Serious security flaw in password manager and hidden/deleted photos.
If someone gets hold of your lock screen passcode they can:
- Change your iCloud password instantly in settings.
- Access your passwords from settings and have all saved passwords.
- Open hidden/recently deleted photos.
- iCloud password can be changed in an instant if your passcode is compromised and someone has your phone, see it for yourself, open settings> click your name> password and security and first option is change iCloud password and it just needs your lock screen passcode. Solution (which fails due to things mentioned in 2): Set up Screen Time 4-digit password and use content & privacy restrictions> account changes> don't allow, plus additionally select passcode changes> don't allow.
- Password manager has a major flaw that all the complex/difficult passwords it stores plus all the security measure which it takes to protect that internally is amazing but here again if two times the Faceid doesn't work you can simply bypass by Lock screen passcode which I believe just compromises everything the password manager and password keychain stands for. As said above you can sure use screen time to block someone from accessing account changes but then again if password manager is compromised by this simple technique, then he can have the iCloud password anyways and now he can just reset the screen time and that defeats the whole purpose of setting it up in the first place.
- Hidden/recently deleted folder is also compromised as mentioned earlier that Faceid can just be bypassed by again Lock screen password. Again, screen time can be used here to just lock the photos app by putting App Limits and setting it to 1 min and sure someone won't be able to open your photos but again as mentioned in 2 this fails.
tldr: Wherever you use biometrics/Faceid after your phone is unlocked it is compromised due to the fact that it can just be bypassed by 6-digit Lock screen code.
I think that apple needs to use different verification method to unlock the password manager in settings like having a separate password where long strings can be used as passwords. This will solve the problem mentioned in 1 and 2 but for 3(hidden photos) Apple has to come up with something that is safe as well as convenient.
iPhone 14 Pro Max
