4 ms·

I've often wondered why Apple won't allow you to enter a 4 digit PIN with your touch ID. I would think that two-factor is better than just a thumbprint.

cjunky 12y ago
I completely agree. While two factor auth is probably overkill for just unlocking a device to many people, I would like to at least have the option. One of my concerns is that if your device is ever taken by an organization that has the ability to command your fingerprints then they can quite easily unlock your device negating any encryption. Also while I think its unlikely right now for criminals to make fake fingerprints in order to steal financial transactions, its a flaw and ApplePay is going to financially motivate those criminals to look into ways to refine the process and make it easier to do.
- tillinghast 12y ago
  I would surmise that this is because Apple relies upon the PIN as a failsafe in the event that the Touch ID sensor can't / won't read your fingerprint. Let's say you only have your right thumbprint scanned and you injure it to the extent that it's no longer recognizable to the Touch ID sensor—what then? Two-factor authentication would need to rely upon a much more reliable criteria than Touch ID.
  - cjunky 12y ago
    You could always set up one pin/passcode for two factor auth and then use a separate passphrase as a fallback to unlock the device. It woould be much better security that way. Also while we are on the subject using a short pincode to unlock the device is asking for trouble. While the device ID is tied to the decryption and there is no way to extract it yet I have no confidence that it will remain that way forever. At which point the ability to crack a short pin off the device means the pin will get cracked in seconds.
- pilif 12y ago
  Turn your phone off before crossing a border. Put the wrong finger on the sensor five times in quick succession when you are asked to hand over your phone and you don't get a chance to turn it off. In both cases, the phone will require a passphrase for unlocking (if you configure one as opposed to just a simple code, of course). Having a really long passphrase and the ability to very quickly render the fingerprint reader useless is a huge improvement in security over previous touchid-less phones. Having to both type a code and using my fingerprint (in that case, in addition to a very long passphrase, which would be difficult to explain to users how that works) would be very annoying, at least for me.
  - ghshephard 12y ago
    Pin, not a passphrase. Just switching to a 4 digit pin would be heaven for me (I have an iPhone 5) - I would have zero problem entering touchID + a 4 digit pin.
  - r00fus 12y ago
    Even simply disabling "simple passcode" and using an equivalently simple alphanumeric passcode makes the task a lot more difficult for the brute-force cracker. In fact, if you look at one of the cracking tools that law enforcement is known to use [1], iOS8 looks to have made things more difficult: "iOS 8 Currently under version 4.0 Advanced logical extraction will extract less data compare to previous iOS versions." [1] http://releases.cellebrite.com/releases/ufed-release-notes-4-0.html http://releases.cellebrite.com/releases/ufed-release-notes-4...
- ghshephard 12y ago
  The idea would be multi-level protection: Short period of time - touchid to unlock. Medium period of time (adjustable) - touchID+Pin Long period of time - (adjustable) - passcode Different people could set the values as appropriate. For me, it would be < 5 minutes touch ID, < 1 hours touchID+Pin, > 1 hours passcode.
  - cjunky 12y ago
    completely agree!
rdl 12y ago
I've asked for this repeatedly. (if it's numeric, it doesn't really matter how long it is, IMO -- I can do an 8+-digit PIN pretty fast) The nice thing is iOS 8 seems to encourage people to use alphanumeric passcodes by default. This is a big change. I guess they're pushing people to touchid primary, complex passphrase backup, vs. making touchid or numeric passcode the same.
gress 12y ago
Do you seriously believe that someone is going to clone your fingerprint and attempt to unlock your phone with it?
- cjunky 12y ago
  if someone has your phone and the ability to acquire/demand your fingerprints do you seriously think they arent? I agree that its only likely as a targeted attack though. This isn't the sort of thing you will see street criminals doing.
  - gress 12y ago
    If someone has your phone and the ability to demand your fingerprints, what possible value is an additional 4-digit pin going to be?
    - cjunky 12y ago
      a four digit pin? not much. A strong passphrase? quite a lot actually. It means they cant get access to your data without your cooperation.
      - bruceboughton 12y ago
        But they can get your fingerprints without your co-operation? Faster than you can lock the device from iCloud/Find my iPhone?
        cjunky 12y ago
        That depends on who and why. A skilled person or organization yes. Obtaining the latent prints probably isn't the hard part, I imagine stealing someones trash would be enough for that. The tricky part is making a clone accurate and detailed enough that it works in less than 6 attempts.
deedubaya 12y ago
After restarting the phone, you're required to enter the pin as well.
deleted 12y ago
[deleted]
archagon 12y ago
Because people are going to turn it on without thinking, forget their passcode, and get locked out of all their personal information without any recourse. Given Apple's size, they have to target the majority, not the tech-savvy minority. I really think it's as simple as that. EDIT: Oops, that's not right — the PIN by itself (or in conjunction with TouchID) still has that property. I meant it the other way around: Apple probably wants to make sure that the TouchID sensor is reliable enough to never lock people out, because if even one person has that problem, they won't be able to recover their data. Right now, the PIN is a failsafe; with TouchID/PIN, if TouchID fails, there isn't one.
- jackgavigan 12y ago
  If they forget their passcode today, they'll be locked out the next time they restart their iPhone.
  - archagon 12y ago
    Oh, err, yeah, you're right. I wasn't thinking when I posted. :/
- rdl 12y ago
  Then you have a recovery password based on "enter your iTunes password" or a device password. Or, worst case, erase the device and restore from iCloud backup, but iTunes password as backup seems more than adequate. The objective should be PIN+fpr for routine use, and a longer password when that doesn't work (or on system boot). I'd be fine with PIN || fpr sometimes when it's even lower risk (e.g. when connected to your home wifi).

