4 ms·

Interesting. Let's take this current tech you described and apply it to this situation, what happens. You did some unspeakable act and you are dead. * You hav

Interesting. Let's take this current tech you described and apply it to this situation, what happens. You did some unspeakable act and you are dead. * You have securely enabled touchID Even if you have 10 tries, barring using random appendages your phone can be unlocked right? Edit: on my phone so far it is password OR touchID. Making this easily defeatable with the physical device and my: 1. Hand if I am dead or alive. 2. A copy of my fingerprints on file with the gov't (true for me) 3. A non-gov adversary with literally anything i've touched. Maybe I can enable both, but currently it is either or.

X-Istence 11y ago
After 5 tries with your finger, an iPhone will require passcode for any further unlocks. Also, after 48 hours an iPhone requires a passcode to be unlocked, even if TouchID is enabled. So you have limited time, and have to hope you guess the right finger to use and it reads the finger within that 5 try period.
- jorgeleo 11y ago
  this is an interesting vector of attack. Can by software modify those limits? Instead after 5, make it after 100; instead after 48 hours make it after 40000. And then, can a fake finger with the correct fingerprints be made so it fools the reader? Lets say make it of silicone or gummy bears?
tptacek 11y ago
All I'm really saying is that the complexity of your passcode matters a lot in this scenario, so anything you can do to increase it will tend to pay off.
- vonklaus 11y ago
  I am not saying you're wrong. I was hoping there was a way to provide more security that I overlooked, however that doesn't seem to be the case. Most people likely use their dominant hand, probably thumb maybe pointer. In this threat model, someone lifts your phone and opens it with a fingerprint. Assuming they can completely replicate a print and get one (fairly non trivial assumption) they could probably get through with 5 tries. Genuine question: How secure would you rate: * TouchID * 6 char password * numeric 4 digit pin

X-Istence 11y ago

After 5 tries with your finger, an iPhone will require passcode for any further unlocks. Also, after 48 hours an iPhone requires a passcode to be unlocked, even if TouchID is enabled. So you have limited time, and have to hope you guess the right finger to use and it reads the finger within that 5 try period.

jorgeleo 11y ago
this is an interesting vector of attack. Can by software modify those limits? Instead after 5, make it after 100; instead after 48 hours make it after 40000. And then, can a fake finger with the correct fingerprints be made so it fools the reader? Lets say make it of silicone or gummy bears?

tptacek 11y ago

All I'm really saying is that the complexity of your passcode matters a lot in this scenario, so anything you can do to increase it will tend to pay off.

vonklaus 11y ago
I am not saying you're wrong. I was hoping there was a way to provide more security that I overlooked, however that doesn't seem to be the case. Most people likely use their dominant hand, probably thumb maybe pointer. In this threat model, someone lifts your phone and opens it with a fingerprint. Assuming they can completely replicate a print and get one (fairly non trivial assumption) they could probably get through with 5 tries. Genuine question: How secure would you rate: * TouchID * 6 char password * numeric 4 digit pin