201–206 of 206 posts
I always thought that Android's 3x3 dot pattern draw password thing was superior against these type of over the shoulder attack, as long as you turn off the tracing effect. Without tracing and if you do it quickly, it just looks like you’re dragging your thumb randomly all over the phone.
Is there a reason why the numbers aren't scrambled? This way you at least wouldn't be able to tell the password unless you saw the actual numbers.
Maybe the phone is attached to a MDM that requires a PIN.
There are lots of orgs with dumb MDM policies, but I doubt Congress is enforcing that one. MDMs usually prevent simple passwords like that (though not equally simple ones like 989898...).
[0]https://www.stigviewer.com/stig/apple_ios_8_interim_security...
I worked for a well known company today, many years ago when it was smaller. When the IT team created new accounts for employees, it was the standard Pa$$word password for everyone. It was up to the user to change their password. They had no password rotating rules or requirements. Anyway, many years later after I started, IT hires a person who wants to do good while in IT. This person discovers the CEO is still usin…
> IT person skipping over the chain of command was bad enough it got them fired. Isn't this roughly the opposite of what you want in an org? Otherwise there can be the failure mode of only good news getting reported up, so the folks running the company base their decisions on finely cultivated bullshit and are completely isolated from reality.
I always thought that Android's 3x3 dot pattern draw password thing was superior against these type of over the shoulder attack, as long as you turn off the tracing effect. Without tracing and if you do it quickly, it just looks like you’re dragging your thumb randomly all over the phone.
You can often see these very obvious smudges on the screen
Earlier quoted context omitted.
There are lots of orgs with dumb MDM policies, but I doubt Congress is enforcing that one. MDMs usually prevent simple passwords like that (though not equally simple ones like 989898...).
It looks like they require a PIN but disallow repeating characters. Here's the Security Technical Implementation Guide[0]. [0] https://www.stigviewer.com/stig/apple_ios_8_interim_security...
DoD and ASD still don't like biometrics, in ASDs case because the want to see how it works: https://www.cyber.gov.au/publications/security-configuration...
Biometrics like iris scanners and palm prints are used everywhere for high security govt installations, but I guess they have been tested by spooks.
Earlier quoted context omitted.
>Phone passwords are for protecting things from your family. I think what you actually mean is anyone who has physical access to your phone. If you lose your phone or it is taken by authorities, then you are at risk of having strangers access your data.
Strangers already have access to all my data; I use Gmail [0] for most of my important personal emailing, metadata like website browsing habits is already snoop-able. iMessages might be secure, but there isn't anything substantial there that can't be dug up elsewhere. If this guy was relying on any password to protect his phone from physical access then he is in for a nasty shock - whatever his password was, his adve…
Generally a random people do not have access to your Gmail account.
The fact that the password is so simple makes it much easier to discern the from the video.
Just because his work is in the public eye for the government does not mean everything he does on the phone is supposed to be open to the public.