5 ms·

Powering down was made easy to defeat biometric ID. Hold buttons on both sides of newer phones. Passcode is required to unlock. Passcodes are vulnerable to sh

by k310 3y ago

Powering down was made easy to defeat biometric ID. Hold buttons on both sides of newer phones. Passcode is required to unlock. Passcodes are vulnerable to shoulder surfers, and every now and then iOS will demand one for chuckles. For me, this only happens in crowded stores.

john_the_writer 3y ago
My iphone code is 10 characters long. Just use your grand-mothers phone number as a passcode, complete with the long 1-areacode, and shoulder surfers would be hard pressed.
- ranger_danger 3y ago
  so set it to a thing that three letter agencies are most likely to know already?
  - selcuka 3y ago
    You have worse things to worry about if a three letter agency is after you. This is for the regular police, and they won't even bother.
- k310 3y ago
  My grandmother passed away in the 60's. I still remember her number, and three others from those days. All would serve as passcodes, custom numeric but not custom alphanumeric. Hope that shoulder surfers don't have great memories or video. Bodycams?
- ozim 3y ago
  There’s cameras everywhere, it’s not going to be someone breathing on your neck anymore.
walterbell 3y ago
> Passcodes are vulnerable to shoulder surfers And countless cameras with frame-by-frame playback. Linux: print * to hide password keystrokes BSD: print * to hide password keystrokes Windows: print * to hide password keystrokes Apple iOS: E N L A R G E and INVERT password keystrokes What do stock Android and Graphene show during password entry?
- deleted 3y ago
  [deleted]
- hetman 3y ago
  By default Android is the same but it let's you turn it off. With the lock screen you can reduce feedback to only the password stars appearing and no key highlights. With password elsewhere you can remove the momentary password character preview. The keyboard lets you reduce key press feedback prominence so it's only a momentary flicker (and no character pop up), but there really should be an API to make the keyboard aware it's in "password mode" so you could eliminate feedback entirely.
  - mcsniff 3y ago
    GBoard has "incognito mode" when it's a Chromium incognito window, but unfortunately none of the feedback is disabled and it appears to be deprecated. Pretty crazy that people use keyboards and grant them network/internet access. https://developer.android.com/reference/android/support/v13/view/inputmethod/EditorInfoCompat.html#IME_FLAG_NO_PERSONALIZED_LEARNING https://developer.android.com/reference/android/support/v13/...
deleted 3y ago
[deleted]
arcastroe 3y ago
> Passcodes are vulnerable to shoulder surfers My home door lock has a pretty cool way to counteract this. Here's a picture of what it looks like https://www.digitaltrends.com/wp-content/uploads/2021/07/lockly-duo-smart-lock-lifestyle-2.jpg https://www.digitaltrends.com/wp-content/uploads/2021/07/loc... Every time you press a button, all the numbers shuffle around. Even if someone watches you enter the passcode, they can't be certain of what the password actually was. They do gain some information (the first digit must be either a two, a six, or a nine), but they don't get the full information.
- swores 3y ago
  Having had a bank that did something similar for logging onto their mobile app, annoyance at that feature was the main reason I moved to a different bank. Do you not have the problem I had that the moving around of numbers makes it impossible to use muscle memory and you always need to think about each digit, or do you just have more patience than me and not mind? Maybe the bank's version on my phone was particularly bad and the interface on your lock particularly good? (It was almost a decade ago, I can't actually remember exactly what it looked like / how it worked, just how frustrating it was.)
  - rustcleaner 3y ago
    >or do you just have more patience than me and not mind? This is the case for me (GrapheneOS), and I wouldn't be surprised if it is the case for the GP too...
    - exe34 3y ago
      I completely forgot the pin to a bank card I haven't used in a long while. It occurred to me that humans are mostly just next token predictors anyway, so I pretended I knew the pin, and just got the little machine out, went to my bank page, and started logging in, and when it came the time to type my pin into the machine to get the one time code, I simply remembered the pin while my fingers typed them in.
- cykros 3y ago

by k310 3y ago

john_the_writer 3y ago

My iphone code is 10 characters long. Just use your grand-mothers phone number as a passcode, complete with the long 1-areacode, and shoulder surfers would be hard pressed.

ranger_danger 3y ago
so set it to a thing that three letter agencies are most likely to know already?
- selcuka 3y ago
  You have worse things to worry about if a three letter agency is after you. This is for the regular police, and they won't even bother.
k310 3y ago
My grandmother passed away in the 60's. I still remember her number, and three others from those days. All would serve as passcodes, custom numeric but not custom alphanumeric. Hope that shoulder surfers don't have great memories or video. Bodycams?
ozim 3y ago
There’s cameras everywhere, it’s not going to be someone breathing on your neck anymore.

walterbell 3y ago

> Passcodes are vulnerable to shoulder surfers And countless cameras with frame-by-frame playback. Linux: print * to hide password keystrokes BSD: print * to hide password keystrokes Windows: print * to hide password keystrokes Apple iOS: E N L A R G E and INVERT password keystrokes What do stock Android and Graphene show during password entry?

deleted 3y ago
[deleted]
hetman 3y ago
By default Android is the same but it let's you turn it off. With the lock screen you can reduce feedback to only the password stars appearing and no key highlights. With password elsewhere you can remove the momentary password character preview. The keyboard lets you reduce key press feedback prominence so it's only a momentary flicker (and no character pop up), but there really should be an API to make the keyboard aware it's in "password mode" so you could eliminate feedback entirely.
- mcsniff 3y ago
  GBoard has "incognito mode" when it's a Chromium incognito window, but unfortunately none of the feedback is disabled and it appears to be deprecated. Pretty crazy that people use keyboards and grant them network/internet access. https://developer.android.com/reference/android/support/v13/view/inputmethod/EditorInfoCompat.html#IME_FLAG_NO_PERSONALIZED_LEARNING https://developer.android.com/reference/android/support/v13/...

deleted 3y ago

[deleted]

arcastroe 3y ago

> Passcodes are vulnerable to shoulder surfers My home door lock has a pretty cool way to counteract this. Here's a picture of what it looks like https://www.digitaltrends.com/wp-content/uploads/2021/07/lockly-duo-smart-lock-lifestyle-2.jpg https://www.digitaltrends.com/wp-content/uploads/2021/07/loc... Every time you press a button, all the numbers shuffle around. Even if someone watches you enter the passcode, they can't be certain of what the password actually was. They do gain some information (the first digit must be either a two, a six, or a nine), but they don't get the full information.

swores 3y ago
Having had a bank that did something similar for logging onto their mobile app, annoyance at that feature was the main reason I moved to a different bank. Do you not have the problem I had that the moving around of numbers makes it impossible to use muscle memory and you always need to think about each digit, or do you just have more patience than me and not mind? Maybe the bank's version on my phone was particularly bad and the interface on your lock particularly good? (It was almost a decade ago, I can't actually remember exactly what it looked like / how it worked, just how frustrating it was.)
- rustcleaner 3y ago
  >or do you just have more patience than me and not mind? This is the case for me (GrapheneOS), and I wouldn't be surprised if it is the case for the GP too...
  - exe34 3y ago
    I completely forgot the pin to a bank card I haven't used in a long while. It occurred to me that humans are mostly just next token predictors anyway, so I pretended I knew the pin, and just got the little machine out, went to my bank page, and started logging in, and when it came the time to type my pin into the machine to get the one time code, I simply remembered the pin while my fingers typed them in.
cykros 3y ago