Hacker News Reader

Comment by k310 | Hacker News Reader

Powering down was made easy to defeat biometric ID. Hold buttons on both sides of newer phones.

Passcode is required to unlock.

Passcodes are vulnerable to shoulder surfers, and every now and then iOS will demand one for chuckles. For me, this only happens in crowded stores.

View on HN

> Passcodes are vulnerable to shoulder surfers

My home door lock has a pretty cool way to counteract this.

Here's a picture of what it looks like

https://www.digitaltrends.com/wp-content/uploads/2021/07/loc...

Every time you press a button, all the numbers shuffle around. Even if someone watches you enter the passcode, they can't be certain of what the password actually was.

They do gain some information (the first digit must be either a two, a six, or a nine), but they don't get the full information.

Having had a bank that did something similar for logging onto their mobile app, annoyance at that feature was the main reason I moved to a different bank.

Do you not have the problem I had that the moving around of numbers makes it impossible to use muscle memory and you always need to think about each digit, or do you just have more patience than me and not mind? Maybe the bank's version on my phone was particularly bad and the interface on your lock particularly good? (It was almost a decade ago, I can't actually remember exactly what it looked like / how it worked, just how frustrating it was.)

>or do you just have more patience than me and not mind?

This is the case for me (GrapheneOS), and I wouldn't be surprised if it is the case for the GP too...

I completely forgot the pin to a bank card I haven't used in a long while. It occurred to me that humans are mostly just next token predictors anyway, so I pretended I knew the pin, and just got the little machine out, went to my bank page, and started logging in, and when it came the time to type my pin into the machine to get the one time code, I simply remembered the pin while my fingers typed them in.

Standard practice from Old School Runescape as well as Ragnarok Online for pin entry.

Always was annoying to have a relatively unimportant account like those more protected than bank accounts were at the time.

OSRS also encourages everyone to enable 2fa by tying it to a quest that gives you 10k ingame currency.

I assume they are so serious about security because it would generate a lot of work for support, and people are constantly trying to scam each other and hack accounts. Plus, they don't have the luxury of locking the whole account until you go into your bank in person.

> Passcodes are vulnerable to shoulder surfers

And countless cameras with frame-by-frame playback.

  Linux:     print * to hide password keystrokes
  BSD:       print * to hide password keystrokes
  Windows:   print * to hide password keystrokes
  Apple iOS: E N L A R G E and INVERT password keystrokes

What do stock Android and Graphene show during password entry?

By default Android is the same but it let's you turn it off. With the lock screen you can reduce feedback to only the password stars appearing and no key highlights. With password elsewhere you can remove the momentary password character preview. The keyboard lets you reduce key press feedback prominence so it's only a momentary flicker (and no character pop up), but there really should be an API to make the keyboard aware it's in "password mode" so you could eliminate feedback entirely.

GBoard has "incognito mode" when it's a Chromium incognito window, but unfortunately none of the feedback is disabled and it appears to be deprecated.

Pretty crazy that people use keyboards and grant them network/internet access.

https://developer.android.com/reference/android/support/v13/...

My iphone code is 10 characters long. Just use your grand-mothers phone number as a passcode, complete with the long 1-areacode, and shoulder surfers would be hard pressed.

so set it to a thing that three letter agencies are most likely to know already?

You have worse things to worry about if a three letter agency is after you. This is for the regular police, and they won't even bother.

My grandmother passed away in the 60's. I still remember her number, and three others from those days.

All would serve as passcodes, custom numeric but not custom alphanumeric.

Hope that shoulder surfers don't have great memories or video. Bodycams?

There’s cameras everywhere, it’s not going to be someone breathing on your neck anymore.

Reply on news.ycombinator.com