Congressman's phone password is 111111

https://gfycat.com/uncommonacclaimedboar

by breadandcrumbel • 7 years ago

321 183 7 years ago

gfycat.com

ceejayoz11• 7 years ago

Aaaaaaand that's why these things aren't allowed in the SCIFs.

breadandcrumbel2• 7 years ago

In a normal company, if an employee have bad practice for data protection and cyber security he might get fired

But what happen when it's a congressman?

We start to see now more and more data breaches that happens due to lack of basic knowledge in this subject....

Just 3 days ago was reveal that Equifax used 'admin' as username and password for sensitive data. ( https://finance.yahoo.com/news/equifax-password-username-adm...? )

In this case I'm sure that the IT person who's in charge for the system just give zero value to data protection and cyber security....

According to an industry report by Shred-it, 47% of business leaders cited human error as the main cause of a data breach at their organization

https://www.perimeter81.com/blog/network/how-employees-open-...

Leave beside the fact that someone in this position should have better understanding of cyber security

I wonder if they get any kind of training from the government.

pjc50• 7 years ago

Bringing the phones into the "secure" CIF was just the icing on the cake of a straightforward attempt to disrupt the inquiry. It's a bit of direct action, almost like a sit-in. Presumably it's a crime, but not the sort that anyone is likely to be charged with if they have power.

derision• 7 years ago

Nothing classified was being discussed in the SCIF during that hearing according to a statement by one of the congressmen.

rvz• 7 years ago

That is a iPhone X like device, which only has Face ID or a PIN.

A PIN is more secure than a fingerprint and Face ID. But at least use a combination of either one with a PIN to make it more secure.

Since the device was already on and it directly showed the PIN screen, Face ID is disabled and instead he chooses to only use a very very weak PIN.

Oh dear.

ceejayoz11• 7 years ago

A PIN is more secure than a fingerprint and Face ID...

While generally true, this is probably not the case for someone who's regularly using their phone on camera like a Congressional rep.

falcolas• 7 years ago

Even being caught once entering your passcode on camera is enough to compromise it, regardless of how complex it is. A passphrase would possibly buy you more time (less discernible finger movement on a phone screen), but I would still consider it compromised.

thrower123• 7 years ago

I'd be curious if Apple had anonymous telemetry that showed what people were picking for their phone unlock PINs. Everyone I've ever seen set one does this same type of thing, either all one number, or they draw a line through the middle. The more advanced maybe use a date like their birthday that they can actually remember.

It's just security theater.

breadandcrumbel2• 7 years ago

Just checked what's the most popular PINs...

1234 1111 0000 1212 7777 1004 2000 4444 2222 6969 9999 3333 5555 6666 1122 1313 8888 4321 2001 1010

https://www.pocket-lint.com/phones/news/148224-these-are-the...

I'm not using any of this, but many of the people I know their PINs (family, girlfriend, close friends)

Are actually using something from this list

bristleworm• 7 years ago

No, PINs are not transmitted to Apple.

"What this process appears to show is that Apple never sees, handles, or stores your device passcode or password in unencrypted form, and it never passes the passcode or password over anything but secure transport. It requires only your Apple ID account name and password, sent over HTTPS, as the first stage of logging into iCloud, but not for the later stages."

Excerpt from: https://tidbits.com/2019/09/26/why-apple-asks-for-your-passc...

ralfd• 7 years ago

It has a notch, but I am unsure if it is an iPhone?

mcast• 7 years ago

It opened up to iMessages (blue and white conversations), it's an iPhone

tomatotomato37• 7 years ago

Yup, not sure why we expect good security practices out of a group who's average age is 60

kwanbix• 7 years ago

Why would age determine your intelligence?

moviuro5• 7 years ago

Nothing to do with intelligence either. Most people don't grasp the consequences of bad OPSEC, though they can fairly well understand why they should lock their door when away from home.

Those people lack education on the topic.

EvanAnderson• 7 years ago

In my 20+ years in IT I haven't found much correlation between age and security practices, personally.

moviuro5• 7 years ago

Can confirm: nobody cares about good OPSEC, be they at the bottom of the ladder, or in a bank's top management.

hairofadog• 7 years ago

I have worked with a few alpha types who considered themselves too important to waste time memorizing a password. I'm not sure if it's the case here, but I'd guess that brand of entitlement has a higher incidence rate within the halls of congress.

arielserafini• 7 years ago

tiny nitpick: "whose"

duxup8• 7 years ago

I tell this story a lot. But I think in the time of smartphones and such it also represents the only real secure site I thought was truly secure from what I knew of it. This was before smartphones were common, but I think it was ahead of its time in that way.

