this post was submitted on 27 Jun 2024
858 points (97.5% liked)

Technology

59219 readers
3314 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago
MODERATORS
L3s@lemmy.world
L3s@fry.gs
L4s@fry.gs
L4s@lemmy.world
enu@lemmy.world
858
Shopping app Temu is “dangerous malware,” spying on your texts, lawsuit claims (arstechnica.com)
submitted 4 months ago by neme@lemm.ee to c/technology@lemmy.world
238 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] dev_null@lemmy.ml 6 points 4 months ago* (last edited 4 months ago) (1 children)

Yes, the phone does, but that data is protected in the hardware and never sent to the software, the hardware basically just sends ok / not ok. It's not impossible to hack in theory, nothing is, but it would be a very major security exploit in itself that would deserve a bunch of articles on it's own. And would likely be device specific vulnerability, not something an app just does wherever installed.

[–] Lojcs@lemm.ee 1 points 4 months ago (1 children)

Pretty sure this is not true. That's how apple's fingerprint scanners work. On android the fingerprint data is stored either in the tpm or a part of the storage encrypted by it.

[–] dev_null@lemmy.ml 1 points 4 months ago (1 children)

Yeah, so the app never sees it. What are you disagreeing with?

[–] Lojcs@lemm.ee 1 points 4 months ago (1 children)

I just corrected that, can't I without disagreeing?

[–] dev_null@lemmy.ml 1 points 4 months ago (1 children)

I mean that I don't know what part of my comment is "not true". I welcome corrections, I just don't see what is being corrected here.

[–] Lojcs@lemm.ee 1 points 4 months ago* (last edited 4 months ago) (1 children)

It doesn't send a yes/no signal it sends the fingerprint to be compared to the stored one

[–] dev_null@lemmy.ml 2 points 4 months ago* (last edited 4 months ago) (1 children)

https://developer.android.com/identity/sign-in/biometric-auth#display-login-prompt

The app gets either the onAuthenticationSucceeded or onAuthenticationFailed callback. It doesn't get the fingerprint.

Edit: I think we are misunderstanding each other, I'm saying that apps never see the fingerprint. The OS does, depending on the device.

[–] Lojcs@lemm.ee 1 points 4 months ago

I think we are misunderstanding each other

Exactly