Apple Quietly Added New Passcode Requirement for Touch ID

[MacRumors]

Apple recently added a new passcode requirement rule for iPhones with Touch ID enabled, according to MacWorld. The new rule requires a user to enter a passcode when an iPhone or iPad has met two conditions: the device has not been unlocked via a passcode for six days and has not been unlocked with Touch ID for the past eight hours.

Users (including this reporter) began noticing this change in the last several weeks, even though an Apple spokesperson says it was added in the first release of iOS 9. However, a bullet point describing this restriction only appeared in the iOS Security Guide on May 12, 2016, according to the guide's internal PDF timestamp. Apple declined to explain the rationale for this restriction.

The previous five passcode requirements are: the device has been turned on or restarted, the device has not been unlocked for 48 hours, the device has received a remote lock command from Find My iPhone, five unsuccessful Touch ID attempts and adding new fingers to Touch ID.

It's unclear why Apple added the restriction and why it chose an eight-hour window, but the rule comes after a judge granted a search warrant forcing a woman to unlock her iPhone with Touch ID. The decision comes as some believe the biometric nature of Touch ID isn't protected by the Fifth Amendment's protection against self-incrimination. Passcodes, however, are considered protected individual privacies.

Article Link: Apple Quietly Added New Passcode Requirement for Touch ID

 

[vertsix]

This is great. Other companies need to step up like this.

 

[Ron21]

Excellent news! Now if only they'd add passcode/touch ID requirement for iPhone shut down

 

[lampwins]

This isn't going to solve much because the vast majority of people still use a 4 digit passcode. Most don't know that they can make it longer, either 6 digits or alphanumeric. The root problem is that 4 digits is still an option.

I also see a great deal of people that are not making use of TouchID at all. Most of the time the response is "I didn't know I could do that" or "I don't know how to set that up."

 

[al256]

The Bill of Rights means more to me than any inconvenience I may have from my long, complex password on my iOS devices. I'm glad these changes are being made.

 

[zorinlynx]

Interesting; I wonder why they picked 8 hours. Most people sleep around that much, so this means folks will have to enter their password about once a week on average if they don't reboot their phone (most people don't)

 

[billybobthornton]

Next passcode requirement... Put your left foot in and your left foot out. Put your left foot in and shake it all about. Do the hokey pokey and turn yourself around because that's what it's all about.

 

[garirry]

8 hours is actually not that much, but I like the security. Besides, it's no big deal entering a password, even if it's once a day.

 

[goobot]

Excellent news! Now if only they'd add passcode/touch ID requirement for iPhone shut down

Nothing is stopping anyone from just holding the power and home to turn it off which is needed for freezes and such.

 

[Mac Fly (film)]

I'll slap James Comey with my big... phone.

 

[Ron21]

Nothing is stopping anyone from just holding the power and home to turn it off which is needed for freezes and such.

Yes, but that will/can only force a restart not a shut down if passcode or touch ID is not inputted.

 

[Paradoxally]

Excellent news! Now if only they'd add passcode/touch ID requirement for iPhone shut down

You could easily bypass this with home + power, so not feasible.

 

[garirry]

Nothing is stopping anyone from just holding the power and home to turn it off which is needed for freezes and such.

I was thinking about this the other day, why not make it so that holding the home and power buttons would force reset the phone instead of powering it down? That way, the only way to shut down the phone is through authentication or battery loss, which, in the case of theft, would give a lot of time for the person to report this. Of course, this probably will require hardware modifications, as I doubt the "sub" controls like force shut downing the phone is built into iOS.

 

[MetalHaze]

This isn't going to solve much because the vast majority of people still use a 4 digit passcode. Most don't know that they can make it longer, either 6 digits or alphanumeric. The root problem is that 4 digits is still an option.

I also see a great deal of people that are not making use of TouchID at all. Most of the time the response is "I didn't know I could do that" or "I don't know how to set that up."

