making password id longer than 6 digits

crankypuss

unread,

Jun 17, 2016, 6:26:30 PM6/17/16

to

I think someone posted that the touch-id pin can be longer than 6
digits, if I didn't hallucinate that, how's it done?

--
http://totally-portable-software.blogspot.com
[Sat Mar 26: "Documentation and Portability"]

nospam

unread,

Jun 17, 2016, 6:31:08 PM6/17/16

to

In article <nk1tem$6fn$2...@dont-email.me>, crankypuss

<inv...@invalid.invalid> wrote:

> I think someone posted that the touch-id pin can be longer than 6
> digits, if I didn't hallucinate that, how's it done?

settings>passcode>change passcode and tap passcode options when setting
it up.

it need not be numbers but if it is, you get a numeric keypad which is
less likely to make typos than if it was an alphanumeric passcode.

crankypuss

unread,

Jun 18, 2016, 5:03:22 AM6/18/16

to

nospam wrote:

> In article <nk1tem$6fn$2...@dont-email.me>, crankypuss
> <inv...@invalid.invalid> wrote:
>
>> I think someone posted that the touch-id pin can be longer than 6
>> digits, if I didn't hallucinate that, how's it done?
>
> settings>passcode>change passcode and tap passcode options when
> setting it up.

I must have missed "passcode options" last time, thanks.

I seem to remember seeing somewhere that if you change the passcode, you
then have to set up the keyring from scratch, does that sound right?

> it need not be numbers but if it is, you get a numeric keypad which is
> less likely to make typos than if it was an alphanumeric passcode.

Thank you.

David Empson

unread,

Jun 18, 2016, 6:54:05 AM6/18/16

to

crankypuss <inv...@invalid.invalid> wrote:

> nospam wrote:
>
> > In article <nk1tem$6fn$2...@dont-email.me>, crankypuss
> > <inv...@invalid.invalid> wrote:
> >
> >> I think someone posted that the touch-id pin can be longer than 6
> >> digits, if I didn't hallucinate that, how's it done?
> >
> > settings>passcode>change passcode and tap passcode options when
> > setting it up.
>
> I must have missed "passcode options" last time, thanks.
>
> I seem to remember seeing somewhere that if you change the passcode, you
> then have to set up the keyring from scratch, does that sound right?

No. If you change the passcode, the system needs to rewrap the class
keys (unwrap them using the old passcode, then wrap them using the new
passcode).

You don't need to do anything else - the new passcode immediately takes
effect for protecting access to the more secure data classes.

Various other keys may be invalidated when the passcode changes, but
they are regenerated automatically.

--
David Empson
dem...@actrix.gen.nz

nospam

unread,

Jun 18, 2016, 10:24:31 AM6/18/16

to

In article <nk32op$1e6$1...@dont-email.me>, crankypuss

<inv...@invalid.invalid> wrote:

> I seem to remember seeing somewhere that if you change the passcode, you
> then have to set up the keyring from scratch, does that sound right?

no

crankypuss

unread,

Jun 18, 2016, 5:41:07 PM6/18/16

to

David Empson wrote:

> crankypuss <inv...@invalid.invalid> wrote:
>
>> nospam wrote:
>>
>> > In article <nk1tem$6fn$2...@dont-email.me>, crankypuss
>> > <inv...@invalid.invalid> wrote:
>> >
>> >> I think someone posted that the touch-id pin can be longer than 6
>> >> digits, if I didn't hallucinate that, how's it done?
>> >
>> > settings>passcode>change passcode and tap passcode options when
>> > setting it up.
>>
>> I must have missed "passcode options" last time, thanks.
>>
>> I seem to remember seeing somewhere that if you change the passcode,
>> you then have to set up the keyring from scratch, does that sound
>> right?
>
> No.

Okay, it sounds like I can change the passcode whenever I choose,
without messing up anything that depends on it.

> If you change the passcode, the system needs to rewrap the class
> keys (unwrap them using the old passcode, then wrap them using the new
> passcode).

Makes perfect sense, thank you. I'm not going to wonder about the
details of class keys at the moment, if I get back to the security guide
I'm sure they're explained there.

> You don't need to do anything else - the new passcode immediately
> takes effect for protecting access to the more secure data classes.

Nice, one passcode protects the remainder, minimum hassle all around.

> Various other keys may be invalidated when the passcode changes, but
> they are regenerated automatically.

Presumably those "other keys" represent application-specific "classes"
whose keys are stored in the same hardware-assisted key-vault? It
sounds like the word "class" means "key-name" but maybe that's me
extrapolating off a cliff. Thanks again.

David Empson

unread,

Jun 18, 2016, 8:46:55 PM6/18/16

to

crankypuss <inv...@invalid.invalid> wrote:

> David Empson wrote:
>
> > crankypuss <inv...@invalid.invalid> wrote:
> >
> >> nospam wrote:
> >>
> >> > In article <nk1tem$6fn$2...@dont-email.me>, crankypuss
> >> > <inv...@invalid.invalid> wrote:
> >> >
> >> >> I think someone posted that the touch-id pin can be longer than 6
> >> >> digits, if I didn't hallucinate that, how's it done?
> >> >
> >> > settings>passcode>change passcode and tap passcode options when
> >> > setting it up.
> >>
> >> I must have missed "passcode options" last time, thanks.
> >>
> >> I seem to remember seeing somewhere that if you change the passcode,
> >> you then have to set up the keyring from scratch, does that sound
> >> right?
> >
> > No.
>
> Okay, it sounds like I can change the passcode whenever I choose,
> without messing up anything that depends on it.
>
> > If you change the passcode, the system needs to rewrap the class
> > keys (unwrap them using the old passcode, then wrap them using the new
> > passcode).
>
> Makes perfect sense, thank you. I'm not going to wonder about the
> details of class keys at the moment, if I get back to the security guide
> I'm sure they're explained there.

For more detail, do a search in the iOS security guide for "change"
(ignore "exchange") and spot the ones mentioning passcode changes.

Data classes are explained pretty well, as app developers need to
understand them for deciding how well to protect files their apps
manage.

> > You don't need to do anything else - the new passcode immediately
> > takes effect for protecting access to the more secure data classes.
>
> Nice, one passcode protects the remainder, minimum hassle all around.
>
> > Various other keys may be invalidated when the passcode changes, but
> > they are regenerated automatically.
>
> Presumably those "other keys" represent application-specific "classes"
> whose keys are stored in the same hardware-assisted key-vault? It
> sounds like the word "class" means "key-name" but maybe that's me
> extrapolating off a cliff. Thanks again.

More obscure stuff like the auto-unlock key used after an iOS update is
installed being invalidated if the passcode changes. I think there was
one other mentioned in the security guide.

Worst case, you might be asked to enter the passcode again for this sort
of thing.

--
David Empson
dem...@actrix.gen.nz