Hacker News Reader

Comment by loteck | Hacker News Reader

For context, in 2016 Apple was claiming the six digit passcode would need 5.5 years of brute forcing[0]. Not sure if they still claim the same.

[0] https://www.washingtonpost.com/news/wonk/wp/2016/02/17/how-l...

View on HN

>“This means it would take more than 5 ½ years to try all combinations of a six-character alphanumeric passcode with lowercase letters and numbers,” Apple security guide says.

So given that it took them three years, 3/5.5 means they went ≈54.5% of the way through all the possible combinations. That seems in line with the estimate (assuming all passwords are 6-char alphanumerics).

I was thinking this through as well but if you were Apple estimating this number, wouldn't you have already done the averaging math to arrive at an estimate of 5.5? Seems to me more likely that speed of Greykey brute forcing improved or Apple's estimate was off.

I get what you mean, but the quote said "all combinations" specifically. I think they'd choose that wording because that's the biggest number they could report truthfully.

Shouldn’t they technically write “all permutations” for the biggest number?

Assuming they started at 000000 this also puts the passcode itself somewhere in the 545000 range. I hope it was 543210.

If they really just incremented from 0 they could have done a lot better. I bet the distribution of 6 digit passcodes in the population is far from uniform:

* A ton of people just take their 4 digit PIN and append 00 or 01

* Passcodes that are easily convertible to dates. Bonus points for targeting their particular birthday, their family’s birthdays, their pet’s birthday, significant historical dates etc

* Passcodes that make a nice pattern on the keypad like 084265

* Passcodes that have a numerical pattern like 024680

Yeah you'd definitely want to do an intelligent pass before brute force. Might be fun to write something that attempts to sort all the 6 digit numbers based on some heuristics "how likely is this as a human generated passcode"

As a serious security person, this is why I use 999999 as my passcode

I use 999997. You'd think they'd try 999999, and 999998 and go "fuck this" and try something else.

All of the best security practices rely on the attacker being easily bored. Thank you attention economy!

Would the probability of guessing all the possible combinations be higher than brute-forcing from 000000 to 999999?

This is why I use more than six numbers in my lock screen pin: the field itself turns from six slots into a single large field, such that you cannot tell if the password is seven digits or seventy. It massively increases the potential address space.

Sure, you have an enter key you have to press to submit the pin instead of having it auto-submitted with the sixth digit, but that’s a small price to pay.

Reply on news.ycombinator.com