I treat pins/pattern as a way to keep casual pranksters and nosey people out of my phone, not as a real "security measure" in the typical sense.
If I wanted actual security I would be using a full blown password and full drive encryption (both supported by Android).
But then I'd have to turn off all my toys like sync, USB debugging, and unsigned package installation. Which I don't want to do. So therefore I just take my phone being relative insecure as a given, and try to keep out the casual pranksters and or nosey people.
Sync doesn't introduce a security issue. Neither does unsigned package installation, as long as you don't install a package that introduces a security hole.
USB debugging is obviously a huge security issue, but you can have USB connections not work with the phone locked, such that you have to enter the password and unlock the phone before you can attach.
The real security problem: remote package installation, which Android allows without prompting for anyone signed into your Google account. So, that reduces the security of your full-disk-encrypted phone to that of your Google account, if you tie your phone to a Google account. You can avoid that by not using a Google account, but that means no Play store.
Smoke detectors are not a real personnel "safety measure", If I wanted real fire safety I'd make everyone wear fire proof exoskeletons equipped with fire extinguishers...
PINs are some of the best security devices we have when implemented right, they work great in eg. EMV payment cards. Passwords/phrases just aren't practical without keyboards when the use case require frequent and low barrier unlocking.
It looked like they did. If you watch the video, it starts with "1234" then goes to "0000" and others with no discernible order, other than the fact that they are common choices.
Windows Phone 8 locks for 1 minute after 5 wrong guesses and then doubles every wrong guess after that. So the 6th wrong guess is 2 minutes, the 7th is 4 minutes, etc.
But what if someone picks up your phone at a party while you're just a few feet away, and they decide to be a dick? It would take them just a minute to erase all your data.
If they are worried about bad guys deleting all their data, they should stop leaving their phone around at parties. Getting their phone stolen is an even worse outcome, because the data is effectively deleted and the hardware is gone. And it's strictly easier than stealing the phone, deleting the data, and returning the phone, which is what the ggp comment was suggesting we worry about.
Article is down, but if this is what I think it is... iPhones start increasing the time between allowed guesses geometrically after a few wrong ones, so this wouldn't actually work.
From the article (which is back up now, it seems):
> Not all phones are as susceptible to the R2B2's cracking. Apple's iOS, for example, increases the time between PIN attempts after each incorrect guess. But there is only 30 seconds delay after every five wrong guesses in Android phone
Then after the 30 second delay, if you guess wrong again, it goes up to around 5 minutes. The same happens repeatedly and it can get up to a few hours. I tried on an old iPod touch and got it up to around 4 hours.
However, it can be circumvented by restarting the phone.
Escalating to a stronger password after 5 failed attempts seems like a good measure which would got a long way to nullifying this sort of brute force attack.
How does logging into the Google account work if the phone is in Airplane mode or whatever where there will be no data connection?
Personally, I'd like the option to set an unlock pin that's weaker than my disk encryption password, and prompt for my disk encryption password (rather than a Google account) if I fail the pin a couple of times.
You can also set a proper password on the iPhone (and presumably Android). You should probably have one of these safeguards set up if your phone has unfettered access to your email, social networks, contacts etc.
I think it was Feynman who figured out that most combination locks actually have a +/- 1 digit slop on the dial. Between that and peoples' habit of leaving the last digit of the combination set, and you can open it in no more than 25*25=625 attempts for a 50-digit dial.
I wonder how much the less versatile C3BO version costs to build. It seems to me that you could use a cheap MC, a grid of 10 solenoids, and a simple light sensor to build a version that would work on most touch screens and not have to deal with the hassle of building a 2D plotter, integrating a webcam, and controlling it with a relatively expensive Arduino.
Because of the last time a 3d printed cracker bot tried to hack my phone, I now use Android's text password option instead of a pin. Combined with the Swype keyboard, it's actually much easier to unlock my phone than before. You get the ease of the pattern unlock with many more possible permutations.