I worked for a company that occasionally would service some of our hardware onsite. One customer was a company that did a lot of work for the military and they had "that site" that a few folks visited. Here was how that worked:

Nothing except your body and your clothes left the site, anything you brought stayed onsite (laptops that we brought onsite were left behind / effectively disposable, later you couldn't even bring those, they provided one). All that stuff belonged to the military / whomever you interacted with at the site.

No electronics, cameras, etc that were not previously improved were allowed and you were told you would not be leaving anytime soon if you had something "unexpected or unauthorized".

It was highly suggested that nothing was in your rental car other than your keys, the equipment you needed as they searched the car and the folks would take what they wished.

If you realized you had something you didn't want to in the car it was highly suggested you do not turn around if you are at all close to the location and to drive up and immediately tell them you dorked up and brought something. This was a fairly remote location so the probabbly knew you were coming before you saw the gate and the guards didn't like surprises.

Upon arrival you parked, were blindfolded and driven from the gate to the site, you never actually saw the outside of the site until you were in the building. You were never alone at anytime. Trips to the bathroom while at the site were monitored... in person by a guard with a rifle.

Now all that sounds ominous but everyone reported that the folks there were very professional (not friendly but professional).

The point of that whole story was that even a while ago someone said "any electronics" were a threat and decided that they had to go to extremes to limit their access. Still today I think that was the closest to a "sure" policy.

laurencei• 7 years ago

If you knew the location of "the site" (because you drove to it) - what benefit was the blindfold for the site?

ssully• 7 years ago

I am guessing to obscure which building was which since the blind fold didn't come off until you were inside the building.

ceejayoz11• 7 years ago

Everyone knows roughly where Area 51 is, but that doesn't necessarily mean they'll let a contractor know where all the external security cameras are sited.

Cerium• 7 years ago

Not op, but if there are multiple buildings you won't be able to leak which one is working on what.

duxup8• 7 years ago

I'm guessing here because they don't tell you.

But at the gate you couldn't see much of anything. So you effectively never saw the outside of the site, and even parts of the inside of the building.

What you could see, where you could go, all of it seemed to be clearly planned ahead of time and it was just what was essential to complete the task.

nkrisc• 7 years ago

The location of the site is pretty pointless and impossible to obscure (everyone can find it in satellite imagery). However they can certainly obscure more specific details about the site: what building houses what, where access points are, physical security measures around those points, components used in entries, etc.

fma• 7 years ago

If "the site" was a building on a military base you'll still have no idea where the exact location is.

komali22• 7 years ago

Where was this? What was the "site?" What country? And what kind of work were they outsourcing to outside the military?

duxup8• 7 years ago

US.

No comment on the rest / some of it I honestly don't know.

None of the organizations involved share a lot of data / answer questions / you don't ask, and everything is designed around you not knowing.

ceejayoz11• 7 years ago

Given the intensity of the security described, I strongly suspect the answer to each of those questions is "I can't say".

We outsource pretty much anything to contractors, though.

HenryKissinger• 7 years ago

I'm guessing Cavalier, Mountain Home, or Tonopah.

eitally• 7 years ago

I'm not the original commenter but I'm familiar with policies like this. I grew up in Lynchburg, VA, where the Naval Nuclear Fuel facility is, operated by what was B&W. It had identical policies: everything that goes in, stays in, no one allowed in without clearance, no paper or electronics leave, air gapped computer network, etc. Not the monitored bathroom breaks, though....

cheschire• 7 years ago

I'm hoping they've implemented some form of localized EMP that you have to pass through now to leave, because large storage is so incredibly small now that it would be impossible to discern it from articles of clothing.

The "hard" part is really just getting the data off the computer in the first place, which is probably why they don't allow bringing in technology anymore.

I wonder how much of a micro computer could be smuggled in one or two parts at a time, stored in articles of clothing, with the intent of simply saving data to a micro SD card which would be the only thing you need to smuggle back out. You would need to be able to assemble the device without soldering.

