With iOS 11 I was compelled to switch from two-step-verification to two-factor-authentication. This has the implication that somewhere at Apple there is some blackbox that can decide, using my AppleID credentials(?), whether a given passcode coincides with the actual iPhone passcode.
When I wanted to check how many bruteforce attempts I have I run into the convenience feature which allow unlimited bruteforce attempts with the same passcode.
Given this I have two questions:
I asked Apple support if this weakens the security of my passcode. They say no. How can this be possible if off-device bruteforcing is possible?
The fact that entering the passcode twice doesn't increase the counter makes me wonder how the counter is triggered. If the passcode attempt is first checked against the actual password and then checked against the last attempt, wouldn't there be a delay between when the passcode is checked and the counter is incremented during which the phone could crash? Wouldn't this potentially allow a brute force attack, or am I missing something?