Hacker News Reader

Comment by bigiain | Hacker News Reader

I don't trust FaceID (technically, I don' trust the cops with FaceID), so I'm entering my (6 digit) PIN every time I take my phone out of my pocket anyway. The only thing that'd make me hesitate to set this down to single digit minutes would be the risk of missed calls/notifications while the phone reboots.

View on HN

If you're outside the house that's less secure, because a security camera or a shoulder surfer can see your PIN.

Agreed. I don’t understand how someone would be careful to not use biometrics and yet use a six digit passcode instead of an alphanumeric password.

Graphene has a feature exactly for this which shows a shuffled unlock screen

This sounds like an excellent way to make it even easier for people to watch you enter your PIN.

Once you’ve had the PIN scramble turned on for a while, it becomes second nature. I enter my GrapheneOS scrambled PIN about as quickly as the unscrambled PIN on my non‐GrapheneOS work phone. But it’s more of a defense against figuring out my PIN from the finger marks on my screen.

In environments where shoulder surfing is a concern, I prefer to use the multiple profiles feature: log out of my main profile (which is actually a secondary profile) to completely evict its keys from memory, and switch to a burner secondary profile containing no personal data, which unlocks with my fingerprint for convenience.

Second nature or not, I’m not sure how this protects you against the security camera watching you enter the passcode. I guess you’re hoping it can’t read the digit on each key?

I am curious what you do with a phone that has no personal data beyond, like, call people whose number you have memorized and maybe look something up

Reply on news.ycombinator.com