5 ms·

> if my right arm is pinned under something and I desperately need to use the phone I have pattern locking today, and "emergency call" button on the lock scree

by VLM 10y ago

> if my right arm is pinned under something and I desperately need to use the phone I have pattern locking today, and "emergency call" button on the lock screen is already a thing. I would imagine this would be option #7 or so for the lock screen. Depending on your phone's hardware, etc. I used to treat my phone like my wallet, aka no lock at all beyond anti-butt dialing swipe, but some obscure corner of VPN setup required more extreme measures. I assume that any lock technology on my phone is on the level of a kids diary book lock, and act accordingly. Anyone with physical access to my phone owns all of it, so I'm pretty happy with "swipe to unlock" and not happy about big brother authoritarianism WRT vpn configs and lock screen choices. I don't find a bunch of security theater about "wiggle analysis" or facial recognition to be interesting or useful and mostly want to know about it so as to avoid it.

Godel_unicode 10y ago
Anyone with physical access and lots of money to pay for a bespoke exploit (assuming you're using a phone where that's possible), sure they have can have access if they're willing to put in the time and considerable money it would take. If you're ok with the risk posture of not locking your phone that's your decision, but you're quite wrong about the level of access granted merely by possession of a modern smartphone.
- gkya 10y ago
  What would be the amount of users who use a proper password on the lock screen, instead of the pattern or a PIN? I bet the actual pattern space is very little for these and these are very guessable. How hard would it be to brute force these or even analyse the human fat on the screen to figure sth out? I unlock and lock the phone very often, unlike a computer where I unlock once and lock when my session is done. Thus I opt for sth quick and convenient instead of a proper password. I'd like to have a little chip like a yubikey that I'd use with an ordinary pattern or pin, guess that'd be the best approach that's both convenient and secure.
  - 794CD01 10y ago
    You're describing the exact use pattern touch ID was designed for.
  - VLM 10y ago
    That seems very complicated compared to looking at security camera footage from the hundreds of cameras I walk past. Type in the code you see on the video and there you are. Likewise no one in .com or .gov technically needs my phone other than to look at what I might have saved locally on it; they own everyone from the mfgr thru the telco thru every app writer and SaaS provider either by just buying/sharing data or NSLs.
    - Godel_unicode 10y ago
      Do you also not lock your front door because someone could possibly take a picture of your key and 3d-print one, then follow you to see where you live and rob you? Coming up with theoretical nightmare scenarios is fun and all, but you should try to bring some reality to your security decisions.
  - Godel_unicode 10y ago
    1 - patterns and pins are not as insecure as you apparently believe (consider that length isn't mandated and watch the search space explode). Enable the "10 tries and it's wiped" setting and get on with your life 2 - I wasn't talking about Joe public, I'm talking about the type of person who posts in smartphone security articles on HN. They'll pick a good enough PIN/Pattern 3 - we're not trying to secure against an advanced adversary, by far the most likely bad actor is the thief who pulled it out of your bag at Starbucks. A PIN/Pattern is fort Knox to them. Security is all about risk mitigation, you have to consider against whom you want the system to be secured.
    - gkya 10y ago
      3. You can't know. 2. No they won't. I don't. If I'll type a password once, twice a day, that's okay. But I draw that pattern or pin tens of times a day. 1. See VLM's post on this thread. 0. You can't ever know who you'll deal with. All you'll know will be "somebody has it".

by VLM 10y ago

Godel_unicode 10y ago

Anyone with physical access and lots of money to pay for a bespoke exploit (assuming you're using a phone where that's possible), sure they have can have access if they're willing to put in the time and considerable money it would take. If you're ok with the risk posture of not locking your phone that's your decision, but you're quite wrong about the level of access granted merely by possession of a modern smartphone.

gkya 10y ago
What would be the amount of users who use a proper password on the lock screen, instead of the pattern or a PIN? I bet the actual pattern space is very little for these and these are very guessable. How hard would it be to brute force these or even analyse the human fat on the screen to figure sth out? I unlock and lock the phone very often, unlike a computer where I unlock once and lock when my session is done. Thus I opt for sth quick and convenient instead of a proper password. I'd like to have a little chip like a yubikey that I'd use with an ordinary pattern or pin, guess that'd be the best approach that's both convenient and secure.
- 794CD01 10y ago
  You're describing the exact use pattern touch ID was designed for.
- VLM 10y ago
  That seems very complicated compared to looking at security camera footage from the hundreds of cameras I walk past. Type in the code you see on the video and there you are. Likewise no one in .com or .gov technically needs my phone other than to look at what I might have saved locally on it; they own everyone from the mfgr thru the telco thru every app writer and SaaS provider either by just buying/sharing data or NSLs.
  - Godel_unicode 10y ago
    Do you also not lock your front door because someone could possibly take a picture of your key and 3d-print one, then follow you to see where you live and rob you? Coming up with theoretical nightmare scenarios is fun and all, but you should try to bring some reality to your security decisions.
- Godel_unicode 10y ago
  1 - patterns and pins are not as insecure as you apparently believe (consider that length isn't mandated and watch the search space explode). Enable the "10 tries and it's wiped" setting and get on with your life 2 - I wasn't talking about Joe public, I'm talking about the type of person who posts in smartphone security articles on HN. They'll pick a good enough PIN/Pattern 3 - we're not trying to secure against an advanced adversary, by far the most likely bad actor is the thief who pulled it out of your bag at Starbucks. A PIN/Pattern is fort Knox to them. Security is all about risk mitigation, you have to consider against whom you want the system to be secured.
  - gkya 10y ago
    3. You can't know. 2. No they won't. I don't. If I'll type a password once, twice a day, that's okay. But I draw that pattern or pin tens of times a day. 1. See VLM's post on this thread. 0. You can't ever know who you'll deal with. All you'll know will be "somebody has it".