Hacker News Reader

Comment by hardwaresofton | Hacker News Reader

Isn't there a setting for wiping the device if the wrong password is entered X times?

This device pranks the hardware to allow unlimited attempts at guessing the password.

I don’t know the details: is it as simple as grounding the “password entered incorrectly” pin? Or is it about injecting so much noise on a signal line that the message to increment the PIN attempt count never gets through? I don’t know.

So use a passphrase, not a PIN.

With all the work that I've heard went into secure enclave (IIRC that's apples hardware+software security latest-and-greatest), does that mean someone (or an entire team) at Apple is absolutely sweating bullets/thinking frantically right now?

Security and a focus on user privacy protection (from other entities, at least) is definitely a differentiator for apple devices

Last year someone demonstrated the possibility of dumping and restoring the state of the security hardware in between entry attempts, so that the phone always thought you were on your first try. I assume this is the technique being used by the GreyKey.

EDIT: Pretty sure this is the one I'm thinking of: https://www.digitaltrends.com/mobile/cambridge-researcher-ha...

I guess it was two years ago.

I guess they copy something off the phone, validate passcode attempts against that piece and the phone gets correct passcode only.

Maybe.. but I think the system is designed so that isn't possible. There is a secret device key inside the secure enclave used to salt your passcode... I bet they're bypassing the limit on number of password guesses.

On the other hand, is it possible to programatically enter the passcode? From the picture, it looks like it's unlocked via lightning cable. It's not emulating unlocking via touchscreen. I wonder how much security would it add to require input via screen.

I bet they just connect (or rather, emulate) a physical keyboard connected via Lightning/USB, and use it as an input device.

Yep! And with these guessing speeds, the amazing device can wipe an entire iPhone in less than a second!

Yes, I wonder if this device has a way to bypass that.

Reply on news.ycombinator.com