touch-packages team mailing list archive

[Jamie Strandboge <jamie@xxxxxxxxxx>]

** Summary changed:

- require 'Enter' key when entering PIN
+ please allow PINs of variable length and require 'Enter' key when entering PIN

** Description changed:

- If I set a PIN on the device, I am prompted to enter it on screen unlock
- (great!). Right now, the lockscreen checks the PIN as you type so that
- you don't have press Enter. I guess this was done for usability, but it
- is a security issue because an attacker can easily determine the PIN
- length, which makes it easier to for an attacker to guess the PIN. Eg,
- if I have a 2 digit PIN set, then an attacker need only type '111' and
- know that the PIN is only two characters. Now, a PIN isn't strong to
- begin with and an automated attack could rather quickly brute force
- PINs, but we shouldn't make it easier for someone manually trying to
- guess the PIN.
+ Currently when setting a PIN on the device, it must be 4 digits. This is
+ artificially limiting. Other platforms (eg Android) allow longer PINs.
  
- The passphrase lockscreen  promptcorrectly requires you to press Enter.
+ However, once longer PINs are supported, we will have to add an Enter
+ key. Right now, the lockscreen checks the PIN once 4 digits are added so
+ that you don't have to press Enter. I guess this was done for usability,
+ but would be a security issue because an attacker can easily determine
+ the PIN length, which makes it easier to for an attacker to guess the
+ PIN. Eg, if I have a 5 digit PIN set, then an attacker need only type
+ '11111' and know that the PIN is only five characters. Now, a PIN isn't
+ strong to begin with and an automated attack could rather quickly brute
+ force PINs, but we shouldn't make it easier for someone manually trying
+ to guess the PIN.
+ 
+ The passphrase lockscreen prompt correctly allows variable length
+ passphrases and requires you to press Enter.
  
  I suggest moving the 'X' up t the left of '0' and an Enter symbol to the
  rigth of '0'.

** Description changed:

  Currently when setting a PIN on the device, it must be 4 digits. This is
  artificially limiting. Other platforms (eg Android) allow longer PINs.
+ It has always been my understanding that we should support Swipe,
+ Passphrase and PIN where Passphrase and PIN can be arbitrarily long.
  
  However, once longer PINs are supported, we will have to add an Enter
  key. Right now, the lockscreen checks the PIN once 4 digits are added so
  that you don't have to press Enter. I guess this was done for usability,
  but would be a security issue because an attacker can easily determine
  the PIN length, which makes it easier to for an attacker to guess the
  PIN. Eg, if I have a 5 digit PIN set, then an attacker need only type
  '11111' and know that the PIN is only five characters. Now, a PIN isn't
  strong to begin with and an automated attack could rather quickly brute
  force PINs, but we shouldn't make it easier for someone manually trying
  to guess the PIN.
  
  The passphrase lockscreen prompt correctly allows variable length
  passphrases and requires you to press Enter.
  
  I suggest moving the 'X' up t the left of '0' and an Enter symbol to the
  rigth of '0'.

** Summary changed:

- please allow PINs of variable length and require 'Enter' key when entering PIN
+ allow PINs of variable length instead of just 4 digits

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to unity8 in Ubuntu.
https://bugs.launchpad.net/bugs/1363214

Title:
  allow PINs of variable length instead of just 4 digits

Status in “unity8” package in Ubuntu:
  New

Bug description:
  Currently when setting a PIN on the device, it must be 4 digits. This
  is artificially limiting. Other platforms (eg Android) allow longer
  PINs. It has always been my understanding that we should support
  Swipe, Passphrase and PIN where Passphrase and PIN can be arbitrarily
  long.

  However, once longer PINs are supported, we will have to add an Enter
  key. Right now, the lockscreen checks the PIN once 4 digits are added
  so that you don't have to press Enter. I guess this was done for
  usability, but would be a security issue because an attacker can
  easily determine the PIN length, which makes it easier to for an
  attacker to guess the PIN. Eg, if I have a 5 digit PIN set, then an
  attacker need only type '11111' and know that the PIN is only five
  characters. Now, a PIN isn't strong to begin with and an automated
  attack could rather quickly brute force PINs, but we shouldn't make it
  easier for someone manually trying to guess the PIN.

  The passphrase lockscreen prompt correctly allows variable length
  passphrases and requires you to press Enter.

  I suggest moving the 'X' up t the left of '0' and an Enter symbol to
  the rigth of '0'.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/unity8/+bug/1363214/+subscriptions