4 ms·

Hey, author here. Happy to answer questions. There's also a big Twitter thread here https://twitter.com/FiloSottile/status/750273921568485377 https://twitter.co

Hey, author here. Happy to answer questions. There's also a big Twitter thread here https://twitter.com/FiloSottile/status/750273921568485377 https://twitter.com/FiloSottile/status/750273921568485377 To frame the post and the conversation, I am targeting a loose but not universal threat model. If threat of deadly force is higher up in your risk scale than shoulder-surfing, or Apple cooperation is a given, then you might want to make very different choices, but more importantly, you probably need better advice than a blog post. The only things I want to add are pair-locking, maybe a forced VPN profile, and a correction on how to check the Whatsapp fingerprint. You can find all these things in the Twitter thread.

newman314 10y ago
I'd avoid using TouchID to unlock your phone for legal reasons. Once the phone is unlocked, you can use TouchID as the phone is already open and you would not gain/lose anything from using TouchID in that scenario. But until the courts rule that you cannot be compelled to TouchID unlock your phone like a PIN, I think that is the safer route to take for now.
- mahyarm 10y ago
  If you expect you can reliably turn off your phone (7 seconds) before you get in a search situation, then use a full password instead of a numeric pin, then touch ID is a great balance of convenience and security. TouchID also prevents shoulder surfing of your code. It's all about the threat model.
  - watson 10y ago
    Correct me if I'm wrong, but isn't it also possible to just use one of your fingers that you didn't register with touch ID for 5 or so consecutive unlock attempts and it will have the same effect as rebooting your phone?
    - notjosh 10y ago
      There is a slight difference. Keychain and NSFileManager have possible modes of "kSecAttrAccessibleAfterFirstUnlock" [0] and "NSFileProtectionCompleteUntilFirstUserAuthentication" [1] respectively that are (fittingly) in an open state within your app after you've unlocked the device. [0]: https://developer.apple.com/reference/security/ksecattraccessibleafterfirstunlock https://developer.apple.com/reference/security/ksecattracces... [1]: https://developer.apple.com/reference/foundation/nsfilemanager/1653059-file_protection_values https://developer.apple.com/reference/foundation/nsfilemanag...
    - TazeTSchnitzel 10y ago
      That will stop you using Touch ID thereafter, but it's quite slow to do in practice. As an aside, I've found that, at least with my iPhone 5S, if my finger is wet (e.g. if I've licked it), it also is rejected.
- deleted 10y ago
  [deleted]
krrose27 10y ago
Just a heads up security questions can be reset with a call to AppleCare. That's why this https://support.apple.com/en-us/KM205083?cid=acs::applesearch https://support.apple.com/en-us/KM205083?cid=acs::applesearc... article states to contact them.

newman314 10y ago

I'd avoid using TouchID to unlock your phone for legal reasons. Once the phone is unlocked, you can use TouchID as the phone is already open and you would not gain/lose anything from using TouchID in that scenario. But until the courts rule that you cannot be compelled to TouchID unlock your phone like a PIN, I think that is the safer route to take for now.

mahyarm 10y ago
If you expect you can reliably turn off your phone (7 seconds) before you get in a search situation, then use a full password instead of a numeric pin, then touch ID is a great balance of convenience and security. TouchID also prevents shoulder surfing of your code. It's all about the threat model.
- watson 10y ago
  Correct me if I'm wrong, but isn't it also possible to just use one of your fingers that you didn't register with touch ID for 5 or so consecutive unlock attempts and it will have the same effect as rebooting your phone?
  - notjosh 10y ago
    There is a slight difference. Keychain and NSFileManager have possible modes of "kSecAttrAccessibleAfterFirstUnlock" [0] and "NSFileProtectionCompleteUntilFirstUserAuthentication" [1] respectively that are (fittingly) in an open state within your app after you've unlocked the device. [0]: https://developer.apple.com/reference/security/ksecattraccessibleafterfirstunlock https://developer.apple.com/reference/security/ksecattracces... [1]: https://developer.apple.com/reference/foundation/nsfilemanager/1653059-file_protection_values https://developer.apple.com/reference/foundation/nsfilemanag...
  - TazeTSchnitzel 10y ago
    That will stop you using Touch ID thereafter, but it's quite slow to do in practice. As an aside, I've found that, at least with my iPhone 5S, if my finger is wet (e.g. if I've licked it), it also is rejected.
deleted 10y ago
[deleted]

krrose27 10y ago

Just a heads up security questions can be reset with a call to AppleCare. That's why this https://support.apple.com/en-us/KM205083?cid=acs::applesearch https://support.apple.com/en-us/KM205083?cid=acs::applesearc... article states to contact them.