5 ms·
It's (b) but they can't unlock the phone. They can make it easier to perform a brute force passcode attack against the device. The method to do this would be to
by interpol_p 11y ago
It's (b) but they can't unlock the phone. They can make it easier to perform a brute force passcode attack against the device. The method to do this would be to restore the phone with a modified (and obviously signed) version of iOS that bypasses the passcode failsafes: such as wiping the data after 10 failed retries, and the exponentially increasing password retry delay.
The hardware imposes a limit of ~80ms on password attempts due to the nature of the hashing computations. So a four digit passcode could be brute forced in a maximum of 15 minutes if Apple were to install a purposefully hindered version of iOS on the device.
- gavinpc 11y agoThe failsafes as I understand it (from recent reading here) also include the inability to programmatically attempt login. As shipped, they will only accept such attempts from user input (keypad UI or fingerprint scanner).
- drdaeman 11y agoThanks! Hope in the new phones they'll just enforce the important constraints right in the silicon, effectively closing this gap.