I guess the easiest would be to build a digital camera to record the screen or photos instead of trying to plug into the computers themselves which probably have robust host intrustion detection and prevention. Or perhaps if you could just record the digital output of the computer before it reaches the monitor. That could be prevented with some form of HDCP though, I think.

This all sounds kind of like a science fiction movie (or In the Line of Fire or that Snowden movie) but it's an interesting thought exercise in any case.

duxup8• 7 years ago

Yeah this was long ago so I've no idea what their policies are now.

Pure speculation: I have to imagine they take further steps now as what is "no electronics" now isn't reliably what you can easily see now.

zerocrates• 7 years ago

I'm hoping they've implemented some form of localized EMP

What would that do to, say, an artificial pacemaker? Feels a little, as you say, science fiction.

Roark662• 7 years ago

The "localised EMP" you mention could simply be a low power microwave oven of same type we have in our kitchens you have to walk through. Waves of that frequency would not harm a person if they were fairly low power, but it would mess up every bit of non-metal-shielded electronics.

If you want to destroy a piece of electronics quickly put it in a microwave oven and hit start (also don't expect to eat from that oven later - plastic residue etc if it heats up that much is probably not safe to eat). This will destroy usb keys and storage on them, SSDs, laptops, smartphones and data on them. The only kind of data safe is magnetic type hard drives, but they become less and less common these days.

You could even make a kind of "wand" similar to what guys at the airport have for pinpointing metal items on people. Wave it around someone suspected of having a listening or recording device - job done.

Simon_says• 7 years ago

What if you stick the flash drive up really far up your bum? Wouldn't the saltwater in your body form a Faraday cage around it?

netsharc2• 7 years ago

The boindfolds seem like extra work, I would just get a SUV and totally black out the rear, or well, put in some seats in the rear of a delivery van.

But I guess the boindfolds also had a psychological effect of "we mean business".

kbenson2• 7 years ago

A blindfold allows someone to be in close proximity to the person while also retain g visibility and communication with that person and other people (e.g. the driver).

If you lack out a special cabi area for a vehicle, either you are leaving them to their own devices in that area, or limiting the senses of your own staff you put in to watch them.

Finally, it's just a lot more expensive and cumbersome to have a large piece of machinery like that, and more likely to fail. What happens if the engine fails? Do you need a spare now? Using a blindfold as backup means that a blindfold is sufficient, so just use it and any vehicle now works.

duxup8• 7 years ago

Yeah that could be true.

I did a poor / vague job of describing that the blindfold was used inside buildings too. Folks walked with their hand on the shoulder of a guard in front of them from time to time.

netsharc2• 7 years ago

How did I misspell "blindfolds" twice!

oauea• 7 years ago

Why would you be willing to work in such conditions? If my employer demanded to send me to such a facility I would happily tell them to shove it and look for another job.

duxup8• 7 years ago

It wasn't a daily thing. It was a rare event for anyone to make that trip.

Most of the time we worked with traditional commercial customers that while some were secure, were nothing like I described.

Nobody seemed to have any concern with the policies / security.

Guph• 7 years ago

wow, me working on FEMA's backups was no where near this secure.(no blinkfolds and guarded all the time inside)

But yea, same thing with them being well aware of your arrival before you show up.

It was their underground bunk backup site near DC, think it was Baltimore area. Drove up to a guard in front of chain link fence.

tzs• 7 years ago

A friend of mine had an amusing story about a visit to a secure facility. He was an engineer in the late '80s or early '90s at company that made some kind of custom text search hardware. He was sent to a customer site to do some service on one of the machines.

The customer was some government intelligence agency (he didn't tell me which one). The machine was in a small room, which also had a printer. To get to that room, you had to walk through a big room full of workers at desks.

Before entering that big room, his escort would press a button beside the door that apparently signaled to those in the room that an outsider was going to come through. That would make some audible signal in the room, and start some red lights flashing on the ceiling. Everyone in the room then had to clear their desks, putting all their papers in their drawers and locking them, and returning the most secret document to their safes.

When all that was done, everyone returned to their desks and then someone would open the door, my friend's escort would tell him to not look around, and would escort him through to the room with the machine. The door would be closed and locked, with my friend and the escort in the machine room, and my friend could work on the machine. Out in the big room, the workers would take their work back out and go back to work.

