News for hackers. Stuff that matters.
Re:A Message to Our Customers by andreyvit on Wednesday February 17, 2016 @09:08AM (#11117902)
They state that they can push an update that makes brute-forcing possible by disabling software-enforced delays between attempts.

Apple's security PDF says that the iteration count is calibrated so that one attempt takes 80ms in hardware, so that's the hard limit on the brute forcing speed, regardless of any updates Apple releases.

This means that a long alphanumeric passphrase is secure, but a 6-digit passcode could be broken in half a day, and a 4-digit passcode would take just a dozen minutes.

Re:A Message to Our Customers by imh on Wednesday February 17, 2016 @12:11PM (#11119332)
It's so weird how hard it is for the brain to handle exponential growth. I was amazed that a 4-digit password can be cracked so quickly at 80ms a pop, but you're right. Just for the hell of it, here's how long it would take for different length passcodes for digits, digits plus letters (case insensitive), and digits plus letters (case sensitive):

    # characters  [0-9]         [0-9a-z]            [0-9a-zA-Z]
    1             0.8 seconds   2.9 seconds         5   seconds
    2             8   seconds   1.7 minutes         5.1 minutes
    3             1.3 minutes   1   hour            5.3 hours
    4             13  minutes   1.6 days            2   weeks
    5             2.2 hours     8   weeks           2.3 years
    6             22  hours     5.5 years           140 years
    7             1.3 weeks     200 years           9   thousand years
    8             13  weeks     7   thousand years  550 thousand years
    9             2.5 years     260 thousand years  34  million years
    10            25  years     9   million years   2   billion years
Re:A Message to Our Customers by tedmiston on Wednesday February 17, 2016 @12:36PM (#11119556)
Does this consider the "too many incorrect attempts" lockout that iOS imposes though?
Re:A Message to Our Customers by imh on Wednesday February 17, 2016 @01:16PM (#11119940)
Nope, it's just 80ms multiplied by the number of possibilities.
Re:A Message to Our Customers by typeformer on Friday February 19, 2016 @03:33AM (#11132360)
According to Snowden, the NSA can brute force at the speed of over a trillion guesses a second, of course, they would need to be able to disable other security features first.