Comment on Stop Using Your Face or Thumb to Unlock Your Phone

• hedgehog@ttrpg.network ⁨6⁩ ⁨months⁩ ago

  It calls them “passwords,” but personally I don’t consider a 6 digit number to be a password. And according to this article on GrayKey, 6 digit “passcodes” became the norm back in 2015. I haven’t seen any stats showing that people on average use more secure passcodes now, and making the passcode required more frequently isn’t going to encourage anyone to use one that’s more secure.

  The article just says “disable biometrics” which is bad advice for the average person, as it will result in them using a 6 digit passcode. This is a knee-jerk reaction at best, and the resulting advice is devoid of nuance, made by someone who clearly doesn’t understand the threat discussed in the article, and would benefit literally nobody who might feasibly take it.

  My advice is echoed by the article above, but it’s based off having an understanding of the problem area and suggesting a solution that doesn’t just address one thing. Anyone giving advice on the topic should consider:

  • known threats and reasonably likely unknown threats
  • the mitigations to those threats
  • how the technology works for both the threats and the mitigations
  • the legal landscape in your jurisdiction - for us, the US - both in practice and in theory
  • people’s attitudes toward security, namely their willingness to suffer inconveniences for its sake
  • how all of the above interact, and how likely someone is to take the advice given in a way that improves their security overall

  The author of this article considered none of the above.

  source

  • drmoose@lemmy.world ⁨6⁩ ⁨months⁩ ago

    I still don’t get where are you seeing this advice in the article. No one is recommending “6 digit passcodes”. AFAIK all contemporary phones use mixed character passwords these days. I just setup a second hand s22 and it asked me to create a full password as primary authentication with all of the brute force strength hints etc.

    Your perception might be a bit outdated here.

    source

    • hedgehog@ttrpg.network ⁨6⁩ ⁨months⁩ ago

      As I said in my first comment, I’m more familiar with iOS, where 6 digit passcodes are the default.

      That said, do you genuinely think the average person would use a random 10+ alphanumeric character passcode to unlock their phone after taking the advice of this article and disabling biometric auth?

      source

      • drmoose@lemmy.world ⁨6⁩ ⁨months⁩ ago

        Yes the contemporary phones literally bug and warn you if you don’t. Password is much easier to remember than 6 digits too imo.

        source
• YoorWeb@lemmy.world ⁨6⁩ ⁨months⁩ ago

  He’s not wrong though. Brute forcing number only pin takes little effort.

  source