Occasionally, someone in the big room wanted to use the printer in the machine room. Before they could do that, my friend had to be escorted out of the machine room, back through the big room, and out to the corridor...going through that whole "secure the room so an outsider can pass through" procedure to get back out, and then to get back in after the printout had been retrieved.

Unfortunately, my friend had a lunch that day which disagreed with him somewhat, so that afternoon there were also a few times he needed to get to the bathroom, which of course required going through the big room each time.

roenxi3• 7 years ago

111111 is perfectly acceptable for a phone password. His password was just broadcast to the entire world; at least using 111111 means that he doesn't have any illusions about how secure it is.

Phone passwords are for protecting things from your family.

davvolun• 7 years ago

???

I think Apple and the FBI disagree

https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_d...

code_duck3• 7 years ago

Phone passwords are for protecting things from your family.

I think what you actually mean is anyone who has physical access to your phone. If you lose your phone or it is taken by authorities, then you are at risk of having strangers access your data.

roenxi3• 7 years ago

Strangers already have access to all my data; I use Gmail [0] for most of my important personal emailing, metadata like website browsing habits is already snoop-able. iMessages might be secure, but there isn't anything substantial there that can't be dug up elsewhere.

If this guy was relying on any password to protect his phone from physical access then he is in for a nasty shock - whatever his password was, his adversaries would know it after this video. That fact that it was 111111 doesn't actually change anything.

He's in the US government. If he is up to something and he has enemies; it will get leaked. If he doesn't have enemies the lack of security isn't so terrible. His work is supposed to all be in the public eye anyway.

[0] https://nakedsecurity.sophos.com/2018/09/06/ungagged-google-...

authoritarian• 7 years ago

Phone passwords are for protecting things from your family.

That's a bit of a sad, unusual sentiment

roenxi3• 7 years ago

Well I can expend that to friends as well if you like. Who do you think your password is protecting you from? Are you frequently at odds with law enforcement?

Most people aren't; it isn't a feature to protect people from governments (I wish we had more features that did). Encryption is a good thing in a general sense but for most users they are more likely to lock themselves out of their own data than protect themselves from anything outside their close friends and family.

securingsincity• 7 years ago

I'm not an iPhone user but I thought that Apple warned you about this kind of password. It was covered quite a bit when Kanye was caught with a 000000 password when meeting with Trump.

https://www.cnet.com/news/kanye-west-meets-with-trump-reveal...

ceejayoz11• 7 years ago

I don't think any PIN is gonna survive the "we've got video of you entering it" attack.

vuln2• 7 years ago

Maybe the phone is attached to a MDM that requires a PIN.

angry_octet3• 7 years ago

There are lots of orgs with dumb MDM policies, but I doubt Congress is enforcing that one. MDMs usually prevent simple passwords like that (though not equally simple ones like 989898...).

vuln2• 7 years ago

It looks like they require a PIN but disallow repeating characters. Here's the Security Technical Implementation Guide[0].

[0]https://www.stigviewer.com/stig/apple_ios_8_interim_security...

ydnaclementine• 7 years ago

I always thought that Android's 3x3 dot pattern draw password thing was superior against these type of over the shoulder attack, as long as you turn off the tracing effect. Without tracing and if you do it quickly, it just looks like you’re dragging your thumb randomly all over the phone.

fbnlsr• 7 years ago

More importantly, Android's pattern draw allows the user to pass on an already traced line. That way you can't guess the pattern just by looking at the screen smudges.

psychometry4• 7 years ago

Sorry, I don't understand what you're trying to say. Why can't you guess the pattern by looking at the smudges?

hanniabu2• 7 years ago

Is there a reason why the numbers aren't scrambled? This way you at least wouldn't be able to tell the password unless you saw the actual numbers.

gambiting2• 7 years ago

I can't imagine a more annoying feature. My bank already does this where I cannot use the keyboard to type in digits, I have to use their own on-screen keyboard that's scrambled between every digit(!!!) and I can't imagine anything like that anywhere near my phone. Either pin-based protection is good enough for you, or if you need more security then switch to full a-Z password.

bszupnick• 7 years ago

Imagine how inconvenient that would be i.e. how much "phone engagement" would take a hit.

rtkwe• 7 years ago

It's an absolute pain in the ass for the user, especially something you're going to be asked to enter multiple times an hour potentially. I play a game that has a 'bank pin' and they scramble the location of the digits and it slows you down a lot and makes you look and think about it every time you enter it. It's a pain and I only have to enter it after 10 minutes of inactivity.

acranox• 7 years ago

That would screw me over. My passphrases tend to be based on a physical pattern of the keys. I can't actually tell you what my phone code is. I just know the order I push the buttons. Similarly, if I have to type me computer passphrase on a non-qwerty keyboard, I couldn't do it. I don't actually know the letters, I just know the pattern on the keyboard.

