2

With iOS 11 I was compelled to switch from two-step-verification to two-factor-authentication. This has the implication that somewhere at Apple there is some blackbox that can decide, using my AppleID credentials(?), whether a given passcode coincides with the actual iPhone passcode.

When I wanted to check how many bruteforce attempts I have I run into the convenience feature which allow unlimited bruteforce attempts with the same passcode.

Given this I have two questions:

  • I asked Apple support if this weakens the security of my passcode. They say no. How can this be possible if off-device bruteforcing is possible?

  • The fact that entering the passcode twice doesn't increase the counter makes me wonder how the counter is triggered. If the passcode attempt is first checked against the actual password and then checked against the last attempt, wouldn't there be a delay between when the passcode is checked and the counter is incremented during which the phone could crash? Wouldn't this potentially allow a brute force attack, or am I missing something?

  • Please focus your question to a specific one. What do you mean by "remembers this code at least until the next code is typed in"? Is it already set when you have to unlock your phone the next time? Be more specific please. – Tom K. Mar 6 '18 at 11:00
  • Well after entering 5 wrong passcodes the phone is locked for a minute. But if you enter 5 times the same wrong code nothing happens. So it has somehow be remembered. – user60589 Mar 6 '18 at 11:02
  • So if you enter the same passcode 10 times the phone would not be locked? – Tom K. Mar 6 '18 at 11:42
  • 4
    There’s is no security issue with the iPhone not locking after typing the same wrong passcode many times: you are allowed 4 mistakes before the lock, repeating the same one doesn’t allow any progress in brute forcing the passcode so there’s no security reason to lock the iPhone then. On the other hand, an iPhone owner who has forgotten their passcode repeatedly typing in the one they think is right (but is not) won’t lock their iPhone — good UX. – korrigan Mar 6 '18 at 11:44
  • @TomK. yes right. Just did it 20 times and even TouchID worked afterwards. – user60589 Mar 6 '18 at 11:46
1

Recap and basics

First off, let us take a quick recap on how to prevent brute-force attempts.

A brute force attack is one where someone tries lots of different passwords (potentially sequential) until they get into the system.

With this in mind, there is really only one way to prevent brute-force attacks: throttle the speed with which attempts can be made.

Example

If all passwords were 8 alpha characters, there are 26^8 ≈ 208 billion password combinations. If a brute force algorithm was restricted to one attempt every second, it will take approximately 26^8 / (60*60*24*365.2425) ≈ 6617 years, so this would be one easy way to prevent brute force attempts without interrupting the user experience.

Most systems, (probably including iOS) are more likely to have an incremental throttle system, something like:

  • normal max rate is 1 per second (that is quick for a person, really slow for a robot)
  • after 10 incorrect attempts, this reduces to 1 per 10 seconds
  • etc.
  • after a successful login or a specified amount of time, the rate resets.

Caveat

This incremental throttling type of system can massively penalise individuals with long passwords and/or a disposition towards mis-typing their password.

If a person mis-types their password the same wrong way, how many passwords have they actually tried? Only 1, so why would it throttle them more than that.

As such, a decent throttling system would also store a hash of the attempted password, and only track number of unique passwords attempted.

Side note

This could be an interesting (though unreliable) way to determine if it is a user attempting to log in or a robot - a robot attempting to brute force would be much quicker (unbelievably so) and would never need to attempt the same password twice.

Summary (and answer to the ops question)

You have tried the same password multiple times, so might not trigger anything as there is no brute force attempt.

Even if you were to attempt different passwords, it is unlikely you will be able to enter them quick enough to trigger anything that prevents brute force attacks: you are nowhere near as quick as a robot.

  • "disposition towards mis-typing their password" This is often the case with shift lock. Modern computers don't even have a light anymore! :( This is also often the case when dealing with qwerty for the azerty people, and vice versa (a good reason to avoid symbols in passwords, BTW). The system should print "same incorrect password that you just typed, check your keyboard setting". – curiousguy Jul 5 '18 at 0:38
1

This has the implication that somewhere at Apple there is some blackbox that can decide, using my AppleID credentials(?), whether a given passcode coincides with the actual iPhone passcode.

HT202303 says:

Your data is protected with a key derived from information unique to your device, combined with your device passcode, which only you know.

You are correct that if Apple holds data encrypted with a key derived from "information unique to your device" (that I assume they know) combined with your passcode that they could try to brute-force the passcode by attempting decryption with each key. This is a trade-off, as a backup that couldn't be decrypted without the original phone would be of limited use. This would be more acceptable if you could use a separate (stronger) password for the backup, but I haven't been able to find out if this is possible. If you don't like this I believe you can disable backups.

The fact that entering the passcode twice doesn't increase the counter makes me wonder how the counter is triggered. If the passcode attempt is first checked against the actual password and then checked against the last attempt, wouldn't there be a delay between when the passcode is checked and the counter is incremented during which the phone could crash? Wouldn't this potentially allow a brute force attack, or am I missing something?

I don't know how Apple has implemented it, but an easy way is to store the $previous attempt and always check against that before checking against the $correct passcode. If it matches $previous, just display the error. If it doesn't, increment the counter, store it as $previous, then check against $correct. This way the counter is always incremented before the check.

  • HT202303 says I might get asked for a passcode of a former device. – user60589 Mar 6 '18 at 16:46
  • They are only saying, I can use E2EE, if 2FA is activated. But are they saying somewhere that that I can opt out of E2EE when 2FA is enabled? – user60589 Mar 7 '18 at 13:08
  • I have the feeling that 2FA is the backdoors version of 2SA. – user60589 Mar 7 '18 at 13:12
  • You are right. First checking $previous should be fine. – user60589 Mar 7 '18 at 13:14
-1

@user60589 The iPhone stores password "1" time. The next time you enter password, it compares the entered password with the previously entered password(if any). If the entered password is same, it doesn't increment the wrong attempts counter. Now, if the entered password is different from previously entered, it increases the counter of wrong password entry to "1". If you enter the correct password after that, the iPhone resets counter to "0" and it unlocks. If you enter wrong password continuously "5 times", the iPhone doesn't allow you to enter password for 1 minute. The 6th time wrong attempt disables it to 10 min. Then 1 hour and so on.

It doesn't have the security impact on iPhone as storing wrong password doesn't impact anything. In fact, it is preventing users from loosing their data because if they are repeating the password, they might be thinking it's the correct one. Now, if someone tries to brute force, it disables itself. isn't that "SMART"? :)

  • 2
    This directly contradicts OP's assertion that entering the same incorrect passcode multiple times doesn't lock the phone. – AndrolGenhald Mar 6 '18 at 14:36
  • what did you meant by "OP's"? – Haseeb Ahmed Mar 6 '18 at 14:42
  • OP generally means "original poster" or "original post". – AndrolGenhald Mar 6 '18 at 14:48
  • Anyway. This is actually a new discovery. I didn't noted that before. I tried entering same password for continuously 8 times and it didn't disabled iPhone. But if you enter 2 different password back to back, it disables the iPhone. I guess the iOS is getting smarter now by detecting if the user has forgotten password or they are trying to brute force it. – Haseeb Ahmed Mar 6 '18 at 14:53
  • 1
    "It doesn't have the security impact on iPhone as storing wrong password doesn't impact anything." can you add any sources or reasoning to that claim? That is pretty much all the OP is asking about. – Tom K. Mar 6 '18 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.