Showing posts with label Google. Show all posts
Showing posts with label Google. Show all posts

Friday, April 23, 2010

Android failed security (or, why my grandma can hack it)

I have been using the Motorola Droid smartphone running Google's Android OS since last November. Overall, I am very satisfied with the phone and the quality of Verizon's network, but a security feature caught my attention last week.

The Droid (and likely other Android phones) has a screen-lock feature based on a grid of 9 nodes. When you set up the screen lock, it prompts you to draw a continuous pattern by dragging your finger over at least 4 adjacent nodes of the grid. After you verify your security pattern, you are supposed to have a locked screen: if someone finds your phone, they cannot use it because it is theoretically difficult to guess the correct pattern.

This sounds like a very smart locking feature for a touch-screen interface. The 9-node grid is certainly a non-boring way to authenticate the user. It is probably easier to remember a drawing pattern than remember a password. In addition, the computer-scientists at Google had fun calculating the combinatorics of the grid, the number of grid nodes and the minimum number of pattern-nodes needed to have adequate security etc.

The issue is that this security feature is an interesting idea in theory, but IT IS NOT WORKING IN REALITY for a very simple practical reason: when you drag your finger on the touch-screen to unlock the phone, and usually you do that often, then a trace is left on the screen that is CLEARLY VISIBLE, if you just turn the screen at an appropriate light-angle. Even when I clean the touch-screen very well and I clean my hands thoroughly, the trace is again clearly visible when I just unlock the phone a couple of times. Evidently, the problem gets much worse when the screen is not very clean, or the user's hands are oily or not thoroughly clean. Hacking a smartphone could not be easier...

Lesson for engineers: Graph theory and probabilities are not substitutes for good old common sense.

p.s. Techcrunch wrote in January 09 about another security bug.

Friday, November 13, 2009

Godgle

If Nietzsche visited the earth one century after his time, he would have probably proclaimed "godgle is again alive!"