If the numbers were scrambled, I'd have to pick a new system to select a password.

abandonliberty• 7 years ago

I had an android variant with this feature once.

mrlala• 7 years ago

Somehow I doubt this in practice still though.. my wife turned hers on, and it's the most obvious pattern you would think of.

And honestly I set it to the same, just because it's the most convenient to use. If I make a convoluted pattern I won't be able to do it as easily.

So still same old crap.. we tend to go to thinks we can remember and easily do- and that is not the most secure.

drivers99• 7 years ago

it's the most obvious pattern you would think of.

First initial probably.

honestly I set it to the same

Hmm. If it's the same, last name then? Maybe a diamond or something. I heard (Mitnick's book about best practices called The Art of Invisibility, chapter 1) many people don't use the corner dots very often, or they use an initial of their name.

I unintentionally can see people's phone patterns when they do it in view. At least with a passcode you can usually try to ignore it, or you have to try to pay attention. Those pattern ones show it visually in a way that's hard to ignore.

kevin_thibedeau• 7 years ago

I did too until a few months ago that my pattern lock stopped working and I had to do a factory restore.

smashface• 7 years ago

I prefer to use the draw password but honestly if you look at the finger smudges on my phone, you could probably still guess my pattern.

r1ch• 7 years ago

I once got a friend's iPhone passcode correct first try by looking at finger smudges. If you're entering a passcode frequently it's definitely a risk to be aware of.

chucksmash• 7 years ago

Yep, pretty easy to do - especially if your pattern is recognizable or doesn't cross over itself.

"Oh hey, cool, a Σ!"

piotrkubisa2• 7 years ago

I liked BlackBerry10 picture passwords [0][1]. Unlocking was a bit slower than drawing few lines but good enough to unlock device fast - I'd say even if you were weakened by some disease/illness/exhausting workout moving slowly a number to target is easier than drawing few crossed lines.

[0] https://helpblog.blackberry.com/2014/02/how-to-use-picture-p...

[1] https://youtu.be/WmBhvn9Q9SE?t=151

Roark662• 7 years ago

Well, if you had a flir camera looking over your shoulder the tracing effect (caused by localised heating of the screen) would still be there. I actually heard it is a legit method to defeat pin entry systems. If you can get to the terminal soon enough it was used, relevant keys will be a little hotter than the other. This will be visible with flir. Then all you have to do is figure out the order of digits.

Someone1234• 7 years ago

If you have any camera (FLIR or otherwise) "looking over your shoulder" the method of secret entry is irrelevant.

1023bytes• 7 years ago

You can often see these very obvious smudges on the screen

piotrkubisa2• 7 years ago

This, 1000x this! The whole "draw your code" is equal to 111111 codes, because both operations are easily possible to hack if you leave your phone to your peer or random freak. Isn't it the same issue as in many house alarm systems that you just need some UV light to note the most used keys to guess the code?

99052882514569• 7 years ago

There are lots of obvious smudges on my screen, and the ones I made first thing after picking up my phone never stand out.

wayneftw5• 7 years ago

I don't lock my phone at all. Never have. However, with the new iPhones that don't have a home button, I believe that Apple is forcing you to either use face unlock or a passcode. There is no choice to just leave it unlocked.

So, as soon as my iPhone 6s stops working, I will have to choose to: 1) Give in and use my face to unlock. 2) Use a dumb passcode like 000000. 3) Upgrade to the newest iPhone that still has a home button (I think iPhone 8) or 4) Become and Android user.

abstractbeliefs• 7 years ago

Why is it that you choose not to?

I think it would be helpful to understand your use case and how you balance your personal tolerance for risk and consequences so we can better consider users like yourself.

_jal• 7 years ago

(Not the OP.)

I have an older phone that is basically a home remote for various things. There is no reason for it to lock, it would be annoying.

