iPhone Cracking Methods Like GrayKey Box Can Guess a Six-Digit Password in 11 Hours on Average

[Defthand]

It's simpler to remember the Ten Commandments than to remember a ten-digit passcode. If you need to be a law breaker or anarchist, avoid using computers and cellphones to conduct business.

 

[oplix]

If you are using passcodes in 2018, you deserve to have your phone hacked. Lets get real. Nobody that is trying to hide information on their phone is going to be using a passcode

 

[Act3]

If you are using passcodes in 2018, you deserve to have your phone hacked. Lets get real. Nobody that is trying to hide information on their phone is going to be using a passcode

please explain, don't use any passcodes at all? lol

 

[kstotlani]

So the professor is just calculating/extrapolating the numbers and didn’t actually use the device? Read the whole article but it’s missing how he came up with the numbers.

 

[btownguy]

I thought every time you put in a bad passcode you had to wait longer and longer before you could enter the next guess.

 

[fathergll]

There are some people in this thread who think this is funny. I've had a coworker who had her identity stolen. It is a life changing event. She is not important. She doesn't have state secrets. She doesn't work for a vast organized crime ring.

So no, you don't need to be important to take security seriously. Hackers make money or simply have fun taking over accounts. Having your electronic identity stolen and accounts taken over is extremely time consuming to undo, very inconvenient, and expensive. And you never know if it is completely over.

Anyone getting access to your phone or your computer, as if they were you, then has access to your web history and email. With access to web history and email they can see all of the places you go to that have accounts. With access to your email they can take over any number of accounts that use email for password resets, even banking accounts. Some accounts won't even need the email password reset, if you have autofill enabled.

Think you're secure because you enabled 2-factor authentication? Nope, they've got the second factor...your phone, which is going to receive any SMS, call, or email needed for 2-factor authentication, and it will have the authenticator apps on it for time-based codes.

So even though nobody has any particular interest in targeting most of us, and odds are very low, the stakes on the other hand are extraordinarily high. It's certainly enough that I'm willing to have a code that's just a little bit longer, and with TouchID or FaceID you don't even have to enter it all that often. Also do the same practices on your tablets and home computers.

This is also why I hate the "if you've done nothing wrong, you have nothing to hide" argument. Wrongdoing has nothing to do with it. Everyone has something to hide--access to your critical accounts.

Yes but you're not going to have your identify stolen because someone got access to a Graykey and bypassed Apple security. You have a better chance of having much more horrible things happen to you like getting murdered, hit by a car, getting cancer...etc.

When it comes to things like this you need to weigh probability and make decisions based on that.

 

[jeremiah256]

Fair point, and I definitely agree with the sentiment! But I do think that if they (the authorities) were to get legal permission, a warrant, to get into your stuff it wouldn't make much of a difference whether you have a 4-digit passcode or some character-riddled 12-character monster of a password -- if they have to get past something, it's a "locked door" legally, right?

True...I think. Law enforcement really, really pushes the boundaries and the law is still evolving. There is too much conflicting information out there for a non-legal expert like me to be sure of the law in the location I happen to be in (I travel, both in the U.S. and abroad):

Washington State
Incident to Arrest/Emergency
Less Rights in Vehicles?
Phone Seized as Evidence

So I try and stay calm and encrypt (strongly).

 

[Macaholic868]

If there is somebody who wants the data on your phone and they are willing to pay what this device costs then you’ve got bigger problems than how many digits your unlock code is.

 

[shyam09]

I always thought easier to remember word/phrases were better.

Ie. Horseeatsbatterycharger > h$^eh37w@e

 

[rp2011]

I thought about it for a second, and i'm not really worried about the FBI, but if the FBI can do it, i bet scammers can too.

 

[cwt2nospam]

Don’t do anything where your phone could be taken by law enforcement, simple.

What makes you think they're the only ones who might want to get into your phone, legally or otherwise?
[doublepost=1523932759][/doublepost]

It's simpler to remember the Ten Commandments than to remember a ten-digit passcode. If you need to be a law breaker or anarchist, avoid using computers and cellphones to conduct business.

What if you just want to do your banking on your phone? Can you have strong encryption then?

 

[Wowereit]

Apple: fix this. If I activate a feature that is supposed to wipe out the phone after 10 incorrect password guesses, I expect it to work.

