4 ms·

It was said Face ID is one in a million so that means ~7500 people can unlock my phone..

function_seven 9y ago
My current PIN is 6 digits, so ~7500 can also unlock my phone on a random guess. Chances are the first five people to try will trigger the passcode though.
- kevingrahl 9y ago
  Haven't checked your math but that's random guesses on an insecure password and prevented by rate limiting, you can't just enter 7.5 billion passwords. Face recognition (other than Face ID I mean) is fairly advanced. Let's say a government wanted to unlock my phone they could search for similiar faces and just pay the person. Sure a lot of trouble for unlocking a phone and it's theoretical but it's still a flawed system in my opinion.
  - jpalomaki 9y ago
    There's no perfect solution to this problem. Secure password is too clumsy to enter on phone many times per hour. Passcodes are easy to catch via shoulder surfing.
    - kevingrahl 9y ago
      Sure, I see that but different users - different habits. I manage just fine with a 25+ character random alphanumerical password that I change at least every six months. I only use Touch ID when I'm home and am very aware when entering my password. In the end it's just a phone but I like to have it at somewhat secure.
  - bpicolo 9y ago
    6 * 10 = 1,000,000
hawski 9y ago
One in a million is the same as with a six digit passcode.
- kevingrahl 9y ago
  > six digit passcode Which is insecure. I use a 25+ character random alphanumerical password that I change at least every six months.
  - lagadu 9y ago
    Having to enter a 25+ character random alphanumerical password every time you need to use your phone isn't anywhere near acceptable for modern usage expectations. Hell, it's not even acceptable for laptop and desktop computers. Sure, a useless system is technically safe but it's still useless.
    - kevingrahl 9y ago
      For the average user, definately not, I agree with you there. For laptop and desktop computers this should be the standard in my opinion, at least 20 random chars if you value your privacy and care for security. Once your inside the system you can use a password manager to use passwords as long as possible without any notable impact on user expierience. But I haven't said I'm the average user, and a six digit passcode just isn't secure I doubt you'd argue on that point?
      - lagadu 9y ago
        I'd argue that under some conditions: I feel it's secure enough for locking a phone for example because a phone won't allow any form of brute-force unlocking that would allow an attacker to try, lets say 1 password/sec. Same goes for pin codes on debit cards. Same goes for a physical combination lock safe: 1 million possible combinations would take an impractically long time to crack on average in a realistic real world attempt. For things like hard drive encryption where you can get the specific piece of hardware and have software brute force it then yes I agree it's insufficient.
deleted 9y ago
[deleted]

My current PIN is 6 digits, so ~7500 can also unlock my phone on a random guess. Chances are the first five people to try will trigger the passcode though.

kevingrahl 9y ago
Haven't checked your math but that's random guesses on an insecure password and prevented by rate limiting, you can't just enter 7.5 billion passwords. Face recognition (other than Face ID I mean) is fairly advanced. Let's say a government wanted to unlock my phone they could search for similiar faces and just pay the person. Sure a lot of trouble for unlocking a phone and it's theoretical but it's still a flawed system in my opinion.
- jpalomaki 9y ago
  There's no perfect solution to this problem. Secure password is too clumsy to enter on phone many times per hour. Passcodes are easy to catch via shoulder surfing.
  - kevingrahl 9y ago
    Sure, I see that but different users - different habits. I manage just fine with a 25+ character random alphanumerical password that I change at least every six months. I only use Touch ID when I'm home and am very aware when entering my password. In the end it's just a phone but I like to have it at somewhat secure.
- bpicolo 9y ago
  6 * 10 = 1,000,000

hawski 9y ago

One in a million is the same as with a six digit passcode.

kevingrahl 9y ago
> six digit passcode Which is insecure. I use a 25+ character random alphanumerical password that I change at least every six months.
- lagadu 9y ago
  Having to enter a 25+ character random alphanumerical password every time you need to use your phone isn't anywhere near acceptable for modern usage expectations. Hell, it's not even acceptable for laptop and desktop computers. Sure, a useless system is technically safe but it's still useless.
  - kevingrahl 9y ago
    For the average user, definately not, I agree with you there. For laptop and desktop computers this should be the standard in my opinion, at least 20 random chars if you value your privacy and care for security. Once your inside the system you can use a password manager to use passwords as long as possible without any notable impact on user expierience. But I haven't said I'm the average user, and a six digit passcode just isn't secure I doubt you'd argue on that point?
    - lagadu 9y ago
      I'd argue that under some conditions: I feel it's secure enough for locking a phone for example because a phone won't allow any form of brute-force unlocking that would allow an attacker to try, lets say 1 password/sec. Same goes for pin codes on debit cards. Same goes for a physical combination lock safe: 1 million possible combinations would take an impractically long time to crack on average in a realistic real world attempt. For things like hard drive encryption where you can get the specific piece of hardware and have software brute force it then yes I agree it's insufficient.

deleted 9y ago

[deleted]