4 ms·

What would be the amount of users who use a proper password on the lock screen, instead of the pattern or a PIN? I bet the actual pattern space is very little

by gkya 10y ago

What would be the amount of users who use a proper password on the lock screen, instead of the pattern or a PIN? I bet the actual pattern space is very little for these and these are very guessable. How hard would it be to brute force these or even analyse the human fat on the screen to figure sth out? I unlock and lock the phone very often, unlike a computer where I unlock once and lock when my session is done. Thus I opt for sth quick and convenient instead of a proper password. I'd like to have a little chip like a yubikey that I'd use with an ordinary pattern or pin, guess that'd be the best approach that's both convenient and secure.

794CD01 10y ago
You're describing the exact use pattern touch ID was designed for.
VLM 10y ago
That seems very complicated compared to looking at security camera footage from the hundreds of cameras I walk past. Type in the code you see on the video and there you are. Likewise no one in .com or .gov technically needs my phone other than to look at what I might have saved locally on it; they own everyone from the mfgr thru the telco thru every app writer and SaaS provider either by just buying/sharing data or NSLs.
- Godel_unicode 10y ago
  Do you also not lock your front door because someone could possibly take a picture of your key and 3d-print one, then follow you to see where you live and rob you? Coming up with theoretical nightmare scenarios is fun and all, but you should try to bring some reality to your security decisions.
Godel_unicode 10y ago
1 - patterns and pins are not as insecure as you apparently believe (consider that length isn't mandated and watch the search space explode). Enable the "10 tries and it's wiped" setting and get on with your life 2 - I wasn't talking about Joe public, I'm talking about the type of person who posts in smartphone security articles on HN. They'll pick a good enough PIN/Pattern 3 - we're not trying to secure against an advanced adversary, by far the most likely bad actor is the thief who pulled it out of your bag at Starbucks. A PIN/Pattern is fort Knox to them. Security is all about risk mitigation, you have to consider against whom you want the system to be secured.
- gkya 10y ago
  3. You can't know. 2. No they won't. I don't. If I'll type a password once, twice a day, that's okay. But I draw that pattern or pin tens of times a day. 1. See VLM's post on this thread. 0. You can't ever know who you'll deal with. All you'll know will be "somebody has it".
  - Godel_unicode 10y ago
    You're totally missing my point. It's not that I can't know, it's that I don't care. You can't secure a phone against nation-state actors, so don't try. Do enough security so that the random person who steals your phone to sell it doesn't also steal your personal photos and bank info, order stuff from Amazon, use your phone to call their Uber, etc. They're more likely to be who has your phone anyway. Re-read the bottom of my other post, security is about balancing cost of mitigation against predicted impact of threat. State actors are very unlikely and very expensive to mitigate. Petty theft is more likely and cheaper.

by gkya 10y ago

794CD01 10y ago

You're describing the exact use pattern touch ID was designed for.

VLM 10y ago

That seems very complicated compared to looking at security camera footage from the hundreds of cameras I walk past. Type in the code you see on the video and there you are. Likewise no one in .com or .gov technically needs my phone other than to look at what I might have saved locally on it; they own everyone from the mfgr thru the telco thru every app writer and SaaS provider either by just buying/sharing data or NSLs.

Godel_unicode 10y ago
Do you also not lock your front door because someone could possibly take a picture of your key and 3d-print one, then follow you to see where you live and rob you? Coming up with theoretical nightmare scenarios is fun and all, but you should try to bring some reality to your security decisions.

Godel_unicode 10y ago

1 - patterns and pins are not as insecure as you apparently believe (consider that length isn't mandated and watch the search space explode). Enable the "10 tries and it's wiped" setting and get on with your life 2 - I wasn't talking about Joe public, I'm talking about the type of person who posts in smartphone security articles on HN. They'll pick a good enough PIN/Pattern 3 - we're not trying to secure against an advanced adversary, by far the most likely bad actor is the thief who pulled it out of your bag at Starbucks. A PIN/Pattern is fort Knox to them. Security is all about risk mitigation, you have to consider against whom you want the system to be secured.

gkya 10y ago
3. You can't know. 2. No they won't. I don't. If I'll type a password once, twice a day, that's okay. But I draw that pattern or pin tens of times a day. 1. See VLM's post on this thread. 0. You can't ever know who you'll deal with. All you'll know will be "somebody has it".
- Godel_unicode 10y ago
  You're totally missing my point. It's not that I can't know, it's that I don't care. You can't secure a phone against nation-state actors, so don't try. Do enough security so that the random person who steals your phone to sell it doesn't also steal your personal photos and bank info, order stuff from Amazon, use your phone to call their Uber, etc. They're more likely to be who has your phone anyway. Re-read the bottom of my other post, security is about balancing cost of mitigation against predicted impact of threat. State actors are very unlikely and very expensive to mitigate. Petty theft is more likely and cheaper.