Hacker News Reader

Comment by chatmasta | Hacker News Reader

If this were configurable, I would make it 30 minutes and increase it if I noticed any inconvenience. But I doubt that I would. I already have my phone in permanent do-not-disturb (so a reboot causing delayed notifications wouldn't be an issue), and it's not like I mind entering my passcode instead of FaceID every 30 minutes.

View on HN

I don't know where you live, but in the US it's basically understood by the courts that FaceID is not protected, but PIN is.

So if your threat model includes the sort of attacker that has a phone exploit or the ability to confiscate it, you should not be using FaceID. Instead, consider using six digit PIN with auto-delete after 10 attempts. Also enable Lockdown Mode And if you use iCloud, enable Advanced Data Protection.

Yeah, I consider FaceID to be basically a time-limited vulnerability akin to "remember me," because unlocking is a matter of just showing your face. It's convenient and I like it, but I don't get too upset when it asks me to enter a PIN (although I am annoyed when it doesn't respond well to the "swipe up to enter passcode").

Speaking of Face ID, I still use the iPhone SE (latest edition).

I like Touch ID and I like the small form factor.

I don't trust FaceID (technically, I don' trust the cops with FaceID), so I'm entering my (6 digit) PIN every time I take my phone out of my pocket anyway. The only thing that'd make me hesitate to set this down to single digit minutes would be the risk of missed calls/notifications while the phone reboots.

If you're outside the house that's less secure, because a security camera or a shoulder surfer can see your PIN.

Agreed. I don’t understand how someone would be careful to not use biometrics and yet use a six digit passcode instead of an alphanumeric password.

Graphene has a feature exactly for this which shows a shuffled unlock screen

This sounds like an excellent way to make it even easier for people to watch you enter your PIN.

Once you’ve had the PIN scramble turned on for a while, it becomes second nature. I enter my GrapheneOS scrambled PIN about as quickly as the unscrambled PIN on my non‐GrapheneOS work phone. But it’s more of a defense against figuring out my PIN from the finger marks on my screen.

In environments where shoulder surfing is a concern, I prefer to use the multiple profiles feature: log out of my main profile (which is actually a secondary profile) to completely evict its keys from memory, and switch to a burner secondary profile containing no personal data, which unlocks with my fingerprint for convenience.

I am curious what you do with a phone that has no personal data beyond, like, call people whose number you have memorized and maybe look something up

Second nature or not, I’m not sure how this protects you against the security camera watching you enter the passcode. I guess you’re hoping it can’t read the digit on each key?

30 minutes would be excessive. Keep in mind that the phone is unusable while it's rebooting, and that rebooting uses a nontrivial amount of power.

Rebooting takes ~7 seconds and ideally only happens when I attempt to use it.

But regardless of that.... why does it take a nontrivial amount of power?

Because booting is relatively CPU-intensive, compared to being at idle.

But iPhones do not boot in 7 seconds either — it's closer to 40. At least that's what it took on my 16 Pro Max right now when I tested it.

My iphone 15 just rebooted in 12 seconds.

Rebooted or turned on?

I had to create a shortcut to actually trigger a reboot, as I couldn’t find a reboot option in settings. My iPhone 13 mini on iOS 17.7.1 took 29 seconds.

wow. that's quick. my two year old galaxy takes ~37 seconds.

I'd love to know what model of iPhone you have a see a video of it shutting down and starting back up in 7 seconds. Sounds like an incredible piece of hardware.

Also you cannot read your notifications, if I am not wrong.

I think 3 days is actually perfect

Reply on news.ycombinator.com