PSA: You Need A Stronger iPhone Passcode

This story for The New York Times by Jack Nicas is primarily about the Pensacola shooter’s iPhone, (a story that we commented on a few days ago to highlight the danger of the FBI’s public attack on encryption), but it raises another good point about device security. Machines exist that are capable of unlocking Apple devices via a brute force method that tricks the iPhone or iPad into allowing an unlimited number of passcode attempts in quick succession. Essentially, this means that one of these devices could break into your phone in as little as a few minutes.

A four-number passcode, the previous default length, would take on average about seven minutes to guess. If it’s six digits [the current default length], it would take on average about 11 hours. Eight digits: 46 days. Ten digits: 12.5 years.

If the passcode uses both numbers and letters, there are far more possible passcodes — and thus cracking it takes much longer. A six-character alphanumeric passcode would take on average 72 years to guess.

The point is that you need to use a strong passcode if you want to truly protect yourself from brute force threats like those posed by anyone in possession of one of these aggressive little boxes, whether that’s law enforcement or an individual will ill intent who manages to get their hands on one of them. Apple does all they can to fix bugs that allow these devices to work, but there’s only so much they can do: security is a cat and mouse game, and you’ve gotta look out for yourself. I’ve been using a seven digit alphanumeric passcode for about two years, and it hardly takes any longer to punch in than the six digit passcode you’re probably already using. Plus, if you’re using Touch ID or Face ID, you probably don’t type in your passcode most of the time when you unlock your device anyway.

To set up an alphanumeric passcode on your iOS device, open Settings → Face ID & Passcode (it may say “Touch ID & Passcode”, depending on what device you have). It will then prompt you to enter your current password. After you’ve punched it in, tap “Change Passcode”. It will prompt you to enter your passcode again, and then slide to the next screen where you can either enter a new passcode. Above the keypad, tap “Passcode Options”, and select “Custom Alphanumeric Code”. This will allow you to set up a passcode that uses a combination of numbers and letters: be sure to include at least one of each, maybe an uppercase letter, and shoot for at least 6 characters. After you enter the new passcode, it will have you confirm it, and then you’re done! Congrats, you just protected your iPhone for about 70 years worth of underhanded, illegitimate, brute force passcode attempts.