Someone will figure it out again.
That's the only thing all those 'maximum X tries' solutions from different companies (or open source developers) on different operating systems have in common, no matter how they are implemented, someone found a way to circumvent them.

If you are concerned about security, switch to alphanumeric passwords only.
The amount of possible combinations does increase significantly, 4 alphanumeric signs are already more secure than 15 digits.

 

[Michael Scrip]

Just changed to an alphanumeric passcode. Not that I don't trust law enforcement with search warrants, but I know it's only a matter of time until one of these devices falls into the wrong hands.

But a bad guy would need one of these devices.... AND they need to have your phone.

That's why I'm not personally worried about bad hackers getting these devices.

If my phone is out of my control... I've got bigger things to worry about.

Or if I simply lost my phone on an airplane or subway... I would remotely brick it via Activation Lock... thus rendering it useless to thieves.

I'm just a normal dude. I'm not carrying state secrets on my phone. But if I was a high-value target... I would definitely have an insane alphanumeric password.

I have no doubt that someday these GreyBoxes will end if in the wrong hands.

But the chances of my phone also being in those same hands are slim to none.

 

[Wowereit]

Don’t do anything where your phone could be taken by law enforcement, simple.

Great solution, because something like false accusations doesn't exist, right?
Being innocent doesn't mean being willing to share all your personal data + login to all your accounts.

And how about 3rd parties? Or other governments when abroad?
Did you know that insulting people is illegal in Germany and can give you up to 2 years in prison in rare cases? But generally it's a safe assumption to lose at least 2 weeks to 6 months of pay as punishment. Great, in't it?
So no, I'm definitely not willing to share my data with the government.

 

[brinary001]

As an expert in IT I know I should be using an alphanumeric passcode, and these posts have been reminding me just how important something as simple as that can be.

Plus I'm always preaching security to my friends and family so I should definitely be walking the talk!

 

[macsrcool1234]

If iOS wasn't constantly asking for a password every 10 seconds, more people could set to something more complex. Having touchid/faceid is useless because of how constantly the OS requires you to put a password in for something.

 

[CarlJ]

Sigh. Fine. I’m going to pick a random Welsh street sign and add my high school gym locker combination to it.

View attachment 758545

Oh, hey, I have that combination on my luggage.

 

[scrapesleon]

I’m surprised people don’t use alphanumeric codes been using it since my first iPhone was stolen back in the days

 

[venom600]

They shouldn't be able to crack the throttling. This is the crux of brute force protection.

My understanding of how it works is that it copies the contents of the phone into virtual machines that can then rapidly try different codes. Throttling never comes into play because they are effectively using thousands of different virtual phones and then discarding them. That means the real limitation is how fast the computer can enter the PIN then move on to the next VM.

Or I could be totally wrong.

 

[NoBoMac]

True...I think. Law enforcement really, really pushes the boundaries and the law is still evolving. There is too much conflicting information out there for a non-legal expert like me to be sure of the law in the location I happen to be in (I travel, both in the U.S. and abroad)

This.

For example, brought up in a different thread, Customs and their zeal to inspect devices and willingness to skirt the Fourth Amendment is a good example (anyone who has driven in these 100mi zones along the border has probably run into the permanent checkpoints and their prying).

https://www.aclu.org/other/constitution-100-mile-border-zone

 

[ctyrider]

I've seen 25 character mixed case with numbers of special characters cracked in under 20 hours. But keep telling yourself that kind of stuff is impossible if it makes you feel better.

I have seen 3 aliens landing on my backyard in the middle of the night.. two of them were singing Macarena, and the third one was so drunk, he was just floating 20 feet in the air. But keep telling yourself that kind of stuff is impossible if it makes you feel better.

 

[Mark Booth]

Glad my passcode is more than 10 characters!

Mark

 

[usarioclave]

Given that most programmers will implement a linear search, numbers and letters at the end of the scale will give you more protection.

 

[nicho]

It's simpler to remember the Ten Commandments than to remember a ten-digit passcode. If you need to be a law breaker or anarchist, avoid using computers and cellphones to conduct business.

For some maybe. I worked in a business where whenever we called someone we'd need to say both the name of the place and a unique department/ID number. The number becomes engrained in your brain. Move locations or departments a few times and you have a few strings of numbers to put together. I remember every single one of them - if my password wasn't already complicated and alphanumeric, I could create a memorable passcode far exceeding the ones mentioned here.

 

[T-R-S]

if you're criminal and are using a smart phone you're pretty dumb