4 ms·
They state that they can push an update that makes brute-forcing possible by disabling software-enforced delays between attempts. Apple's security PDF says tha
by andreyvit 11y ago
They state that they can push an update that makes brute-forcing possible by disabling software-enforced delays between attempts.
Apple's security PDF says that the iteration count is calibrated so that one attempt takes 80ms in hardware, so that's the hard limit on the brute forcing speed, regardless of any updates Apple releases.
This means that a long alphanumeric passphrase is secure, but a 6-digit passcode could be broken in half a day, and a 4-digit passcode would take just a dozen minutes.
- deleted 11y ago[deleted]
- imh 11y agoIt's so weird how hard it is for the brain to handle exponential growth. I was amazed that a 4-digit password can be cracked so quickly at 80ms a pop, but you're right. Just for the hell of it, here's how long it would take for different length passcodes for digits, digits plus letters (case insensitive), and digits plus letters (case sensitive): # characters [0-9] [0-9a-z] [0-9a-zA-Z] 1 0.8 seconds 2.9 seconds 5 seconds 2 8 seconds 1.7 minutes 5.1 minutes 3 1.3 minutes 1 hour 5.3 hours 4 13 minutes 1.6 days 2 weeks 5 2.2 hours 8 weeks 2.3 years 6 22 hours 5.5 years 140 years 7 1.3 weeks 200 years 9 thousand years 8 13 weeks 7 thousand years 550 thousand years 9 2.5 years 260 thousand years 34 million years 10 25 years 9 million years 2 billion years
- tedmiston 11y agoDoes this consider the "too many incorrect attempts" lockout that iOS imposes though?
- imh 11y agoNope, it's just 80ms multiplied by the number of possibilities.
- typeformer 11y agoAccording to Snowden, the NSA can brute force at the speed of over a trillion guesses a second, of course, they would need to be able to disable other security features first.