The iPhone automatically goes into BFU (Before First Unlock) after 72 hours of inactivity (it actually reboots the phone). This can’t be disabled.
In addition, there are additional restrictions where your passcode will be required. For example, if the passcode has not been used to unlock the device in the last six days and Face ID has not unlocked the device in the last eight hours, then you must use a passcode to access the device (in other words, biometric unlock is automatically disabled).
If you've ever wondered why you've had to enter your passcode after a good night's sleep and haven't entered your passcode recently, that's probably why!
Given these built-in precautions, a click-bait headline like this is a bit excessive for most people.
>The iPhone automatically goes into BFU (Before First Unlock) after 72 hours of inactivity (it actually reboots the phone). This can’t be disabled.
But if the threat is from law enforcement, as the beginning of the article implies, how does that help? They just have to scan your face with your phone when they seize it, and slurp up all the data they want.
>In addition, there are additional restrictions where your passcode will be required. For example, if the passcode has not been used to unlock the device in the last six days and Face ID has not unlocked the device in the last eight hours, then you must use a passcode to access the device (in other words, biometric unlock is automatically disabled).
The conditions for triggering this is so unreliable that it probably exists more to prevent people from forgetting their pins, than meaningfully increase security.
Interesting- searching says you're right. I thought the enclave discarded the derived decryption keys in those situations. Looks like it just goes extra locked down.
Not just open, but (by default) “paying attention” and not actively trying to “look away” from the phone:
The TrueDepth camera will provide an additional level of security by verifying that you are looking at iPhone before unlocking. Some sunglasses may block attention detection.
If you have Face ID enabled, you can put your iPhone in hard-lock mode and require a passcode by pressing and holding the side (aka power) button and either of the volume buttons for a couple seconds.
It will pop up an emergency screen, but just tap the power button once more to cancel it.
I'm fortunate to be in a position where I don't attract negative attention from law enforcement, but this is still muscle memory to me.
Edit: You can also do the same thing by quickly pressing the side button alone five times.
Both of these methods have an undesirable side effect for me, which is that it immediately pops up the passcode dialog saying that a passcode is required to activate Face ID. Depending on the situation, that could be construed as an attempt to actively interfere with a police investigation, which could bring consequences of its own. It would be better if it silently dropped you to the normal lock screen, and only showed the passcode dialog when you attempt to unlock the phone normally.
Another thing I've often wished for with kids is a mode that removes all notifications and widgets from the lock screen - the only things you should be able to do is to unlock the phone and emergency calls. You can remove most notifications with the right Focus, but not notifications to control playing music/video apps, for example, nor any other widgets you happen to put on your lock screen.
The same passcode prompt appears after software updates, multiple previous failed Face ID login attempts, and maybe more.
Not a lawyer, but everyone has a password locked phone and its standard practice for device security. I'm not optimistic for a prosecutor winning on an interference charge.
> Depending on the situation, that could be construed as an attempt to actively interfere with a police investigation
IANAL but I highly doubt this would hold up in court with even mildly competent attorneys. Anyone can easily accidentally trigger it, I do all the time.
> Both of these methods have an undesirable side effect for me, which is that it immediately pops up the passcode dialog saying that a passcode is required to activate Face ID.
Must be an iOS 26 thing? I haven't dared upgrade yet. No immediate passcode dialog on iOS 18 if you follow the instructions above. It does pop up like you describe if you press the cancel button on the screen, but if you are whipping out your phone to play with the screen you're not exactly acting inconspicuously anyway.
Note: do not try the "click the side buttons a few times" on pixels. It starts an emergency alarm and you have 5 seconds to cancel before it starts reaching out to your emergency contacts. I almost pissed myself in bed.
… or you can just close your eyes, and move your face around. The device will not unlock if you're not looking at it and after 3 or 4 tries will ask for the password.
Right, there’s a multitude of ways to trigger a passcode requirement, but the point here is quick/immediate procedures that can be learned into muscle memory.
How many times do you unlock your phone a day? For some people it’s over 100+ times a day Face ID is convenient, useful and secure. The alternative? People will use short numeric passcodes that are easy to bypass with devices like Cellulite.
Instead, we should push for laws and protections around our private devices. The 4th Amendment actually protects our personal effects and imo this biometric loophole is illegal.
As the other commenter pointed out, in the meantime, practice how to quickly lock your phone - and better yet, when in dangerous situations, leave it behind or turn it off.
Does anyone know how devices like Cellebrite work? Like high level I assume it taps the numbers and has some algorithm that prioritizes common passcode patterns.
But how does it not get locked out the same way we do when we fail our passcode 5+ times in a row? Is it just super easy to get around that exponential lock-out for iOS?
It is not super easy to get around that tech. It used to be easier a long time ago. Apple patches the methods every time they can, and have made hardware adjustments in attempt to make it as hard as possible. A lot of these methods involve tricking the counter so it doesnt increment at all, or somehow rolling it back. If the phone isnt set to wipe after 10 attempts, tricking the timer that time has passed would be enough.
Im not sure if anyone other than Cellebrite knows the exact details of what they are doing. (If they can even unlock latest iPhones that are properly secured. I’m seeing a recent article that implies recently unlocked iPhones had biometrics enabled) I wouldn’t be surprised if their techniques involved disassembling the phone, and tampering with every connection of the chips involved, or depowering them in weird ways as they are counting attempts, or even desoldering and transferring the chips to other boards. I suspect that if apple knew and could patch the method, they would.
