2 ms·

My understanding is that this and similar techniques don't get you back into the before first unlock (BFU) state. To do that as far as I know you have to shut d

My understanding is that this and similar techniques don't get you back into the before first unlock (BFU) state. To do that as far as I know you have to shut down the device. Otherwise--even if locked--your phone will be in the after first unlock (AFU) state. I believe that in the AFU state considerably more of the system is decrypted and accessible than in the much more limited BFU state. Maybe someone with more knowledge can chime in here.

fragmede 9mo ago
You used to be able to ask Siri "who am I", and it would lock out biometrics, but they removed that feature and I don't know why.
retsl 9mo ago
This is true but there's automatic restart which will automatically restart the phone to get it back into BFU state: > Automatic Restart is a security mechanism in iOS 18.1 iPadOS 18.1 and or later that leverages the Secure Enclave to monitor device unlock events. If a device remains locked for a prolonged period, it automatically restarts, transitioning from an After First Unlock state to a Before First Unlock state. During the restart, the device purges sensitive security keys and transient data from memory. https://help.apple.com/pdf/security/en_US/apple-platform-security-guide.pdf https://help.apple.com/pdf/security/en_US/apple-platform-sec... > [...] inactivity reboot triggers exactly after 3 days (72 hours). [...] https://naehrdine.blogspot.com/2024/11/reverse-engineering-ios-18-inactivity.html https://naehrdine.blogspot.com/2024/11/reverse-engineering-i... GrapheneOS also has this (https://grapheneos.org/features#auto-reboot https://grapheneos.org/features#auto-reboot) with a default of 18 hours. Maybe one could try to force restart (https://support.apple.com/en-gb/guide/iphone/iph8903c3ee6/ios https://support.apple.com/en-gb/guide/iphone/iph8903c3ee6/io...) to quickly get to BFU. But I could imagine that it'd be hard to remember and then execute the right steps in a stressful situation.

fragmede 9mo ago

You used to be able to ask Siri "who am I", and it would lock out biometrics, but they removed that feature and I don't know why.

retsl 9mo ago

This is true but there's automatic restart which will automatically restart the phone to get it back into BFU state: > Automatic Restart is a security mechanism in iOS 18.1 iPadOS 18.1 and or later that leverages the Secure Enclave to monitor device unlock events. If a device remains locked for a prolonged period, it automatically restarts, transitioning from an After First Unlock state to a Before First Unlock state. During the restart, the device purges sensitive security keys and transient data from memory. https://help.apple.com/pdf/security/en_US/apple-platform-security-guide.pdf https://help.apple.com/pdf/security/en_US/apple-platform-sec... > [...] inactivity reboot triggers exactly after 3 days (72 hours). [...] https://naehrdine.blogspot.com/2024/11/reverse-engineering-ios-18-inactivity.html https://naehrdine.blogspot.com/2024/11/reverse-engineering-i... GrapheneOS also has this (https://grapheneos.org/features#auto-reboot https://grapheneos.org/features#auto-reboot) with a default of 18 hours. Maybe one could try to force restart (https://support.apple.com/en-gb/guide/iphone/iph8903c3ee6/ios https://support.apple.com/en-gb/guide/iphone/iph8903c3ee6/io...) to quickly get to BFU. But I could imagine that it'd be hard to remember and then execute the right steps in a stressful situation.