Brute-force Iphone password guesser can bypass the 10 guess lockout

[PhasmaFelis]

@stephen_schenck

Perhaps I wasn’t clear there. I’m saying that every time the lock screen is accessed, we take a counter one step closer towards wiping the device. If you do nothing, and the screen times-out due to inactivity, or if you press a button to manually put the phone back to sleep, the system moves that counter back down, stepping away from a data wipe. In this case, the counter ends up in the same place it started.

Seems like it would be easier and simpler to just reverse the current order of things: write the attempt to flash, then display the result to the user, instead of the other way around.

[Boundegar]

A system I use at work forces passwords to contain a symbol. But it gives a list of only seven acceptble symbols. Three of them don’t actually work, and you end up calling IT for a reset. So you’re down to four possible symbols. Great security, guys.

But I learned something by calling IT - I was the only employee who had this problem. That means nobody has ever used the three “broken” symbols, and I would bet a dollar every single password contains one exclamation point and no other symbols.

Great security, guys.

[Kernos]

Mine’s 10 digits. How long would that take?

[EjDobr6]

10 billion times 40 seconds is about 12,675 years. But, as Rosyna pointed out, this was patched in iOS 8.1.1 back in November 2014. So it’s not possible if your iOS device is up-to-date.