Locked out behaviour

Papalock

Hello all!

After using graphene for several years, my father did something stupid and locked himself out after changing his password.

As he has tried different combinations, the time to make additional password attempts has been increasing. So far that seems normal behavior. But one odd thing he has mentioned is that if he restarts his phone he will have 1 “free” attempt before the long countdown blocks him from a second attempt.

This means that he can actually try many attempts per hour by just restarting the phone every time he does one attempt.

It made me think… is this behavior normal? I would think this is easily exploitable but wanted to check with you guys on your option on the matter.

Thanks!

FYI this is on a Pixel 7 on the latest or close to the latest update.

fid02

Papalock This means that he can actually try many attempts per hour by just restarting the phone every time he does one attempt.

Your father isn't actually getting extra attempts in this way. If you try the same on your own device (to which you should know the device unlock credentials for), you'll notice that the device will not accept even the correct unlock credentials.

fid02

fid02 In other words, your father shouldn't inconvenience himself by rebooting the device and trying again constantly, because even if he enters the correct password during the lockout, it won't be accepted while the timer is counting down.

Papalock

I see, that makes sense. Thanks for your response. Good to know the security is working as intended.

The only thing that is weird to me is that once he does his “one attempt” after loggin in, the time increases more. Wouldn’t it make sense to increase the time only if a real wrong password attempt is made?

Papalock

Nvm, I tested it myself, the “attempt” after restart does not seem to affect the time countdown. All good 👍