5 ms·
Who was smart enough to implement rate limiting there, but not an exponential lockout period?
by jackric 5y ago
Who was smart enough to implement rate limiting there, but not an exponential lockout period?
- bildung 5y agoThe probable standard answer for every large organization: Those were the responsibilities of different teams.
- vxNsr 5y agoThey did, the exploit here is shutting down the phone before it has a chance to log there was a password attempt.
- TwoBit 5y agoDoesn't that apply only to older phones?
- Scoundreller 5y agoSomeone who never got DDoS’d by their own app after their server went down, that’s who.
- dylan604 5y agoHaven't there been stories of parent's losing their phones because their kids randomly entering in passcodes forced the exponential time outs to be into the years (and longer) time frames?
- alias_neo 5y agoI can see it happening. My 1.5 year old daughter routinely locks me out of my phone by touching the in-screen fingerprint reader when she takes my phone from the desk or wherever it's lying around at home. I have a password the maximum length allowed so it's not trivial to unlock when she does that.
- FearlessNebula 5y agoReset the phone and restore from backup
- russh 5y agoNot possible, it is now a paper weight. Found this out when a disgruntled employee “forgot” the passcodes to several devices before quitting.
- tinus_hn 5y agoThat happens when you can’t access the Apple account that has the activation lock for the device. You don’t need the device passcode to reinstall it.
- dylan604 5y agoSeems like it would be safer to enable wipe device after 10 wrong entries than allowing the exponential time out to increase
- spideymans 5y agoThe lockout period progresses something like 60 seconds, 5 minutes, 30 minutes, 1 hour, 3 hours, 6 hours, 1 day and so on. This should only be possible if the child had sole possession of the phone for days. Not saying it’s impossible, but this appears to be an extreme edge case. I suspect most of these reports come from either bugs in the software (and some quick Googling suggests this has been the case), or perhaps that even someone (heck, even a savvy child) was trying using some sort of brute force exploit to unlock the phone.
- astrange 5y agoMy phone once entered permanent lockout because I left it upside down on a surface that registered a passcode button press every few minutes.