iPhone passwords not worth the paper they're written on
Print
Retweet
FacebookPush two keys to bypass password
Posted in Mobile, 27th August 2008 10:42 GMT
Free whitepaper – The Register Guide to Enterprise Virtualization
iPhones protected by a password aren't actually protected at all, as just by pressing a few keys a miscreant can access all the phone's functions without needing the password at all.
The trick, reported by MacRumours, is simply a press of the "Emergency Call" key from the passcode entry screen, followed by a double-tap on the home button. That takes the miscreant into favourites, from which they can access the address book, from which they can get into the e-mail client (by tapping a contact's e-mail address) or the browser (by tapping a URL).
Clearly Apple has missed a trick here, and a fix should be quickly forthcoming, but it bodes badly for a device which is trying to sell itself into the enterprise and is already under fire for lacking important security features.
Concerned users can secure their devices by disabling the home button double-tap (Settings > General > Home Button > Checkmark Home), though it really shouldn't be working at all at that point.
Users might argue that a device password should never be relied upon, but one that is so trivial to bypass makes a mockery of the very concept. It's unlikely that this security problem will do more than attract ridicule to the iPhone security model, but it's ridicule that Apple could do without while they're trying so hard to have the iPhone taken seriously as a business device.
Free whitepaper – The Reg Guide to Solutions for the Virtual Era
Best Practices for producing smarter products
Grady Booch: Smarter products for a smarter planet
Five CIO challenges addressed by better change management
How IBM Stacks Up in Service Delivery for Data Centers
Smartphones 2010: Time for Operators to Take an End-to-End View