Dragonai• 7 years ago

Comments like the parent comment never fail to fascinate me - far and away, I have never seen more uncommon/unusual use cases for pretty much anything than I do on Hacker News. I don't mean that in a negative way at all, I mean it's just amazing how diverse a crowd we have on here and I love how many perspectives we end up seeing in the comments.

barneygumble742• 7 years ago

My phone never leaves my sight. I don't do mobile banking of any kind. I can sign out/remotely wipe the device via the web. It would be nice to remotely turn ON the GPS to find my phone but Android has since removed the remote GPS ON feature.

If only I can find a smartphone for talk/text/web/GPS, I'd be switch in a heartbeat. I'm seriously getting sick of the all the security features that tend to bloat the device and slow it to a crawl.

That being said, if my phone was vulnerable to theft or I wasn't so careful, I would lock my screen.

droithomme• 7 years ago

Not him but I also leave my iPhone wide open.

I primarily use it as a camera and tape recorder. And mobile wifi web browser with retina resolution in rare cases, all in which I specifically avoid using it to use any sites that require logging in.

I have a fake name on it. There are no contacts or email accounts set up on it.

It's not ever been activated as a cell phone.

Basically, I see no reason to have a password on it, and a password slows things down slightly and has the risk of forgetting (since I never reuse passwords), so why bother.

My Android phone that I do use as a cell phone though I have a password on it. It has similarly few personal details, but the call logs would make it easy to identify me.

Granted the iPhone's location logging though disabled might be storing info anyway, and probably the photos are GPS tagged, so those things would identify me.

dpcan• 7 years ago

I think your point may be that he doesn't have anything private on the phone to worry about or anything that needs to be kept secure?

I think the argument hidden in the headline here is that since this is a device owned by a congressman, and allowed inside this particular meeting, it has information on it that may be confidential, and therefore needs a much stronger password.

My phone has access to my email, phone number, texting.

With these 3 things you can get into my bank account, access to my domains, and into any online account I hold.

Then, personally and professionally, I manage other peoples' accounts, so, with my phone, you can probably social-engineer your way into those as well.

My point is, if you are married, have a job, email, or have other people in your life that you don't want to go through an identity theft crisis, or get hacked, stalked, etc, you should lock your phone.

Maybe you aren't the target, but you are the wide-open back door into their life.

wayneftw5• 7 years ago

Nobody in my contacts has given me non-public contact info such as secret phone numbers, email addresses or other such info.

I don't manage other peoples accounts from my phone.

My passwords are stored in an encrypted file, accessible only by entering my pin.

My email app has a pin lock.

I don't use the browser to login to any important sites like banking sites.

If you get my phone, the most you can do is order something for me on Amazon (it will be shipped to me, else you have to enter your own credit card) or you can mess with my GitHub content.

t0mbstone• 7 years ago

On the flip side, one could also argue that as a public employee, everything that congressman does should be on the public record out in the light for everyone to see, and that the best security would actually be zero security.

This would also have the positive side effect of making it really hard for public employees to engage in corrupt and illicit behavior (which, as we all know, is so rampant that it's practically industry standard at this point).

weaksauce2• 7 years ago

I was just using an iPhone without a home button and you don’t need a passcode or facial recognition to use it. Just swipe up from the bottom.

probablyexists• 7 years ago

I'm not sure I follow...

You don't need a passcode or facial recognition to access any phone that doesn't have those features enabled.

If you enable them you certainly do.

psychometry4• 7 years ago

How do all the people you communicate with via email, text, etc., feel about their contact information and messages with you being so easily accessible? Securing your devices isn't just about you...

wayneftw5• 7 years ago

They're absolutely fine with it. Contact information isn't secret.

wycy2• 7 years ago

Why do you not want to use your face? And I don't think the lack of a home button changes whether or not you have to use a passcode. I haven't seen anything to indicate that the new iPhones can't be passcodeless (though I don't want to clear my FaceID data to test this). Just swipe up to unlock.

wayneftw5• 7 years ago

Thanks for this! I'll go to the Apple store and test it.

berdon• 7 years ago

5) Accept responsibility and lock your device

swozey2• 7 years ago

When I was a kid my house was "broken into" but because the door was unlocked the police couldn't qualify it as breaking and entering. It was merely trespassing and my neighbor who did it got off. I was 12, these details may be a bit fuzzy. I chased the guy off so nothing was taken, he just walked in, saw me running to the door and ran back out. Supposedly he was just drunk and wandered into the wrong house anyway.

