I'm working at a company who is currently working to secure their mobile app (iOS native) by adding check points to security sensitive screens on the device (data is stored in the iOS keychain). User will be prompted to re-enter their password upon viewing these screens that present this data. One our requirements from Product team is asking for a usability feature that I think is a potential vulnerability.

They are basically asking for when the user leaves the field that they are typing their password to verify that it immediately turns to red or green, if the password locally is verified as invalid or valid. This seems it would make it too easy for an attacker to pick up someone's iPhone and repeatedly guess the password stored locally on the device. I would think we should check and validate with the server.

I'm asking for someone who may know more about the best practices to answer this question.

  • Won't the user know that it is incorrect when the password fails, anyway? I'm not sure that I understand the issue.
    – schroeder
    May 14, 2014 at 22:32

1 Answer 1


In addition, what a lot of people do is, if the user types in a wrong password x times in a timespan of x minutes, it gets denied for x seconds/minutes.

For example:

John enters a wrong password 5 times in one minute, thus he cannot log in for another 2 minutes.

Or even better, if the app NEEDS an internet connection with user accounts and such, you can even lock it after 5 times in 2 minutes (for example!), and let it be unlocked via email (companies use email a lot, if this app is for business-type users, most of them would have their mail on the same device as the application).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .