{"id":161020,"date":"2016-04-10T13:01:00","date_gmt":"2016-04-10T11:01:00","guid":{"rendered":"http:\/\/mybroadband.co.za\/news\/?p=161020"},"modified":"2016-04-10T13:01:00","modified_gmt":"2016-04-10T11:01:00","slug":"how-safe-your-smartphone-lock-screen-is","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/161020-how-safe-your-smartphone-lock-screen-is.html","title":{"rendered":"How safe your smartphone lock screen is"},"content":{"rendered":"

One consequence of the Apple vs FBI<\/a> drama has been to shine a spotlight on the security of smartphone lock screens.<\/p>\n

The fact that the FBI managed to hack the iPhone<\/a> of the San Bernardino shooter without Apple\u2019s help raises questions about whether PIN codes and swipe patterns are as secure as we think.<\/p>\n

In fact, they\u2019re probably not as secure as we\u2019d hope. No device as complex as a smartphone or tablet is ever completely secure, but device manufactures and developers are still doing their best to keep your data safe.<\/p>\n

The first line of defence is your lock screen, typically protected by a PIN code or password.<\/p>\n

When it comes to smartphones, the humble four-digit PIN code is the most popular choice.<\/p>\n

Unfortunately, even ignoring terrible PIN combinations<\/a> such as \u201c1234\u201d, \u201c1111\u201d or \u201c7777\u201d, four-digit PIN codes are still incredibly weak, since there are only 10,000 unique possible PINs.<\/p>\n

If you lose your device, and there are no other protections, it would only take a couple of days for someone to find the correct PIN through brute force (i.e. attempting every combination of four-digit PIN).<\/p>\n

A random six-digit PIN will afford you better security, given that there are a million possible combinations.<\/p>\n

However, with a weak PIN and a bit of time and luck, it\u2019s still possible for someone to bypass this using something like Rubber Ducky<\/a>, a tool designed to try every PIN combination without triggering other security mechanisms.<\/p>\n

Checks and balances<\/h3>\n

Fortunately, there other safeguards in place. On iPhones and iPads, for instance, there is a forced delay<\/a> of 80 milliseconds between PIN or password attempts.<\/p>\n

And after 10 incorrect attempts, the device will either time-out for increasing periods of time, lock out completely, or potentially delete all data permanently, depending on your settings.<\/p>\n

Similarly, Android<\/a> devices enforce time delays after a number of passcode or password entries. However, stock Android devices will not delete their contents after any number of incorrect entries.<\/p>\n

Swipe patterns are also a good security mechanism, as there are more possible combinations than a four-digit PIN.<\/p>\n

Additionally, you can\u2019t set your swipe pattern to be the same as your banking PIN or password, so if one is compromised, then the others remain secure.<\/p>\n

However, all of these security controls can potentially be thwarted.<\/p>\n

By simply observing the fingerprints on a device\u2019s display on an unclean screen, it is possible to discern a swipe pattern or passcode. When it comes to touch screen devices: cleanliness is next to secure-ness.<\/p>\n

Bypasses<\/h3>\n

Speaking of fingers, biometrics have increased in popularity recently. Biometric security controls simply means that traits of a human body can be used to identify someone and therefore unlock something.<\/p>\n

In the case of smartphones, there are competing systems that offer various levels of security. Android has facial, voice and fingerprint unlocking, while iOS has fingerprint unlocking only.<\/p>\n

Generally, biometrics on their own are not inherently secure.<\/p>\n

When used as the only protection mechanism, they\u2019re often very unreliable, either allowing too many unauthorised users to access a device (false positives), or by creating a frustrating user experience by locking out legitimate users (false negatives).<\/p>\n

Some methods of bypassing these biometric protections have been widely publicised, such as using a gummi bear<\/a> or PVA glue<\/a> to bypass Apple\u2019s TouchID, or using a picture to fool facial recognition on Android.<\/p>\n