cjunky 12y ago

I completely agree. While two factor auth is probably overkill for just unlocking a device to many people, I would like to at least have the option. One of my concerns is that if your device is ever taken by an organization that has the ability to command your fingerprints then they can quite easily unlock your device negating any encryption. Also while I think its unlikely right now for criminals to make fake fingerprints in order to steal financial transactions, its a flaw and ApplePay is going to financially motivate those criminals to look into ways to refine the process and make it easier to do.

tillinghast 12y ago
I would surmise that this is because Apple relies upon the PIN as a failsafe in the event that the Touch ID sensor can't / won't read your fingerprint. Let's say you only have your right thumbprint scanned and you injure it to the extent that it's no longer recognizable to the Touch ID sensor—what then? Two-factor authentication would need to rely upon a much more reliable criteria than Touch ID.
- cjunky 12y ago
  You could always set up one pin/passcode for two factor auth and then use a separate passphrase as a fallback to unlock the device. It woould be much better security that way. Also while we are on the subject using a short pincode to unlock the device is asking for trouble. While the device ID is tied to the decryption and there is no way to extract it yet I have no confidence that it will remain that way forever. At which point the ability to crack a short pin off the device means the pin will get cracked in seconds.
pilif 12y ago
Turn your phone off before crossing a border. Put the wrong finger on the sensor five times in quick succession when you are asked to hand over your phone and you don't get a chance to turn it off. In both cases, the phone will require a passphrase for unlocking (if you configure one as opposed to just a simple code, of course). Having a really long passphrase and the ability to very quickly render the fingerprint reader useless is a huge improvement in security over previous touchid-less phones. Having to both type a code and using my fingerprint (in that case, in addition to a very long passphrase, which would be difficult to explain to users how that works) would be very annoying, at least for me.
- ghshephard 12y ago
  Pin, not a passphrase. Just switching to a 4 digit pin would be heaven for me (I have an iPhone 5) - I would have zero problem entering touchID + a 4 digit pin.
- r00fus 12y ago
  Even simply disabling "simple passcode" and using an equivalently simple alphanumeric passcode makes the task a lot more difficult for the brute-force cracker. In fact, if you look at one of the cracking tools that law enforcement is known to use [1], iOS8 looks to have made things more difficult: "iOS 8 Currently under version 4.0 Advanced logical extraction will extract less data compare to previous iOS versions." [1] http://releases.cellebrite.com/releases/ufed-release-notes-4-0.html http://releases.cellebrite.com/releases/ufed-release-notes-4...
ghshephard 12y ago
The idea would be multi-level protection: Short period of time - touchid to unlock. Medium period of time (adjustable) - touchID+Pin Long period of time - (adjustable) - passcode Different people could set the values as appropriate. For me, it would be < 5 minutes touch ID, < 1 hours touchID+Pin, > 1 hours passcode.
- cjunky 12y ago
  completely agree!

rdl 12y ago

I've asked for this repeatedly. (if it's numeric, it doesn't really matter how long it is, IMO -- I can do an 8+-digit PIN pretty fast) The nice thing is iOS 8 seems to encourage people to use alphanumeric passcodes by default. This is a big change. I guess they're pushing people to touchid primary, complex passphrase backup, vs. making touchid or numeric passcode the same.

gress 12y ago

Do you seriously believe that someone is going to clone your fingerprint and attempt to unlock your phone with it?

cjunky 12y ago
if someone has your phone and the ability to acquire/demand your fingerprints do you seriously think they arent? I agree that its only likely as a targeted attack though. This isn't the sort of thing you will see street criminals doing.
- gress 12y ago
  If someone has your phone and the ability to demand your fingerprints, what possible value is an additional 4-digit pin going to be?
  - cjunky 12y ago
    a four digit pin? not much. A strong passphrase? quite a lot actually. It means they cant get access to your data without your cooperation.
    - bruceboughton 12y ago
      But they can get your fingerprints without your co-operation? Faster than you can lock the device from iCloud/Find my iPhone?
      - cjunky 12y ago
        That depends on who and why. A skilled person or organization yes. Obtaining the latent prints probably isn't the hard part, I imagine stealing someones trash would be enough for that. The tricky part is making a clone accurate and detailed enough that it works in less than 6 attempts.

deedubaya 12y ago

After restarting the phone, you're required to enter the pin as well.

deleted 12y ago

[deleted]

archagon 12y ago

Because people are going to turn it on without thinking, forget their passcode, and get locked out of all their personal information without any recourse. Given Apple's size, they have to target the majority, not the tech-savvy minority. I really think it's as simple as that. EDIT: Oops, that's not right — the PIN by itself (or in conjunction with TouchID) still has that property. I meant it the other way around: Apple probably wants to make sure that the TouchID sensor is reliable enough to never lock people out, because if even one person has that problem, they won't be able to recover their data. Right now, the PIN is a failsafe; with TouchID/PIN, if TouchID fails, there isn't one.

jackgavigan 12y ago
If they forget their passcode today, they'll be locked out the next time they restart their iPhone.
- archagon 12y ago
  Oh, err, yeah, you're right. I wasn't thinking when I posted. :/
rdl 12y ago
Then you have a recovery password based on "enter your iTunes password" or a device password. Or, worst case, erase the device and restore from iCloud backup, but iTunes password as backup seems more than adequate. The objective should be PIN+fpr for routine use, and a longer password when that doesn't work (or on system boot). I'd be fine with PIN || fpr sometimes when it's even lower risk (e.g. when connected to your home wifi).