Siri lets anyone use a locked iPhone 4S(cbsnews.com) |
Siri lets anyone use a locked iPhone 4S(cbsnews.com) |
> It's pretty surprising that Apple has the default
> set to be able to use Siri without unlocking the device.
People variously could and could not replicate it, until someone finally mentioned that the lock screen only shows if it's been locked for more than a (user-configurable) length of time.
So when people who never use the lock screen went to turn on the lock screen and immediately test it out, shockingly they didn't have to enter a PIN!
If it's enabled in that manner by default and lets you bypass the lock screen, then there's a serious problem.
What I'd really like is TPM-type security built into the phone (and used correctly) to protect from brute forcing a short authentication code, and maybe multi-factor auth. e.g. if the phone is inside my house or office (was on my secured wifi, hasn't moved), there can be less security (longer relock interval, shorter passcode, etc.) than if I am out and about. If there were a way to definitively link my phone to my car, I'd be fine with turning off all passcodes -- maybe due to bluetooth pairing or something.
Biometrics might actually make sense in phones, too, although I'm not sure how much I like the facial recognition in ice cream sandwich.
Biometrics are evil. If someone wants what's in your phone that bad, you don't want them cutting off your thumb to get it.
I'm not so afraid of someone's stealing my phone, then coming back and cutting off my thumb. If I were using the phone, it'd be easier to come up at gunpoint and grab the phone while it's unlocked, if you're that paranoid (one of the reasons highly sensitive data isn't unlocked "in the wild" in sensitive organizations).
Simple theft or losing the phone is still the most likely, and a biometric+PIN, securely stored on device, solves this.
High-end luxury cars have great engine immobilizer systems, which led to a lot of carjackings, since it was easier than unattended theft, which is basically the problem you've identified.
There are LOTS of other issues with biometrics, but they mainly come up when they're part of a centralized service and can't be completely controlled by the user.
Shocking.
> In a default setting, Siri let's [sic] a complete stranger see
> your calendar on your passcode locked iPhone 4S, as well as get
> contact information, make a call and send texts and e-mails.
Full of sound and fury, signifying nothing.
Agree that require unlocking is silly, but the whole point of locking is missing.
No, because that would encourage people to vocalize their passphrases.
Double click the home button to get the camera icon, go to camera and press home button and you can access all apps.
But if you try to go to the photo gallery, the phone tells you its locked and wont go there.
You know what else is reasonably obvious? Those checkboxes saying "Yes, I want to also subscribe to this other site for an addition 29.95", pre-checked on the final checkout screen.
It's not reasonably obvious that after turning the passcode on, that it effectively doesn't secure anything, and it's irresponsible to think that way.