fid02
First, let me say that I’ve appreciated a good number of your contributions to the forum, but I don’t follow you if you really think it was necessary to explain the obvious, to me or to OP.
Also, it seems you used my tongue-in-cheek answer to your half-rhetorical question as a trigger to explain what you wanted to explain since the beginning; always expect a laconic reply to a laconic comment.
By doing so, you have triggered the fool in me, so I’ll go deeper in this discussion.
While I agree to the obvious part of your comment, it was only answering a small part of OP discussion request.
Neither @nnad nor I took the idea of the simplest time pattern seriously. If you reread my first message, the part directed towards OP clearly shows my scepticism towards this kind of approach when more elaborated (i.e. with modifiers and non-time variables) whereas I don’t even bother talking about the most basic one.
More importantly, it was also quite evident that OP deemed the basic one as ‘being obvious’ – he explicitly said it! Moreover, the three links posted by OP mention or explain modifiers, and the last also include the battery level variable.
[…] public knowledge that a mobile OS is shipping such functionality. Consequently, anyone with this knowledge […]
[…] knowledgeable observer observes […]
[…] then use the publicly known formula to input the rest. […]
All they need is to know about the feature.
[…] could protect against an observer that has no prior knowledge of the feature.
[…] on the hope that users will not be observed by an informed attacker […] against real-life harm.
I do strongly disagree here.
First of all, you are arguing against a single ‘publicly known formula’, but that has never been the subject, since OP straightforwardly talked about possible customisations and modifiers in his first message.
Secondly, if tomorrow you were wearing a white t-shirt with ‘24.08.24@14:45’ printed on it in big characters while walking past hundreds of people in the street (or standing on a stage) – scrutinising you like a pickpocket would do – at this exact time during one long minute, you can be sure that many if not most people will realise the surprising coincidence, and this, to the minute level.
A greater number of people will only see the date of the day, it would only be a matter of time (pun intended) then for most.
Now, to be fair, let put simply ‘2408241445’ (or the usual order in your country) on your white t-shirt: I’ll concede that possibly far fewer people will be struck at first, but then again, if it’s their job as it is for the smartphone snatcher, many will eventually get it.
All this to say that, in my opinion, it doesn’t even have to be public knowledge for it to be a poor choice; we have quite a certain power of deduction. Furthermore, many people have already thought of this kind of password trick; probably even more so since one-time passwords are mainstream.
But to concur with you, I’ll say that even in the case of multiple possible formulae, as long as they’re publicly known (hardcoded choice), it would not be prudent to use them.
Given that you concluded with protection ‘against real-life harm’, let us consider the following thought experiment:
You have set up a dynamic password based on time, not with the basic formula, but with just a tad bit more sophisticated one, with one or two modifiers, to make it less obvious.
You’re in a grocery store, large enough for it to have a dedicated security guard watching all the livestream cameras footage. Then, for whatever reason, you have to unlock your phone in the store; it would be too annoying to interrupt your errand in order to get out, and your fingerprint sensor is out of the question, either because your phone is in a BFU state, or because it is not reliable enough.
But no luck, the watchman is crooked and is working with a bunch of snatchers, and he already had eyes on you…
Let me be clear here: this is nothing far-fetched in many places of many countries.
Often, snatching involves time critical actions, and many stealers wouldn’t feel at ease keeping a phone for more than a few hours or a day.
It is maybe not the most relevant video, must some parts of it are:
iPhone Thief Explains How He Breaks Into Your Phone | WSJ
Taking the example from the video (iPhones are not widely available or popular in all countries), if a thief is doing five to ten phones a night, there is a good chance that he’ll just go to next phone after some failed attempts, and eventually resell it, the buyer having no idea of the filmed password. However, there might be a chance that the thief sense there’s a big haul at stake with your phone; in this case, the sophistication of your password pattern will be tested; still, the clock is still ticking, and he’s still in a hurry.
Does it seem like an unlikely scenario to you? I would dare say that it’s one of the most common real-life scenarios for most of us, long before any kind of law enforcement involvement, which wouldn’t be in a hurry most of the time, let alone three-letter agencies.
But that’s not all, even in the case of LE implication, some information on your phone may only have a value for a limited time (e.g. password to a distant server). Not all law enforcements are on the cutting edge of this kind of stuff, and not all will be able to cause you harm in time – and rubber-hose cryptanalysis is not always relevant.
I believe that all of the above in my response is circumscribed within the intended discussion by OP.
Now, to stay on this subject, but in a broader perspective, just an idea.
What about using the method of loci to divide each day of a year in two parts, that is, 00:00-11:59 and 12:00-23:59? So it would involve memorising 730 variables; that can be a word, a word combination or a word-number combination for instance. Again, not really far-fetched, that is mostly a feat possible through training, and for sure, it is already applied in some ways.
https://en.wikipedia.org/wiki/Method_of_loci
Obviously, the simpler the variable is, the more brute-force prone it would be.
The 730 variables would be fed to a secure and encrypted database used by the password app.
In this case, the outward formula would be known, but not the words.
From then on, the adversary would either have to wait one year, or to modify clock time to get to the right time for which the variant is known – that’s maybe easy, I don’t know, but again, it may be time critical.
Let spice things up and let use a correspondence table in order to use another calendar than the Gregorian one, like a fictional one or a real one with a total of days different from 365 days.
That’s getting far-fetched, but I think it’s closer to what @nnad wanted to discuss.
Maybe some cypherpunk thought experiment will contradict me and show some possible fallacies uttered by me; in the meantime, that’s my take.
For the technical aspect, which will probably have the last word, I’m all ears; I wouldn’t be surprised if it’s simply not achievable within the current architecture.