I'm curious what affect not locking your phone might have on police reports if your identity/etc is ever stolen and you need to provide police reports. Possibly nothing, but I can imagine some credit cards legal team working hard on that aspect of things in the event you're trying to convince AMEX to return $40k of transactions you supposedly didn't make yourself and need reversed because your phone was swiped while logged into some CC app and they copied your card number.

dwild3• 7 years ago

Supposedly he was just drunk and wandered into the wrong house anyway.

That's what made him fine, not the fact that you didn't lock.

That's a thing that quite misunderstood, but for a crime to be committed, you need criminal intent. If you just made a mistake and weren't aware it wasn't your house, it's not a crime to enter it.

alphabettsy• 7 years ago

You can still choose not to have a passcode on newer iPhones.

That said, I have a really good friend that chooses not to use a passcode for their phone.

Somewhat irritating because being a really close friend we sometimes have very personal conversations via text, and the fact the they don’t lock their phone means I have to be conscious of that. These aren’t deep-dark secrets, but still personal things I wouldn’t share publicly.

boonez123• 7 years ago

Looks like 777777 to me.

chooseaname• 7 years ago

Exactly. This appears to be an iPhone, so it would be all 7s.

samanator• 7 years ago

What does it being an Iphone have to do with the orientation of the numberpad?

drtillberg• 7 years ago

The problem isn't the password or the camera that captured it.

The problem is that the phone required a password in that scenario-- same user, phone never left his vicinity, probably not a long interval between uses. Being more selective about when to require a master password is a better protection model IMHO.

TheHypnotist• 7 years ago

Non-complex passwords are routinely an issue. Unless he's staring at his phone, it's good practice to prompt for a password.

Redoubts• 7 years ago

I'm really surprised he doesn't just use FaceID in this case.

lotsofpulp• 7 years ago

Considering the better protection model doesn't exist yet, and the password is the best option we have, the password is the problem.

ehsankia• 7 years ago

Soli on the new Pixel 4 could easily allow that.

jedieaston• 7 years ago

Or fingerprint readers, which most phones have had for years. It's possible that the DoD standards for the phone he has requires that biometrics be disabled.

_pmf_• 7 years ago

Still safer than using an off-brand or Smasung fingerprint sensor.

agumonkey• 7 years ago

are they so easy to pwn ?

html5web• 7 years ago

Check this https://www.cnn.com/2019/10/18/tech/samsung-fingerprint-read...

angry_octet3• 7 years ago

Only if you teach it your fingerprint after you put the screen protector on.

diafygi• 7 years ago

I wonder what AI tech is being developed around detecting pin code entry on phones using passive CCTV networks.

If you process the feeds for public transit security cameras, I wouldn't be surprised if you can read the pin codes for a huge swath of the population. It would also reduce the need for law enforcement to try to get a suspect to tell them their passcode. Just look up that time they rode the subway 3 weeks ago and watch them enter it.

Maximus9000• 7 years ago

I often notice this at gas pumps. There are always cameras at gas pumps. If you pay at the pump, then you enter your pin. I shield mine very carefully, but I watch other people and they just punch in their pin without shielding. It's weird because people often shield their pin at a checkout counter because the clerk is right there (sort of) watching. Maybe these people feel at gas pumps, no one is watching... but the CCTV definitely is watching.

mdszy• 7 years ago

And as someone who has worked as a cashier, it is BLATANTLY obvious when someone's pin is 1111 or 1234. No matter how hard they try to shield it.

Jill_the_Pill2• 7 years ago

But it's not enough to know someone's code. So what if you do? Unless you can get the physical card without the owner knowing, what good would it do you?

manigandham3• 7 years ago

Isn’t the real problem here that this was caught on video? Otherwise it’s just as secure as any other code.

code_duck3• 7 years ago

I think the idea is that it's easily guessed/cracked in ways other than watching him in video.

philshem• 7 years ago

If you obtained this phone without seeing the video, a singular oil smudge on the number 1 surely gives it away.

damq• 7 years ago

This would imply the only thing he uses his phone for is to type in his passcode.

manigandham3• 7 years ago

It's a touchscreen phone, not a keypad. Everything would be smudged.

kerkeslager2• 7 years ago

No, it is not. These sorts of "I'm annoyed that I'm being forced to put in a password so I'll put the easiest one to type" passwords are in even the most basic password dictionaries, and are therefore susceptible to dictionary attack.

gambiting2• 7 years ago

Sure, but if your angle of attack is "someone swiped my phone off my desk and wants to unlock it within the next 30 minutes before I wipe it remotely" then 111111 is as good as literally any other 6-digit pin code, unless the attacker just tries 111111. In which case 999999 is probably a better choice.

dbg31415• 7 years ago

These are the people who are grilling Zuck?

