Auto-confirm pin reveals that I use 6 digits (Android 14)

N1b

The new feature to automatically unlock after entering the correct pin shows 6 blank dots if a 6 digit pin is set up and it won't show any blank dots when using a longer pin.

I don't understand why this was implemented (probably in AOSP) because it tells any adversary that the user has a 6 digit pin and auto-confirm turned on.

Of course one could simply use 7 digits or above but in my case I'd lose the convenience that made me turn on this feature in the first place. Is there a way to deactivate the blanks via ADB or can we hope for a future GOS update to do this? It's so unnecessary in my opinion...

Btw great job GOS for updating so quickly to Android 14, everything works like a charm for me!

Skyway

N1b yeah in had the same feeling , security through obscurity isn't a good model but to me knowing its 6 digits give someone a known starting point .

233328

I don't think this is an actual security issue. There are two scenarios:

The attacker cannot bypass the secure element, therefore a 6-digit PIN is enough to prevent access and knowing its length doesn't make anything easier thanks to the throttling of attempts.
The attacker can bypass the secure element, at which point a 6-digit PIN would be so trivial to bruteforce that knowing its length wouldn't change anything in practice.

Hiding the length of the PIN would be security by obscurity, which is not reliable. One could argue that by showing the length of the PIN, this feature avoids giving a false sense of security.

N1b

233328 everything you say is correct, but it's still hard to understand for me why somebody bothered to code this "preview" in and then decided to also deactivate it for everything beyond 6 digits. I think it's unnecessary, and it's definitely inconsistent UI design...

There is also the edge case that somebody could spot my last 5 digits but not know how many came before and this preview could be the critical factor... Yes it's unlikely and if I really worried, I would just use 7+ digits. It's just so weird to me and I wish there was a good idea behind this decision (and maybe there is and I just don't get it).

Anyway, thanks for your answer!

N1b

Skyway exactly, that's basically all my complaints in a nutshell. Hopefully there's some genius behind this decision that I just have yet to grasp. :D

233328

N1b

somebody bothered to code this "preview" in and then decided to also deactivate it for everything beyond 6 digits.

Oh yeah I hadn't realized that, definitely weird. I'm curious what the logic is for this, seems somewhat arbitrary.

N1b

@"dismount2784"#p47109 no the preview is always there if you use auto-confirm with 6 digits, you can't opt-in or opt-out of that (to my knowledge).

But the auto-confirm itself is a new Android 14 feature and toggled off by default if that's what you mean.

[deleted]

N1b I deleted my reply because I misunderstood the issue. I got it now.