You must not own an iPhone because in iOS 9 it no longer defaults the PIN length to 4 characters. You have to manually change it back to 4. More people are more likely to have a PIN longer than four numbers now because of that change.

And really smart people will change it to a long, alpha numeric passcode for ultimate security

 

[Paradoxally]

I was thinking about this the other day, why not make it so that holding the home and power buttons would force reset the phone instead of powering it down? That way, the only way to shut down the phone is through authentication or battery loss, which, in the case of theft, would give a lot of time for the person to report this. Of course, this probably will require hardware modifications, as I doubt the "sub" controls like force shut downing the phone is built into iOS.

No, not really...if the thief knows how to shut it down quickly.

1. Force reboot
2. Remove screws
3. Open iPhone
4. Remove battery

Takes 1 minute to do with simple tools. They can just keep force rebooting or putting the phone into airplane mode which shuts down all connectivity.

Of course, then Activation Lock kills them.

 

[Kmonz90]

I also see a great deal of people that are not making use of TouchID at all. Most of the time the response is "I didn't know I could do that" or "I don't know how to set that up."

I have tried to set up touch ID numerous times and after its all set up it never recognizes my finger print to unlock my phone. Try it again, doesn't work. Different finger; doesn't work. Helped my mom set up hers, works great. Set up my girlfriends, works great. I don't know I think its my finger prints.

 

[Casiotone]

I came to the same conclusion after noticing the more frequent passcode requests on my devices. Not that I couldn't believe that this was a bug, but to me it was more likely intentional.

 

[ardchoille50]

Next passcode requirement... Put your left foot in and your left foot out. Put your left foot in and shake it all about. Do the hokey pokey and turn yourself around because that's what it's all about.

I almost fell out of my chair laughing at this!

 

[ovo6]

Idk but sometimes I require to put my code, way before 8 hours

 

[bilibug]

This should be configurable.

 

[IJ Reilly]

As someone who considers the possibility that the government will seek out and find something incriminating on my phone almost as likely as being struck by lightening twice in the same day, I find the constant demand to double-unlock it for my own use to be nothing better than an annoying sop to the massively paranoid.

 

[rohitp]

Apple recently added a new passcode requirement rule for iPhones with Touch ID enabled, according to MacWorld. The new rule requires a user to enter a passcode when an iPhone or iPad has met two conditions: the device has not been unlocked via a passcode for six days and has not been unlocked with Touch ID for the past eight hours.

The previous five passcode requirements are: the device has been turned on or restarted, the device has not been unlocked for 48 hours, the device has received a remote lock command from Find My iPhone, five unsuccessful Touch ID attempts and adding new fingers to Touch ID.

It's unclear why Apple added the restriction and why it chose an eight-hour window, but the rule comes after a judge granted a search warrant forcing a woman to unlock her iPhone with Touch ID. The decision comes as some believe the biometric nature of Touch ID isn't protected by the Fifth Amendment's protection against self-incrimination. Passcodes, however, are considered protected individual privacies.

Article Link: Apple Secretly Adds New Passcode Requirement for Touch ID

[doublepost=1463630361][/doublepost]The best suggestion I saw was to have one of your fingerprints be a "panic" fingerprint for TouchID; one that immediately locks down the iPhone. It would be a cool security feature to keep Big Brother away.

 

[tennisproha]

I don't like it. It doesn't solve any problem but rather creates an inconvenience. So now every six days, you have to enter your passcode.

 

[a-m-k]

I thought it was a weird fluke of my thumbprint....

 

[Slix]

Next passcode requirement... Put your left foot in and your left foot out. Put your left foot in and shake it all about. Do the hokey pokey and turn yourself around because that's what it's all about.

I used to be addicted to the Hokey Pokey.

But then I turned myself around.


I think it's good to have some of these requirements, especially if courts are ordering people to use Touch ID to get into their phones for cases.