Where are the settings to disable passcode unlock if Face ID fails?
I think you know my what I mean. Obviously in this whole scenario, the person has stolen the phone. Let me be more specific
I don't think there is one and how would this work? What would you use to unlock the device that would allow the criminal to use the same information to take over your account. It couldn't be your Apple ID password because the fact that they can reset it and then have it is the whole problem.
This is how passkeys work, the device passcode becomes the master password for your accounts.
The advantage of using an alpha numeric password would be it would be more difficult to observe with someone shoulder surfing. You couldn't use actual words, because that would be almost as easy to observe as a PIN. It would have to be a random long string of letters and numbers. Long and random enough to make it difficult for most people to remember quickly.
It's not a security vulnerability, it's how passkeys appear to be designed to work.
Agreed that this is the issue we are discussing here. The passcode works as it should, but it has a vulnerability that is difficult to mitigate. The only existing mitigations presented here are to 1) hide your passcode from everyone or 2) use Screen Time to lock out password changes with the passcode.
That's a different password to your device passcode/word (unless of course you make them the same!).
It's not so much 'pushing back', it's recognising that this is how device and account security is going to work in the future. Your device passcode is going to be the master password for many different accounts.
Not with the main passcode. Changing anything in Screen Time settings requires the screen time passcode but the thief won't have this. Yes it is another passcode to remember I am willing to do this.
Regardless of how passkeys work, the number used to unlock your phone should not be the same one that can reset your password. I have a banking app that allows me to use a PIN. I cannot use that PIN to reset my banking account password.
I was told there is somehow a workaround for this as well. I don't know for sure though, so maybe it's something to slow them down
It is a vulnerability since people have had their phones and passcodes stolen and used maliciously. It may work as designed but it has a particular weakness that allows a malicious actor to exploit the convenience of resetting the AppleID password with the passcode and the device. And apparently it is not too hard for a thief to do this in a public setting.
It looks like the future is precisely that; your device passcode is going to become the master password for many different accounts and will be what you need to enter to reset passwords to your online accounts.
www.passkeys.com
No, the passcode does not work as it should. The pass code should work to unlock the phone and that's it.
That's not how passkeys work, or are going to work. By definition, the device that has the passkey stored is a secure device with access priviledges to make changes to your accounts. The device passcode, FaceID, TouchID becomes the master password for your accounts.
I agree with you on the second part but not on the first part. Apple designed the passcode to do more than unlock the phone. But there is a weakness in this strategy and right now there is no good way to mitigate it other than to never give a thief the opportunity, which is easier said than done when it comes to the way we use smart phones these days.
It looks like the future is precisely that; your device passcode is going to become the master password for many different accounts and will be what you need to enter to reset passwords on your online accounts.
It's going to become ever more important to protect your device passcode.
Passkeys & Passkey Authentication: Secure Passwordless Login and Auth
Passkeys and passkey authentication provide secure, passwordless sign-ins through passkey login, passkey auth, and passkeys authentication. Experience seamless authentication with biometrics, PIN, or pattern for enhanced security.
Passkeys go in your keychain, they are protected by FaceID, touch ID or device passcode. They aren't designed to be a separate thing under a different lock and key, and I don't think they will be.
So you're telling me it's impossible to make the unlock code on a phone a different number than say the number to unlock my bank account? I find this a bit hard to believe.
The passkey concept still has a vulnerability because if someone knows your passcode and has your device they can reset the biometrics (finger or face).
There is no setting for that. If Face ID fails, you will be prompted to enter the passcode. When that happens, I exit out of the app and reopen with Face ID.
