6 ms·
Most users have 4-digit or 6-digit numeric passwords, which can be trivially brute-forced. The only reason they can't generally is that SEP rate-limits decrypt
by earenndil 7y ago
Most users have 4-digit or 6-digit numeric passwords, which can be trivially brute-forced. The only reason they can't generally is that SEP rate-limits decryption attempts. They probably have a way around the rate-limit. Meaning: if you use an alphanumeric password, you're fine.
- jMyles 7y agoI can't immediately find the methodology by which a pattern is converted to a pin. For example, what's the degree of entropy for a non-trivial 6x6 pattern? (And why is my search fu not availing me of the answer to this question? :-) )
- f1refly 7y agoCheck out the "specific pattern decrypt note" section from the twrp faq https://twrp.me/faq/openrecoveryscript.html https://twrp.me/faq/openrecoveryscript.html
- polar 7y agohttps://android.googlesource.com/platform/frameworks/base/+/HEAD/core/java/com/android/internal/widget/LockPatternUtils.java#1124 https://android.googlesource.com/platform/frameworks/base/+/...
- jjeaff 7y agoThis is supposedly how they were able to crack the earlier gen iPhone previously. But supposedly, Apple has mitigated that type of replay attack in hardware.
- unstatusthequo 7y agoI can still brute force your iTunes backup without a rate limit and distributed in Amazon GPU compute instances. Combine leaked pw databases with smart software (I use Elcomsoft), and you have a fair chance at getting in.
- macintux 7y agoDo many people still perform iTunes backups? I haven’t since iCloud first offered them.