1

My Samsung Galaxy phone has a feature named "auto factory reset," by which (according to the blurb in the device's settings) this happens:

After 15 incorrect attempts to unlock your phone, it will be reset to factory default settings, and all data will be erased, including files and downloaded apps.

Question: Does that mean "auto factory reset" makes the phone immune to brute-force attack and makes irrelevant the sort of information as pictured at the bottom of this post?

It would appear that, with only 15 chances, even a four digit PIN should be strong protection against brute force? (Or more practically, something like five lower case letters long.)

Or is there a catch (as there always seems to be), and am I better off with a long password? The catch might say that the "auto factory reset" itself can be separately defeated, after which the brute-force attack can be applied.

For this question, please assume that the android phone in question is device-encrypted.

Added in response to comments: The case I am worried about is my losing the phone and its falling into the hands of a hacker with time on his hands to "try and crack, why not?" I am not worried about a determined person with his eyes set on my phone (as it is not an interesting target). I have a type of keyboard that makes it very difficult to "look over my shoulder." (It enters different values depending on the direction of the strike and drag.)

time it takes to crack a password by brute force in 2022

Source of image: https://www.techrepublic.com/article/how-an-8-character-password-could-be-cracked-in-less-than-an-hour/

Improve this question
3
  • You mean how easy is it for someone to look over your shoulder to watch you enter a 4 digit password? Forget brute-forcing as an actual vector... people don't need to do that. They'll either social-engineer it out of you, simply spy on you, or just beat you up until you unlock it. And who are the threat actors? Some random guy on the street? Sure, 4 digit password is fine. Nation-state actor? You better lose the phone completely (e.g.: Snowden).
    – Nelson
    Commented Apr 12, 2023 at 0:50
  • Of more concern if you enable this option is that anyone malicious could enter 1111 fifteen times and wipe your phone!
    – TripeHound
    Commented Apr 12, 2023 at 14:48
  • @TripeHound Ha, ha, that's a great one! But seriously, it could be a child, not necessarily malicious. I'll have to think about that. Thanks!
    – Catomic
    Commented Apr 13, 2023 at 1:33

1 Answer 1

Reset to default
1

Only you decide if 4 digits with 15 attempts is acceptable to you. Effectively it is weaker than a 3 digit PIN with a single attempt.

Suppose there are 10000 people, every has different PIN from 0000 to 9999. The attacker picks up 15 different PINs and uses them for each of 10000 phones. Thus, 15 out of 10000 phones will be successfully unlocked. This means, 1 of every 667 phones. The probability is 1/667. This is even higher than if one used 3 digit PIN with a single attempt, because in such case the probability would be 1/1000.

I would advise you not use 4 digit PIN in this case. Use at least 6 digits.

To the picture you linked: It is not relevant for your case. It is applicable in other scenarios, for instance, when the attacker has a obtained hash of the password from the database and wants to find the plain password by brute-forcing. Or if there is an encrypted file and the attacker tries all possible combinations to find a password.

Improve this answer
5
  • The main point I may draw from your answer is that the "auto factory reset works as advertized" i.e. without a catch? Thanks for 1/667. The actual password I would use is five lower case characters long. If the "15 chances" thing works, that would be practically impossible odds?
    – Catomic
    Commented Apr 12, 2023 at 1:17
  • @Catomic: If you use English letters, 26 characters, instead of 10 digits, then there are 11 881 376 possible combinations. Of course if you pick up PIN randomly, not some word from dictionary. In such case, 15 attempts means probability 1/800000, which would be (to me) sufficient. But if you pick up some word, let say out of 10000 most commonly used words, then again the probability would be 1/667.
    – mentallurg
    Commented Apr 12, 2023 at 1:31
  • @Catomic: The strength of protection should be commensurate with what are you protecting. If you have only pictures from your vacation, then such PIN can be overkill and 4 digits can be sufficient. If your phone has a banking app that provides access to an account with $100'000'000, then even 5 characters will be too high risk and will be not sufficient. Only you can estimate your risks.
    – mentallurg
    Commented Apr 12, 2023 at 1:36
  • @Catomic If you loose physical control of your device, the protections should be considered mitigations at best. Against a determined or skilled adversary you can not really assume that they don't have an exploit against the device. Prudence would dictate that you take other measures if the phone is stolen, such as changing all passwords and logging out of sessions.
    – le3th4x0rbot
    Commented Apr 12, 2023 at 1:54
  • @Catomic Using disk encryption is super helpful though, as is keeping your device fully updated, and ditching devices after their hardware support ends.
    – le3th4x0rbot
    Commented Apr 12, 2023 at 1:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .