4 ms·

The attacker has physical access to your device ... you have bigger problems to worry about. That being said, just disable the unlock with smart cover and prob

The attacker has physical access to your device ... you have bigger problems to worry about. That being said, just disable the unlock with smart cover and problem solved.

pyre 15y ago
The speed with which the attack can be done is really the key here. This is less an issue of someone stealing your iPad2 and then getting access to your personal data. This is more an issue of someone having physical access for a couple of minutes and being able to get into and out of the device without being detected.
- X-Istence 15y ago
  If they have a smart cover around (if you don't own one), and if you have the "unlock with smartcover" feature enabled.
  - jbri 15y ago
    The feature defaults to enabled. If you don't own a smart cover, would you really look through the options for something like that and change it? Would your Joe Average consumer? An insecure default shouldn't be excused because you can change it - the default configuration should be secure against such an attack.
  - ugh 15y ago
    I think that option isn’t even displayed when you have never used a smartcover with your iPad and it defaults to being turned on. So in order to avoid this bug you would have to own a smartcover (or magnet) and hold it up to the sensor (it’s on the right side of the device) in order to display the option in the settings and only then could you turn it off.
5hoom 15y ago
While the adage "physical access == game over" is definitely true, it's a bit less useful now as more & more devices are portable. Previously, physical access meant someone broke in or fraudulently gained entry to a room where your pc/server lives. Nowadays it means someone grabbed your tablet/smartphone for a minute while you are in the bathroom.
- JoshTriplett 15y ago
  Why would you leave your electronics out while you're in the bathroom? Especially a smartphone---you can just put that in your pocket.
  - DallaRosa 15y ago
    Sure. Try putting the ipad in your pocket.
    - X-Istence 15y ago
      I have never left my iPad lying anywhere, unless it is with friends, and I am not too worried about them getting a peek at my home screen, or my email...
      - nodata 15y ago
        It's not a binary decision. Your e-mail is the key to your entire online (offline too?) identity. I trust my friends but I wouldn't give all of them "me-level" access to my entire life.
      - veidr 15y ago
        I have never left my iPad lying anywhere but the bathroom. (That's the only place I find it actually useful.)
      - Marwy 15y ago
        But there's this little thing called privacy.
nodata 15y ago
> The attacker has physical access to your device ... you have bigger problems to worry about. 1. What bigger problems do I have to worry about? 2. The iPad uses encryption just like the iPhone. Most people won't be able to defeat that encryption, but most people will be able to do this simple on/off hack.
- demallien 15y ago
  2. The iPad uses encryption just like the iPhone. Sure, but the decryption keys are also on the iDevice, otherwise it wouldn't work. Which means that a competent cracker can get access to your data. Not a big issue if all you have is personal stuff (but then, how bad is it if your personal data is compromised), but the gains for bug business espionage could justify the expense of a crack... So yes, the battle is already lost if an attacker physically has your iDevice in their hands. Don't do that. Still, the default setting for the smart cover is clearly a bad security error by Apple - I trust it will be quickly fixed.
  - nodata 15y ago
    Wait a second, you wrote: > The attacker has physical access to your device ... you have bigger problems to worry about. I don't have bigger problems to worry about (or maybe I do - what are they?) Perhaps 1% of thieves can get at my encrypted data, but probably all of them will be able to perform the few steps necessary to bypass the lock screen.
    - demallien 15y ago
      Wait a second, you wrote: Uh, no I didn't ;) Look, the thing is, if you're worried about a casual thief, they probably don't care about your data anyway, they're going to wipe the device clean and resell it. If it is someone that actually stole the device to get the data, then I would expect your '1%' (plucked out of the air, or is there a reference for this kind of statistic - honest question, I'm not snarking) is actually going to be a much higher number, in which case the encryption isn't going to save you. It's pretty much game over once the attacker has their hands on the physical device, afterwards it's just a question of time.
VMG 15y ago
So why bother offering a lock screen at all?

The attacker has physical access to your device ... you have bigger problems to worry about. That being said, just disable the unlock with smart cover and problem solved.

pyre 15y ago

The speed with which the attack can be done is really the key here. This is less an issue of someone stealing your iPad2 and then getting access to your personal data. This is more an issue of someone having physical access for a couple of minutes and being able to get into and out of the device without being detected.

X-Istence 15y ago
If they have a smart cover around (if you don't own one), and if you have the "unlock with smartcover" feature enabled.
- jbri 15y ago
  The feature defaults to enabled. If you don't own a smart cover, would you really look through the options for something like that and change it? Would your Joe Average consumer? An insecure default shouldn't be excused because you can change it - the default configuration should be secure against such an attack.
- ugh 15y ago
  I think that option isn’t even displayed when you have never used a smartcover with your iPad and it defaults to being turned on. So in order to avoid this bug you would have to own a smartcover (or magnet) and hold it up to the sensor (it’s on the right side of the device) in order to display the option in the settings and only then could you turn it off.

5hoom 15y ago

While the adage "physical access == game over" is definitely true, it's a bit less useful now as more & more devices are portable. Previously, physical access meant someone broke in or fraudulently gained entry to a room where your pc/server lives. Nowadays it means someone grabbed your tablet/smartphone for a minute while you are in the bathroom.

JoshTriplett 15y ago
Why would you leave your electronics out while you're in the bathroom? Especially a smartphone---you can just put that in your pocket.
- DallaRosa 15y ago
  Sure. Try putting the ipad in your pocket.
  - X-Istence 15y ago
    I have never left my iPad lying anywhere, unless it is with friends, and I am not too worried about them getting a peek at my home screen, or my email...
    - nodata 15y ago
      It's not a binary decision. Your e-mail is the key to your entire online (offline too?) identity. I trust my friends but I wouldn't give all of them "me-level" access to my entire life.
    - veidr 15y ago
      I have never left my iPad lying anywhere but the bathroom. (That's the only place I find it actually useful.)
    - Marwy 15y ago
      But there's this little thing called privacy.

nodata 15y ago

> The attacker has physical access to your device ... you have bigger problems to worry about. 1. What bigger problems do I have to worry about? 2. The iPad uses encryption just like the iPhone. Most people won't be able to defeat that encryption, but most people will be able to do this simple on/off hack.

demallien 15y ago
2. The iPad uses encryption just like the iPhone. Sure, but the decryption keys are also on the iDevice, otherwise it wouldn't work. Which means that a competent cracker can get access to your data. Not a big issue if all you have is personal stuff (but then, how bad is it if your personal data is compromised), but the gains for bug business espionage could justify the expense of a crack... So yes, the battle is already lost if an attacker physically has your iDevice in their hands. Don't do that. Still, the default setting for the smart cover is clearly a bad security error by Apple - I trust it will be quickly fixed.
- nodata 15y ago
  Wait a second, you wrote: > The attacker has physical access to your device ... you have bigger problems to worry about. I don't have bigger problems to worry about (or maybe I do - what are they?) Perhaps 1% of thieves can get at my encrypted data, but probably all of them will be able to perform the few steps necessary to bypass the lock screen.
  - demallien 15y ago
    Wait a second, you wrote: Uh, no I didn't ;) Look, the thing is, if you're worried about a casual thief, they probably don't care about your data anyway, they're going to wipe the device clean and resell it. If it is someone that actually stole the device to get the data, then I would expect your '1%' (plucked out of the air, or is there a reference for this kind of statistic - honest question, I'm not snarking) is actually going to be a much higher number, in which case the encryption isn't going to save you. It's pretty much game over once the attacker has their hands on the physical device, afterwards it's just a question of time.

VMG 15y ago

So why bother offering a lock screen at all?