5 ms·
There are some tell-take signs that this is a cursory inspection by soemone who is not familiar with the iOS security environment. Firstly, the statement that
by gress 12y ago
There are some tell-take signs that this is a cursory inspection by soemone who is not familiar with the iOS security environment.
Firstly, the statement that the passcode is only 4-digits. Not knowing that this can optionally be switched to a far longer string, and that this option can be mandated by policy in secure environment, is an indication that the author is making his inference just by looking at the GUI.
Also, whilst it's true that the passcode can be brute forced, this must be done on-device and so requires a non-trivial rig (which even then will be encumbered by the work required for each try), or a many-hour manual attack.
The link-bait title is another tell-tale.
- smackfu 12y agoI think you might have read this article a bit too quickly. It's about apps using TouchID to protect access to the app on an unlocked phone, and whether that is worthwhile or a false sense of security. The passcode in question is a dropbox one that is distinct from the system-level iOS one.
- borski 12y agoHe is referring to the Dropbox passcode. You are referring to the Apple passcode.
- Sephiroth87 12y agoWell, yes and no, the fallback for TouchID must be handled in app and is not related to the pin you use to unlock the device. Most app I've seen use the same 4 digit pin format, but nothing is stopping them to ask for a full password... Also, there's a pretty good keychain API to handle encryption, and you shouldn't need to derive any key from any password to safely encrypt stuff... For me, it's not really a problem with the TouchID implementation, but with each developer knowing what they are dealing with...
- gfodor 12y agoA 4-digit passcode cannot be brute forced if the application is dependent upon an external service. After N bad attempts, lock the user (which I'm sure dropbox does.)
- potatolicious 12y agoThe default lockscreen passcode works the same way. After several attempts it will lock the phone and prevent further access for some time. Brute forcing a PIN on iOS is not particularly practical in the same way brute forcing auth via a script isn't practical (so long as the system wasn't designed by idiots).
- gfodor 12y agoSure, my point is just that a server-side check is immune to attack (assuming the server is not compromised.) A client-side check is subject to other exploits allowing the attacker to get around it. Either way, you're right, it's pretty much a given that brute forcing a 4-digit passcode in iOS is far from easy, regardless of context if the developer knows what they are doing.