6 ms·

The interesting part is whenever they use the same algorithm for hashing passphrases (there's an option to lock phone using a proper passphrase, not 4-digit pin

The interesting part is whenever they use the same algorithm for hashing passphrases (there's an option to lock phone using a proper passphrase, not 4-digit pin).

nly 13y ago
Good point! Although really, breaking the unlock password on a phone isn't that interesting to an attacker unless the owner has encrypted their phone or, more likely, they suspect the owner uses the same password for other things. I think most people just use face or pattern unlock these days though? Android actually does quite well in this regard: KitKat now uses Scrypt... although both PIN and Face Unlock can still be used with encryption, which very secure. Oddly you can't use pattern.
- blueskin_ 13y ago
  >I think most people just use face or pattern unlock these days though? Most average users, sure. I've seen a couple of family members using face unlock, and many random people and coworkers using patterns. Myself, I use a password.
  - nly 13y ago
    Patterns are terrible. I've clocked a few friends patterns accidentally, let alone actually trying to shoulder surf. Far too visible.
    - blueskin_ 13y ago
      Not to mention when dirty fingers leave pattern-showing streaks on the screen.
    - darklajid 13y ago
      Ah, but it's a matter of what you're trying to protect against. I'm having a number of devices, from 'swipe to unlock' via 'pattern unlock' and full passphrases. My phone uses a lock pattern, because - swipe to unlock would unlock the phone in my pocket. Rare, but happened a number of times - my phone is the one device that consistently lies around the house and gets carried away by my 1.x year old son. Swipe to unlock was very easy to understand... So - pattern aren't secure, agreed. They are just a way to lock the keyboard against accidents and for that they work quite well..
      - e12e 13y ago
        This. Arguably, if you're not using full disk encryption, your adversary is someone that (at least) hasn't entered high school yet... ;-) I'd add that it also does add a bit of "intent" (in the same sense that (quite easily pickable) door locks do -- if your child/friend/coworker unlocks your phone with your pattern, that's clearly crossing a boundary - more so than just looking at your unlocked phone.
    - oftenwrong 13y ago
      If you disable the "Make pattern visible" option, it makes it much harder to shoulder surf the pattern.
      - Fishkins 13y ago
        I don't understand why making the pattern invisible isn't the default. When it's visible, everyone within 20 feet of you can tell your unlock pattern. I wish you could also make failed patterns invisible, but AFAICT there's no option for that. Of course, as others said, if I were really worried I'd use a longer password and disk encryption.
  - drdaeman 13y ago
    Since Samsung's TouchWiz (at least on S4 mini) don't allow to take shots with camera without unlocking the phone (standard AOSP has such feature), I guess many users settle with swipe-to-unlock.
    - blueskin_ 13y ago
      I disabled that feature since it's essentially an easy battery DoS (and can be activated in a pocket).
raverbashing 13y ago
There's also an unlocking pattern, where you must draw a pattern between some circles in a grid. (the difficulty is adjustable, so it can be a 3x3 grid, a 4x4 grid, etc) Not sure how this is stored in the cellphone though.
e12e 13y ago
That, and if the 40-bit hash is used for aes full disk encryption (encrypting the device requires pin or passphrase). And, if full disk encryption uses proper key expansion, why don't the just use the same thing for the pin? (maybe so that if you reuse pins, you couldn't easily get the pin from an unsecured device? But then again, how hard could it be to brute force 10^4 keys, given that the device will need access to the salt before deriving the decryption key anyway? No HSM seems like it has to be a fail here, no matter what...).

The interesting part is whenever they use the same algorithm for hashing passphrases (there's an option to lock phone using a proper passphrase, not 4-digit pin).

nly 13y ago

Good point! Although really, breaking the unlock password on a phone isn't that interesting to an attacker unless the owner has encrypted their phone or, more likely, they suspect the owner uses the same password for other things. I think most people just use face or pattern unlock these days though? Android actually does quite well in this regard: KitKat now uses Scrypt... although both PIN and Face Unlock can still be used with encryption, which very secure. Oddly you can't use pattern.

blueskin_ 13y ago
>I think most people just use face or pattern unlock these days though? Most average users, sure. I've seen a couple of family members using face unlock, and many random people and coworkers using patterns. Myself, I use a password.
- nly 13y ago
  Patterns are terrible. I've clocked a few friends patterns accidentally, let alone actually trying to shoulder surf. Far too visible.
  - blueskin_ 13y ago
    Not to mention when dirty fingers leave pattern-showing streaks on the screen.
  - darklajid 13y ago
    Ah, but it's a matter of what you're trying to protect against. I'm having a number of devices, from 'swipe to unlock' via 'pattern unlock' and full passphrases. My phone uses a lock pattern, because - swipe to unlock would unlock the phone in my pocket. Rare, but happened a number of times - my phone is the one device that consistently lies around the house and gets carried away by my 1.x year old son. Swipe to unlock was very easy to understand... So - pattern aren't secure, agreed. They are just a way to lock the keyboard against accidents and for that they work quite well..
    - e12e 13y ago
      This. Arguably, if you're not using full disk encryption, your adversary is someone that (at least) hasn't entered high school yet... ;-) I'd add that it also does add a bit of "intent" (in the same sense that (quite easily pickable) door locks do -- if your child/friend/coworker unlocks your phone with your pattern, that's clearly crossing a boundary - more so than just looking at your unlocked phone.
  - oftenwrong 13y ago
    If you disable the "Make pattern visible" option, it makes it much harder to shoulder surf the pattern.
    - Fishkins 13y ago
      I don't understand why making the pattern invisible isn't the default. When it's visible, everyone within 20 feet of you can tell your unlock pattern. I wish you could also make failed patterns invisible, but AFAICT there's no option for that. Of course, as others said, if I were really worried I'd use a longer password and disk encryption.
- drdaeman 13y ago
  Since Samsung's TouchWiz (at least on S4 mini) don't allow to take shots with camera without unlocking the phone (standard AOSP has such feature), I guess many users settle with swipe-to-unlock.
  - blueskin_ 13y ago
    I disabled that feature since it's essentially an easy battery DoS (and can be activated in a pocket).

raverbashing 13y ago

There's also an unlocking pattern, where you must draw a pattern between some circles in a grid. (the difficulty is adjustable, so it can be a 3x3 grid, a 4x4 grid, etc) Not sure how this is stored in the cellphone though.

e12e 13y ago

That, and if the 40-bit hash is used for aes full disk encryption (encrypting the device requires pin or passphrase). And, if full disk encryption uses proper key expansion, why don't the just use the same thing for the pin? (maybe so that if you reuse pins, you couldn't easily get the pin from an unsecured device? But then again, how hard could it be to brute force 10^4 keys, given that the device will need access to the salt before deriving the decryption key anyway? No HSM seems like it has to be a fail here, no matter what...).