Our communications, privacy, and security, are in good hands! Ugh.

ceejayoz11• 7 years ago

Zuck didn't exactly give off an aura of competence at said hearings.

ChicagoBoy11• 7 years ago

and it won't matter at all!

jdlyga• 7 years ago

Remind me to change the combination on my luggage

rbobby• 7 years ago

Me too!!

rerpha• 7 years ago

and they say millennials are on their phones too much!

slg3• 7 years ago

And yesterday over a dozen members of Congress barged into one of the Congressional versions of this site without authorization and while recording video, audio, and taking photos on their personal smartphones.

Here is a Twitter thread about why that is such a problem:

https://twitter.com/MiekeEoyang/status/1187032800572125191

dang2• 7 years ago

Please don't take HN threads into political flamewar.

We detached this subthread from https://news.ycombinator.com/item?id=21344785 and marked it off-topic.

slg3• 7 years ago

Just trying to be a better HN citizen, so is there something specific I did wrong here that crossed a line or is it just a "know it when I see it" situation? I didn't reference anything partisan and was simply relating a recent political event to both the general topic of poor congressional cybersecurity and the specific topic that duxup was talking about regarding securing a site from electronic devices. It was the response to my comment that was sparking a partisan flamewar.

breakerbox• 7 years ago

If I were giving a security recommendation to famous people and congresspeople I would recommend using a password like this. You might think it’s incredibly insecure, but imagine this GIF contained that 6 digit number that the congressman uses for all of his accounts. Suddenly, a ton of other services and passwords are vulnerable to an attacker.

In reality a lot of iPhones now require authentication at the app level for apps that have sensitive data.

To each his own, but knowing how public you are and how many people would want your passcode, I think the best practice is to use something dumb like 6 of the same keys.

stingraycharles• 7 years ago

In reality a lot of iPhones now require authentication at the app level for apps that have sensitive data.

I'm fairly certain that knowing my passcode would provide access to my email, which can then be used to acquire access to plenty of critical services.

kobayashi• 7 years ago

This is itself bad advice. The proper solution is a truly random password, committed to memory, and all others being stored in a password manager, which is itself secured by a separate strong password

dorfsmay• 7 years ago

The one thing I miss from CyanogenMod: keyboard key orders scrambled for each use.

I wish LineageOS and stock Android added that feature.

onychomys• 7 years ago

So who is that? I'm not up on my random member of congress identification skills.

therealrootuser• 7 years ago

This. I just went through every picture in the latest available Congressional Pictorial Directory, and I wasn't able to make a 100% sure identification, but my best guess was Rep. Andy Barr (Kentucky).

rezmeplease• 7 years ago

this really illustrates how we live in a society

someonehere2• 7 years ago

I worked for a well known company today, many years ago when it was smaller. When the IT team created new accounts for employees, it was the standard Pa$$word password for everyone. It was up to the user to change their password. They had no password rotating rules or requirements.

Anyway, many years later after I started, IT hires a person who wants to do good while in IT. This person discovers the CEO is still using the day one password he was given. The IT person decides to email the CTO, the director of IT, and the head of HR warning them the CEO is still using his default password.

I’m not clear what exactly the wording was, but the IT person skipping over the chain of command was bad enough it got them fired.

shoo• 7 years ago

IT person skipping over the chain of command was bad enough it got them fired.

Isn't this roughly the opposite of what you want in an org? Otherwise there can be the failure mode of only good news getting reported up, so the folks running the company base their decisions on finely cultivated bullshit and are completely isolated from reality.

someonehere2• 7 years ago

Management in IT was big on chain of command at that time. If the director of IT was insecure and wanted to filter bad news through him before going further up. Because this person went to the director’s boss, it angered the director.

Congressman's phone password is 111111

Related Stories