News for hackers. Stuff that matters.
Re:Apple Is Said to Be Working on an iPhone Even It Can’t Hack by jarcoal on Wednesday February 24, 2016 @06:47PM (#11171202)
Don't they just need to tell people to switch away from 4 or 6 digit pins and use longer passwords?
Re:Apple Is Said to Be Working on an iPhone Even It Can’t Hack by trowawee on Wednesday February 24, 2016 @06:51PM (#11171222)
I wish Apple would start pushing passphrases. Easy enough to remember, plenty strong, already usable with the current system on iphones.
Re:Apple Is Said to Be Working on an iPhone Even It Can’t Hack by rm_-rf_slash on Wednesday February 24, 2016 @07:02PM (#11171287)
Nobody would adopt them. It's annoying enough to deal with 4 digits when it's cold and I'm wearing gloves and I just want to change the song I'm listening to.

Passphrases suck enough whenever you have to log back in. Are people really gonna put up with that every time they want to use their phone?

On the other hand, if there were a convenient way to toggle between passphrases and 4-digit unlock, (especially if you had to use the passphrases to toggle back to 4-digit) then I would be all for it.

Re:Apple Is Said to Be Working on an iPhone Even It Can’t Hack by dheera on Wednesday February 24, 2016 @07:23PM (#11171436)
Not really. Have the option to set both a long passphrase and a PIN code.

The long passphrase is used to mount the encrypted file system upon startup, and the PIN code is used merely as a "screen lock", as a casual deterrent from your friends and casual thieves from swiping through your photos before you can catch them.

The file system can be automatically unmounted after a set period of inactivity, or if the user wants to unmount it on demand. After the file system is unmounted, the data is secure again and the long passphrase will once again be needed before anything can be done with the phone.

Re:Apple Is Said to Be Working on an iPhone Even It Can’t Hack by plorkyeran on Wednesday February 24, 2016 @07:08PM (#11171322)
I'd love to have a long passphrase that has to be entered after booting and every 48 hours, and then a 4-digit pin that's usable when TouchID is for when I'm unlocking my phone with my nose.
Re:Apple Is Said to Be Working on an iPhone Even It Can’t Hack by shawn-furyan on Wednesday February 24, 2016 @07:43PM (#11171537)
Exactly. Short passwords/longish pins suffice for short durations if they are random (i.e. not guessable), particularly if the device requires external hardware to brute force due to attempt duration scaling.

I currently use a generated long password on my Android phone and have adapted to the extra work, but having the option to enter a password once a day and a pin or shorter password throughout that day would be a welcome convenience option, and it's not really significantly more onerous than just a pin.

Re:Apple Is Said to Be Working on an iPhone Even It Can’t Hack by trustfundbaby on Wednesday February 24, 2016 @07:32PM (#11171476)
clearly you're not the average user.
Re:Apple Is Said to Be Working on an iPhone Even It Can’t Hack by agripa2 on Wednesday February 24, 2016 @07:11PM (#11171343)
Can't songs just be changed from the lockscreen (i.e., no unlocking needed)? Either way, your point still stands...
Re:Apple Is Said to Be Working on an iPhone Even It Can’t Hack by superuser2 on Wednesday February 24, 2016 @07:15PM (#11171365)
A secure passphrase requirement would kill Apple overnight.

Low-friction UI has been Apple's differentiator for years. If you have to take the time to type out a secure passphrase every time you want to interact with your phone, people will stop interacting with their phones (or use phones that suck less).

Why do you think they built Touch ID? Because typing even a 4-digit PIN is too annoying!

Re:Apple Is Said to Be Working on an iPhone Even It Can’t Hack by aioprisan on Wednesday February 24, 2016 @07:09PM (#11171325)
They already do, on phone bootup. You can use the fingerprint the rest of the time instead.
Re:Apple Is Said to Be Working on an iPhone Even It Can’t Hack by spullara on Wednesday February 24, 2016 @07:03PM (#11171298)
maybe if i only needed to use it on boot or daily. inputing a long passphrase is pretty onerous to do all the time.
Re:Apple Is Said to Be Working on an iPhone Even It Can’t Hack by zaroth on Wednesday February 24, 2016 @08:48PM (#11171817)
On my wish list is for the iPhone to effectively support multiple concurrent users. You login with your simple PIN for most cases or when the kids are using it, and you can login with a passphrase and are now working on a completely separate partition, with its own apps, settings, Apple ID, etc. I guess they could even support TouchID in this case as long as you enroll different fingers for each.
Re:Apple Is Said to Be Working on an iPhone Even It Can’t Hack by jedberg on Wednesday February 24, 2016 @07:19PM (#11171402)
Does anyone know if it re-encryptes the data after I change my passphrase? In other words, am I immediately more secure if I switch from a 6 digit pin to a passphrase?
Re:Apple Is Said to Be Working on an iPhone Even It Can’t Hack by ikeboy on Wednesday February 24, 2016 @07:43PM (#11171535)
Short answer: yes.

Longer answer: There's a key that encrypts the actual data, and that key is stored on disk, but encrypted with your passcode along with a hardware key. The hardware key cannot be read, only used to decrypt. Changing your code just changes the key stored to disk, but not the encryption key, so it's quick, but preserves security.

Longest and most accurate answer: https://www.apple.com/business/docs/iOS_Security_Guide.pdf from page 10.

Re:Apple Is Said to Be Working on an iPhone Even It Can’t Hack by jedberg on Thursday February 25, 2016 @02:30AM (#11172911)
Awesome thanks! Exactly what I was looking for.
Re:Apple Is Said to Be Working on an iPhone Even It Can’t Hack by mtgx on Wednesday February 24, 2016 @07:38PM (#11171512)
Yes, they could just remove the PIN authentication method, and I hope they do. Because then it would leave DoJ to argue for something even more extreme than they are now.
Re:Apple Is Said to Be Working on an iPhone Even It Can’t Hack by tomschlick on Wednesday February 24, 2016 @11:05PM (#11172322)
Or just burn in the auto wipe functionality so it can't be disabled by a software update unless you have the correct password.