3 ms·

So the key is derived from passcode? isn't that 5 digits that are easy to brute force?

tzs 12y ago
5 digits would be easy. It would take a little over an hour on average. However, passcodes are not limited to digits. Use upper and lower case letters and digits, and then a 5 character passcode would on average a little over a year. Make it 6 characters, and that's 72 years.
- ghshephard 12y ago
  I'm guessing based on my observations of 40-50 people entering Passcode, that north of 90% of people who bother to use a Passcode (or care to) - use a 4 digit pin. Even those who are super security conscious tend to just use numeric PINs. It's the very, very rare individual who enters an alphanumeric passcode.
deleted 12y ago
[deleted]
- comex 12y ago
  > Also, it's my understanding that authentication can be trivially bypassed if the phone is kept powered on? (ie. authentication data is stored in memory? Seems to be the case for at least Touch ID) It can be bypassed if the phone is kept powered on -and someone is able to start running code on it-. The normal approach of Apple signing a malicious recovery/update image would require rebooting first; there are probably exploits to be found somewhere, but Apple probably doesn't have any intentional mechanism for running code without either rebooting or unlocking the phone (at which point a lot more services open up including developer tools, etc.). Also, Touch ID expires after a while, and (edit: I said the key is probably wiped, but that makes no sense if the phone continues to display contact names and such on the lock screen; there may be details in Apple's white paper, but since I don't remember any, disregard.)
  - micampe 12y ago
    Contact names are not displayed in the lock screen until the first unlock (new in iOS 8). Notice how now all devices, not only ones with Touch ID, say that your phone needs to be unlocked for full functionality after a reboot.

tzs 12y ago

5 digits would be easy. It would take a little over an hour on average. However, passcodes are not limited to digits. Use upper and lower case letters and digits, and then a 5 character passcode would on average a little over a year. Make it 6 characters, and that's 72 years.

ghshephard 12y ago
I'm guessing based on my observations of 40-50 people entering Passcode, that north of 90% of people who bother to use a Passcode (or care to) - use a 4 digit pin. Even those who are super security conscious tend to just use numeric PINs. It's the very, very rare individual who enters an alphanumeric passcode.

deleted 12y ago

[deleted]

comex 12y ago
> Also, it's my understanding that authentication can be trivially bypassed if the phone is kept powered on? (ie. authentication data is stored in memory? Seems to be the case for at least Touch ID) It can be bypassed if the phone is kept powered on -and someone is able to start running code on it-. The normal approach of Apple signing a malicious recovery/update image would require rebooting first; there are probably exploits to be found somewhere, but Apple probably doesn't have any intentional mechanism for running code without either rebooting or unlocking the phone (at which point a lot more services open up including developer tools, etc.). Also, Touch ID expires after a while, and (edit: I said the key is probably wiped, but that makes no sense if the phone continues to display contact names and such on the lock screen; there may be details in Apple's white paper, but since I don't remember any, disregard.)
- micampe 12y ago
  Contact names are not displayed in the lock screen until the first unlock (new in iOS 8). Notice how now all devices, not only ones with Touch ID, say that your phone needs to be unlocked for full functionality after a reboot.