You can switch to using a more complex password on iOS for extra security. On Android pattern unlock would be the obvious solution.
Also 20 hours should give you enough time to track down a device using Find My iPhone (or similar service) before they can unlock it and shut tracking down.
>Also 20 hours should give you enough time to track down a device using Find My iPhone (or similar service) before they can unlock it and shut tracking down.
Couldn't you just put this whole operation in a faraday cage to bypass that?
That assumes you can go directly from any spot to any other spot, which you can't. Given a grid that looks like this:
123
456
789
you can't go directly from 1 to 3 unless 2 has been selected. I also don't think you can immediately backtrack, as in 213; you have to go 2513, for instance.
With that in mind, I wrote a quick search:
Adjacent only (can't go from 1 to 6 or 8)
1 9
2 40
3 160
4 496
5 1208
6 2240
7 2984
8 2384
9 784
total: 10305
total with length >= 4: 10096
Non-adjacent (knight-moves) allowed (can go from 1 to 6 or 8)
1 9
2 56
3 304
4 1400
5 5328
6 16032
7 35328
8 49536
9 32256
total: 140249
total with length >= 4: 139880
Pass through previous spots, no immediate backtracking (2513 but not 213)
1 9
2 56
3 304
4 1464
5 6136
6 21344
7 57184
8 105376
9 100928
total: 292801
total with length >= 4: 292432
Pass through previous spots, with immediate backtracking allowed (213)
1 9
2 56
3 320
4 1624
5 7152
6 26016
7 72912
8 140704
9 140704
total: 389497
total with length >= 4: 389112
So, I believe the correct number is 292432. For comparison, that's less secure than a 6-digit PIN, or a 4-lowercase-letter password.
More importantly, though, if you're using an unlock pattern, you can't be using disk encryption, so anyone who has physical possession of your phone need not bother brute-forcing the unlock pattern.
You can do that with Android, too. It's actually right there in the list with the PIN and pattern locks. I think it has been there at least since Gingerbread, maybe earlier.
I had some coworkers who had their iPads wiped by their children because of this. They didn't even know the feature existed or was turned on (turned on when they connected their work email) so they were pretty annoyed by it.
After 5 tries they should make you do some task like drawing a line or sliding a button to allow you to do the second 5 tries, so that random button mashing doesn't wipe your phone.
Android phones, and possibly iPhones as well, have multiple options for screen locks, one of which is a pin. That said, it will block pin entry after a set amount of failures after which you have to wait a set amount of time or log in with your Google account. I imagine the wait time scales if you continue guessing, rendering this bot quite useless.
But in the phone’s lockscreen, you are usually not bound by the 4-digit requirement of SIM card PINs, hence can use an arbitrary alphanumeric password (though likely rather short, as you have to enter it often on a small keyboard). 36^5 >> 10^4.
Only in my country the simcard after 3 tries ask a PUK code of 8 digits and after 10 tries of it just block definitively the card and only your vendor can unlock it?
That's to unlock the SIM to start communicating with the network; this is for "screen lock" codes on (typically) smartphones, where the SIM is already unlocked and the phone is already on the network.
While I try not to underestimate conniving boyfriends, girlfriends, spouses, friends, parents, siblings, children, and grandparents, I am reasonably confident they will not employ a cracker bot from def con when I have momentarily become separated from my phone. For this reason, I lock my phone.
Or because you might have to use your work email on it, and exchange forces you lock your screen if you want to sync emails. Company policy so that you have a bit of security in case your phone gets stolen. Not everyone would have a robot to try all the PIN numbers just to steal you funny-cat-pictures-work-emails.
If I wanted actual security I would be using a full blown password and full drive encryption (both supported by Android).
But then I'd have to turn off all my toys like sync, USB debugging, and unsigned package installation. Which I don't want to do. So therefore I just take my phone being relative insecure as a given, and try to keep out the casual pranksters and or nosey people.