4 ms·

Since the phone is covered in the password anyway, it would be interesting to see if it stands up to a gummi bear attack: http://www.theregister.co.uk/2002/05/

• marvin 13y ago
  Have we seen this fingerprint reader yet? IBM/Lenovo ThinkPads use a reader that's just a tiny strip, so you actually have to swipe your finger instead of just planting it on the reader. This at the very least defends against simple attacks. But I mean, a fingerprint is a physical thing which can be cloned, just like a key. And you also leave prints everywhere you go. It's not a silver bullet in authentication. All else being equal, passwords are safer against a determined attack, if we can assume correct usage.
  • sjwright 13y ago
    Anyone who wants to go to that amount of trouble will find brute-forcing 10,000 possible pin codes to be just as easy.
    • jonknee 13y ago
      Not when the data erases after a low number of misses.
      • kevinwallace 13y ago
        The data doesn't erase itself. The phone, in its original state, erases its copy of the data, but that doesn't help if you're operating with (a) a copy of the data, or (b) a modified phone, which is likely given an adversary that doesn't find cracking 10,000 PIN combinations to be a significant hurdle. In particular, tools automating (b) already exist: http://gizmodo.com/5896992/the-xry-cracking-tool-is-unimpressed-with-your-iphones-defenses http://gizmodo.com/5896992/the-xry-cracking-tool-is-unimpres...
        • hexley 13y ago
          Actually, the data is encrypted firstly with a per-device key that is unique to the phone and unable to be accessed directly (unless you want to go decapping chips), then additionally with a hash of your pin or password. A copy of the data is useless unless you can get to it in an already unlocked state. An erase firstly deletes the encryption key entirely then begins a secure erase in the background.