136
submitted 2 years ago by schizoidman@lemmy.ml to c/technology@lemmy.ml
all 19 comments
sorted by: hot top controversial new old
[-] twinnie@feddit.uk 38 points 2 years ago

It’s device manufacturers that are fucking up, not MS.

[-] aard@kyu.de 31 points 2 years ago

Pretty much everybody pushing fingerprints as a sensible thing for accessing a device is fucking up. It is way too easy to obtain a persons fingerprints suitable for device unlocking without them knowing - and that's ignoring that using fingerprints enables device unlocking with a persons finger against their will.

[-] Saik0Shinigami@lemmy.saik0.com 3 points 2 years ago

It’s device manufacturers that are fucking up, not MS.

...

and Microsoft Surface Pro X all fell victim to fingerprint reader attacks

So... MS is not MS? Is that the logic we're going for now?

[-] CaptObvious@literature.cafe 6 points 2 years ago

No, as stated in the article, it’s the sensor manufacturers that are not properly implementing the security protocol.

[-] Saik0Shinigami@lemmy.saik0.com -2 points 2 years ago

So you think that somehow absolves Microsoft how?

[-] CaptObvious@literature.cafe 4 points 2 years ago

It isn’t MS’s screwup. They didn’t build the sensor.

[-] Saik0Shinigami@lemmy.saik0.com -5 points 2 years ago

They didn't build the sensor, but they sourced and implemented it in their product. Part of selling products is getting your parts from reputable locations that are building their parts to your specification. This is absolutely still MS's screwup. And if MS can't build a device to implement their "security" standard properly. Then you cannot assume that ANY manufacturer can do it properly.

[-] CaptObvious@literature.cafe 2 points 2 years ago

Did you actually read the article?

[-] Saik0Shinigami@lemmy.saik0.com 1 points 2 years ago* (last edited 2 years ago)

Yes.

t’s not clear if Microsoft will be able to fix these latest flaws alone, though. “Microsoft did a good job designing Secure Device Connection Protocol (SDCP) to provide a secure channel between the host and biometric devices, but unfortunately device manufacturers seem to misunderstand some of the objectives,” writes Jesse D’Aguanno and Timo Teräs, Blackwing Intelligence researchers, in their in-depth report on the flaws. “Additionally, SDCP only covers a very narrow scope of a typical device’s operation, while most devices have a sizable attack surface exposed that is not covered by SDCP at all.”

So microsoft made a standard... and it doesn't cover the full scope of usage of these devices... Including their own surface pro x and thus can be abused. It's almost like both the sensor choice, and the software is flawed.

It's becoming apparent that you and all the other downvoters are just windows fanbois.

Also

The researchers found that Microsoft’s SDCP protection wasn’t enabled on two of the three devices they targeted.

So they recommend to enable this protocol... simply because it's better overall... But the third device was still vulnerable!

But yeah... I'm the one with reading comprehension problems. Totally.

Edit: You also still failed to articulate how this absolves MS from anything. They created the standard. They can't choose sensors that use it properly? So either MS is ignorant, or willfully breaking their own standard. Care to actually address how MS isn't at fault still?

[-] Pyrozo007@lemmy.dbzer0.com 20 points 2 years ago

Shocked_pickachu_face.jpg

[-] autotldr@lemmings.world 14 points 2 years ago

This is the best summary I could come up with:


Microsoft’s Offensive Research and Security Engineering (MORSE) asked Blackwing Intelligence to evaluate the security of fingerprint sensors, and the researchers provided their findings in a presentation at Microsoft’s BlueHat conference in October.

The team identified popular fingerprint sensors from Goodix, Synaptics, and ELAN as targets for their research, with a newly-published blog post detailing the in-depth process of building a USB device that can perform a man-in-the-middle (MitM) attack.

Blackwing Intelligence researchers reverse engineered both software and hardware, and discovered cryptographic implementation flaws in a custom TLS on the Synaptics sensor.

The complicated process to bypass Windows Hello also involved decoding and reimplementing proprietary protocols.

The researchers found that Microsoft’s SDCP protection wasn’t enabled on two of the three devices they targeted.

Blackwing Intelligence now recommends that OEMs make sure SDCP is enabled and ensure the fingerprint sensor implementation is audited by a qualified expert.


The original article contains 474 words, the summary contains 145 words. Saved 69%. I'm a bot and I'm open source!

[-] sadreality@kbin.social 7 points 2 years ago

This is for your own security!

[-] cheese_greater@lemmy.world 0 points 2 years ago

Because of course it has

this post was submitted on 23 Nov 2023
136 points (97.2% liked)

Technology

38791 readers
78 users here now

This is the official technology community of Lemmy.ml for all news related to creation and use of technology, and to facilitate civil, meaningful discussion around it.


Ask in DM before posting product reviews or ads. All such posts otherwise are subject to removal.


Rules:

1: All Lemmy rules apply

2: Do not post low effort posts

3: NEVER post naziped*gore stuff

4: Always post article URLs or their archived version URLs as sources, NOT screenshots. Help the blind users.

5: personal rants of Big Tech CEOs like Elon Musk are unwelcome (does not include posts about their companies affecting wide range of people)

6: no advertisement posts unless verified as legitimate and non-exploitative/non-consumerist

7: crypto related posts, unless essential, are disallowed

founded 6 years ago
MODERATORS