Hacker News Reader

Comment by knallfrosch | Hacker News Reader

It's a welcome change, especially the time-lock is something that I always thought about. SMS and EMail as 2FA are dead when someone can unlock your phone.

Still though, why don't iPhone owners use face unlock? Is it not good?

View on HN

They do use it but you can force passcode requirement by holding down the power button until 'slide to power off' appears. From daringfireball: '(One way the scam would run: Chat up the victim in a bar, and offer to use the target’s phone to snap a photo of the victim and their friends. Surreptitiously lock the phone out of Face ID when handing it back to the victim. Then, when next the victim wants to do anything on their phone, they need to enter their passcode. Either the thief or a partner in a team gleans the passcode. Then they steal the phone, knowing the device passcode.)'

Say that to BofA. On my phone they still require email or text when I sign in.

Guess what I receive on this iPhone? Right, email & text.

On my PC it prompts for my YubiKey, but I cannot use it on iOS.

If anyone is interested, I wrote a small utility to time-lock data, to be able to self-restrict myself in terms of Screen Time etc. passwords: https://github.com/aerbil313/timelock

masks? sunglasses? etc

But also the phone locks back to requiring a passcode with enough failed attempts, so presumably people stealing them know how to induce recognition failure.

It’s very easy to trigger the fall back to enter PIN code.

Reply on news.ycombinator.com