Hacker News Reader

Comment by chisleu | Hacker News Reader

Current iphones can be unlocked by asking siri for the time. I doubt the new iPhone security is much better.

Not unlocked... The thing you're talking about gives access to photos and contacts[1] - still a fair amount of data, but not unlocked.

Not sure if it's been fixed yet or not, but you can just turn off Siri from the lock screen.

1: http://lifehacker.com/ios-9-lock-screen-exploit-gives-evildo...

It was fixed in iOS 9.0.2.

https://support.apple.com/en-us/HT205284

Yeah I figured it got enough bad press to get priority fixing

No. I got to the home screen. You can disable it though.

Can you give more details on how this works? I just tried and couldn't get it.

Someone demo'd it on a couple new iphones at the hackerspace yesterday. They got to the homescreen with all the app buttons through the clock exploit. It wasn't just access to the dialer. Once you get through to the clock, you can hit the home button and it just hops to the home screen.

I have no idea how this works in regard to the encryption. It isn't likely anyone else here does either. They are just speculating.

I hope that it is good, but I don't trust it. No one should trust it.

I would look, but I don't own an iPhone.

I've spent a fair amount of time now trying to reproduce this on iOS 9.02 on a 5s, and I can't make it work. I can easily get to the clock by asking Siri and then tapping the clock in her results, or by swiping up from the bottom of the screen, but either way when I press the home button it dumps me back to the "Enter Your Passcode" screen.

I don't mean this as a claim that the iPhone is a secure device, since it obviously isn't in several different ways, but rather just that I can't reproduce this specific behavior.

How can you do that? Are you sure your not just engaging touch id? I tried it with my thumb, which 'unlocked'. Then I tried again with my fingernail, which didn't unlock it.

If the phone is locked, the decryption keys aren't in memory and your finger or password are required to access them, and no amount of bugs in Siri can get around that.

Reply on news.ycombinator.com