1

Many smartphones and programs are using fingerprint's to secure the phone or encrypt data. In many cases, those programs want a PIN as backup authentification method.

A PIN just got 10000 possible combinations, while a fingerprint got many more. So an encryption isn't safe if there is a backup pin, is it?

The same question for a phone lock-screen: If there's a 4-digit PIN, people could just bruteforce this pin instead of bruteforcing million of fingerprints, couldn't they?

2

Welcome to the community ☺

  1. A backup plan is always necessary in case the fingerprint sensor doesn't recognize fingerprints or gets broken or something that it doesn't function as expected
  2. Coming to app locking system, it totally depends on the app lock system if it has limit of trying PINS then you should be safe but if it doesn't YES it can be bruteforced if there's no limit on no. of wrong attempts
  3. Coming to Androids PIN lock feature, it doesn't have limit of only 4 digit PINS so you can make it more secure by making large complex PIN
  4. Assuming 4 digit PIN, AFAIK Android wouldn't allow you to attempt 10000 wrong PINS infact it will allow only few and then will lock up itself
0

A PIN just got 10000 possible combinations, while a fingerprint got many more.

If there's a 4-digit PIN, people could just bruteforce this pin instead of bruteforcing million of fingerprints, couldn't they?

Biometric lock is weak, hence insecure - it's only for user's convenience.

PIN can be generated from set of 10 numbers - it can be with or w/o repetition.

Password (on factory Android) can be generated from ASCII charset, including numbers, without control chars - c < 32 || c > 127, thus having 94 printable chars.

Again, minimum lock screen length is 4 && maximum lock screen length is 16 (on factory Android).

Also, default password policy is PASSWORD_POLICY_UNSPECIFIED (on factory Android).

With that said, factory (AOSP) Android has low security margin; it is only on user to define password with complex quality thus to mitigate online attacks (bruteforce).

Off course, you can change policies with DPM (DevicePolicyManager) application or build custom ROM.

Regarding your q about bruteforcing, I suggest to read this

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.