study is referred to as ‘Liveness Detection,’ and it's the same sector that's concerned with the use of fake or spoof measures to bypass biometric identification. In fact, there are solutions out there that can tell the difference, although these tend to be used for high-end corporate security solutions and not consumer-grade devices, such as Samsung's Galaxy A20.
Source: The Register, Live Science