PIN suddenly not correct

attila-lendvai

it's the same issue as described in https://discuss.grapheneos.org/d/1013-pin-suddenly-not-correct

this is a Pixel 9a, with a recent GOS.

the pin was entered countless times in the past few months (because the fingerprint reader is unreliable), and my wife is not showing signs of dementia, so please spare us the condescending comments exhibited in the other thread.

pin scrambling is not turned on and has never been on.

the pin is 6 digits long.

did anyone get any hint of what's going on?

guser39

attila-lendvai it may be that there is a hardware issue with the screen and touch recognition, especially if the fingerprint reader is known to be unreliable. Perhaps the area of the screen around the fingerprint reader is damaged? Do any of the PIN digits overlap with the fingerprint reader? When typing in the PIN try using a different finger or touching the screen in slightly different spots.

As mentioned in the referenced thread, the OP put the phone away for a few hours and was able to login afterwards.

attila-lendvai

guser39

no, the screen is fine. i meant that in general, that the fingerprint reader on the pixel 9a is one of the shittier ones compared to the phones we used prior to it. and the pin entry works as expected, touches are registered without delay, etc.

i've been coding for almost 4 decades, i would have noticed that, but i appreciate the ideas, thanks!

so, let's sleep on it then and see where we are tomorrow morning. i just don't know whether to keep it on or off, but i guess i'll keep it on.

random wild guess: maybe that post-update app-optimization thing is running in the background and unlock fails until it's finished? but that wouldn't have broken the unlock on her already booted phone running normally...

attila-lendvai

oh f*ck: a little detour: i got into a boot loop on both our phones, but i managed to resolve it.

after a few reboots i tried to enter recovery mode to see maybe i can adb shell to it. i accidentally selected rescue mode instead. after that i was unable to boot GOS! not if i select Start, nor if i completely power off the phone and start it. and i couldn't reach the Recovery menu either.

and then i tried it on my own phone (same setup), because i assumed it's some storage issue. but then i had two phones in a boot loop.

LLM suggested all kinds of dance around the boot menu. what worked finally is to enter Waiting for command... and leave the phone there for several minutes. after that timeout it finally entered the recovery menu, where a simple Reboot to system resolved the boot loop.

but now i'm back to square one: the pin doesn't work on my wife's phone.

no one could change it, we didn't lose sight of the phone in the relevant timeframe, and no one should know the pin to begin with.

one last anomaly that i've noticed: her phone is lagging behind on some system update, because the status bar icons are newer/different on mine. there was an upgrade about a week ago that i have installed on mine already, but it's not installed on hers yet. on her phone there's a "System updater" notification (that i cannot read because of the screen lock).

maybe some app update without a system update can lead to this?

attila-lendvai

next morning status:

there was a "system has been updated" notification that is instructing us to reboot. i assume it remained there in spite of the multiple reboots because the update is only applied if the storage is decrypted, i.e. the pin properly entered to unlock it.

the major WTF: the phone unlocked with the first 4 digits of the otherwise 6 digit pin that used to work for months.

this is baffling, because we did try yesterday to enter only the first 4 digits (because of the comments under the linked posts), and it did not work yesterday. we also rebooted multiple times in the process.

overnight the phone was left there lying freshly booted, i.e. it was waiting for the first unlock code to decrypt the storage.

today it seems to work consistently with the first 4 digits of the unlock code.

and what i very much don't understand (i.e. my understanding is inaccurate): if the pin is used to decrypt the storage -- hence it always needs to be entered after a fresh reboot --, then how on earth did a 4 digit version of the originally 6 digit pin unlock the storage this morning?!

wild guess: i suspect that this baffling behavior is related to installing a recent update.

Novalissoide

attila-lendvai you should do some backing up of important data, make any future lockout scenario less catastrophic.

marq2

attila-lendvai

@GrapheneOS any ideas about this? How can 4 digit decrypt the profile?

Thanks

attila-lendvai

further wild guessing:

maybe there's some migration code in the update script that regenerates or rewrites the storage encryption key in the hw keystore, and that script assumes the pin is at most 4 digits long.

update gets applied in the background while the phone is in normal use, the pin is requested (?) and the keystore gets updated according to the new code that comes with this update. notification comes up that a reboot is needed, and from that point the screen unlock breaks down on the phone.

then some WTF happens that makes the 4 digit code not work for a while.

next day the 4 digit code opens the phone, reboot is selected from the system-updated notification after it was unlocked, the application of the system update gets finished, and the phone continues to work with the first 4 digits of the pin.

i haven't actually checked any of these guesses in the code, i'm not familiar with the android codebase.

attila-lendvai

here's a screenshot from the current notification state:

notifications screenshot

if the embedding doesn't work: https://i.postimg.cc/Hx1RLT16/gos-update-wtf.png

i.e. it wants to once again reboot, and also complains about some error while applying an update that otherwise passed verification.

attila-lendvai

the phone has multiple users/profiles.

but the pins are completely different, so it's not a simple pin mixup, either by the user or the code.

hemingway

marq2

I would like to know too. Sounds like a pretty massive hole in how the unlock pin appears to be implemented.

attila-lendvai

another piece of info:

the phone was at least 2 or 3 system updates behind. or at least i have seen and pressed the reboot system notification at least this many times since this issue took my attention.