5 ms·

Isn't numeric passcode the default fallback to biometrics that millions of users use? Also, isn't it supposed to be safer than FaceID or TouchID? Apparently Gr

Isn't numeric passcode the default fallback to biometrics that millions of users use? Also, isn't it supposed to be safer than FaceID or TouchID? Apparently GrayKey can't crack long passwords, since it's essentially brute-forcing, but almost everyone I know uses a four-digit code. Also, this is troublesome because in the US, we're told that cops can force you to hand over your fingerprint but not your passcode. It's a bit problematic if those passcodes are easy to crack.

deleted 7y ago
[deleted]
thenewnewguy 7y ago
4 digit codes are obviously easy to crack. That's a pathetically low number of combinations.
- matthewmacleod 7y ago
  This isn’t really obvious. While there are clearly a limited number of codes with four digits, the idea is that the Secure Enclave can throttle and limit cracking attempts to the point that an attack would be infeasible.
  - hanniabu 7y ago
    Does the timeout between attempts increase with each failed attempt?
    - saagarjha 7y ago
      Normally, yes: https://support.apple.com/guide/security/passcodes-sec20230a10d/1/web/1 https://support.apple.com/guide/security/passcodes-sec20230a...
- jackson1way 7y ago
  Just checked. The default passcode on my iPhone 8 is a 6 digit numeric code, not 4. although you can switch to 4 it seems. Even 4 digits could be enough, given that iOS enforces (very long) delays after a few failed attempts.
  - suprfnk 7y ago
    > given that iOS enforces (very long) delays after a few failed attempts. This is, apparently, the thing that GrayKey is able to bypass.
wahern 7y ago
> Also, this is troublesome because in the US, we're told that cops can force you to hand over your fingerprint but not your passcode. It's not settled law that you can't be compelled to provide a passcode. In general, the 5th Amendment prohibits compelled testimony that is incriminating. Disclosing a password to your own phone is usually not per se incriminating. Contrast that with disclosing a password to a device you're accused of hacking, where showing knowledge of the password is evidence of guilt. Many (most?) courts haven't yet been prepared to defend such a fine distinction, and seem to be more comfortable with a simpler rule that prohibits compelling password disclosure, period. But that could easily change, especially at the Supreme Court.
- Angostura 7y ago
  > Disclosing a password to your own phone is usually not per se incriminating That's why my passcode is always "I murdered her, officer".
  - croon 7y ago
    Better to go for "them" to cover twice (or more in case of multiple) as many situations.
- newnewpdro 7y ago
  My understanding is that it's settled law that Americans have the right to remain silent unconditionally.
  - gnopgnip 7y ago
    It is not that straightforward. Generally you cannot be compelled to testify against yourself. But you can be legally compelled to perform certain actions, and held in contempt if you fail to do so. Whether or not disclosing a password is self incrimination, or something you are required to provide is an actively changing area of the law.
    - mcny 7y ago

deleted 7y ago

[deleted]

thenewnewguy 7y ago

4 digit codes are obviously easy to crack. That's a pathetically low number of combinations.

matthewmacleod 7y ago
This isn’t really obvious. While there are clearly a limited number of codes with four digits, the idea is that the Secure Enclave can throttle and limit cracking attempts to the point that an attack would be infeasible.
- hanniabu 7y ago
  Does the timeout between attempts increase with each failed attempt?
  - saagarjha 7y ago
    Normally, yes: https://support.apple.com/guide/security/passcodes-sec20230a10d/1/web/1 https://support.apple.com/guide/security/passcodes-sec20230a...
jackson1way 7y ago
Just checked. The default passcode on my iPhone 8 is a 6 digit numeric code, not 4. although you can switch to 4 it seems. Even 4 digits could be enough, given that iOS enforces (very long) delays after a few failed attempts.
- suprfnk 7y ago
  > given that iOS enforces (very long) delays after a few failed attempts. This is, apparently, the thing that GrayKey is able to bypass.

wahern 7y ago

> Also, this is troublesome because in the US, we're told that cops can force you to hand over your fingerprint but not your passcode. It's not settled law that you can't be compelled to provide a passcode. In general, the 5th Amendment prohibits compelled testimony that is incriminating. Disclosing a password to your own phone is usually not per se incriminating. Contrast that with disclosing a password to a device you're accused of hacking, where showing knowledge of the password is evidence of guilt. Many (most?) courts haven't yet been prepared to defend such a fine distinction, and seem to be more comfortable with a simpler rule that prohibits compelling password disclosure, period. But that could easily change, especially at the Supreme Court.

Angostura 7y ago
> Disclosing a password to your own phone is usually not per se incriminating That's why my passcode is always "I murdered her, officer".
- croon 7y ago
  Better to go for "them" to cover twice (or more in case of multiple) as many situations.
newnewpdro 7y ago
My understanding is that it's settled law that Americans have the right to remain silent unconditionally.
- gnopgnip 7y ago
  It is not that straightforward. Generally you cannot be compelled to testify against yourself. But you can be legally compelled to perform certain actions, and held in contempt if you fail to do so. Whether or not disclosing a password is self incrimination, or something you are required to provide is an actively changing area of the law.
  - mcny 7y ago