It’s impressive that it is so hard to get into iPhones imo. People use 6 digit passcodes to lock their entire digital life. That would be considered horrendously insecure for anything that isn’t an iPhone. You can (and should) increase it to a full password. But a lot of people don’t.
I don't understand why Apple and Google don't just use biometrics as a second factor, like GrapheneOS does. When you first start up, you have to enter your real long and complicated password, and then every time you unlock it after that, a short PIN + your fingerprint is enough. If you enter the PIN incorrectly too many times or hold your finger on it at the wrong angle, it locks and you have to use the real password. There is also a duress password. If you enter this instead of the real PIN, all data is deleted. This means that even if someone threatens you and tries to force you to cooperate, you can prevent the device from being unlocked.
This is the advice I give to everyone who comes to me for digital security advice. I let them know that building habits of using lengthy PINs (my own personal PIN is far more than four or six digits) takes some time to get used to but makes them immune to device seizure followed by law enforcement-compelled or court-ordered biometric unlock (this is specific to US law).
The same public where you're constantly leaving your fingerprints, where your face is being constantly recorded and scanned into multiple facial recognition systems, where your DNA is being constantly shed? When everything needed to unlock your phone can be taken off of your corpse or just reconstructed from what you leave everywhere you go you're not really "secure".
If your threat model includes abduction and torture, then you probably don’t need to worry about your rights to begin with, and probably shouldn’t be using a regular cell phone for anything important
It's like using a password that can never be reset, writing it on a stack of post-it notes, then tearing one off and throwing it over your shoulder every 10 feet you travel
Facial recognition cameras don’t use or give you the same data that FaceID’s 3D depth mapping FaceID uses, besides few cameras get close enough to practically reconstruct a useful 3D mask that could fool it.
No, because for most people, the alternative to "no biometrics" isn't "secure password/pin", it's a weak password (eg. 1234 or the S pattern that half the people with a pattern lock uses) because the ergonomics of a secure password are terrible.
I've been thinking about this recently and I disagree. Keep biometrics and know how to disable them quickly (usually 5x power button)
I think the most likely case where you'll be compelled to hand over your device is an airport immigration desk / room. And what do airports have? Lots and lots of CCTV. From the moment you step off the plane or jetway into the terminal there are cameras everywhere. Enter your PIN once in view of those cameras and it's on record for forensics to pick up.
I actually hate when my phone requires me to enter my PIN on public because I have to angle it away from cameras and eyes like I'm looking at smut.
The worst for me is when I am prompted to re-enter my password manager's master password. Trying to keep that out of view while entering all those characters is difficult and nerve wracking.
Nobody should use biometric ID systems. Resetting my password requires plastic surgery? No thanks.
Involuntary compliance [1], false positives and false negatives are all big, unsolvable problems with biometrics.
[1] To some extent, all authentication systems are vulnerable to legitimate users acting under coercion. https://xkcd.com/538/
Biometric systems take the choice of compliance away from the user, they can physically force you to unlock your phone. With a password you have a choice not to comply even in coercive scenarios; you have the option to say "I'm willing to die from getting hit with the wrench before I'll give up the password."
To me this article is “meta” and tells a very different story: “America is an authoritarian hellhole where trivial matters such as how you lock your phone can put you in real danger. Not from gangs, but from the government.”
I went to the US on holidays recently and several people sat me down before I left to give me a very serious talk warning me about the police being deadly dangerous to anyone that doesn’t behave “just right”. You know: show your hands, don’t reach for things unless prompted, that kind of thing that I just don’t have to worry about over here — where “here” is most of the rest of the Planet.
The last time I felt like this — that I had to worry about the police as a law abiding citizen — was in communist country behind the iron curtain.
You’ve all managed to turn the “land of the free” into a copy of the enemy you made fun of.
I guess Trump is right: the US and Russia should be friends. You’re more similar than different.
The iPhone automatically goes into BFU (Before First Unlock) after 72 hours of inactivity (it actually reboots the phone). This can’t be disabled.
In addition, there are additional restrictions where your passcode will be required. For example, if the passcode has not been used to unlock the device in the last six days and Face ID has not unlocked the device in the last eight hours, then you must use a passcode to access the device (in other words, biometric unlock is automatically disabled).
If you've ever wondered why you've had to enter your passcode after a good night's sleep and haven't entered your passcode recently, that's probably why!
Given these built-in precautions, a click-bait headline like this is a bit excessive for most people.
>The iPhone automatically goes into BFU (Before First Unlock) after 72 hours of inactivity (it actually reboots the phone). This can’t be disabled.
But if the threat is from law enforcement, as the beginning of the article implies, how does that help? They just have to scan your face with your phone when they seize it, and slurp up all the data they want.
>In addition, there are additional restrictions where your passcode will be required. For example, if the passcode has not been used to unlock the device in the last six days and Face ID has not unlocked the device in the last eight hours, then you must use a passcode to access the device (in other words, biometric unlock is automatically disabled).
The conditions for triggering this is so unreliable that it probably exists more to prevent people from forgetting their pins, than meaningfully increase security.
before apple changed it again in ios26 - tripple hitting the side button to bring up emergency also went into BFU. (can't confirm- screw you Dexcom.)
>before apple changed it again in ios26 - tripple hitting the side button to bring up emergency also went into BFU
AFAIK that disables biometrics, but that's not the same as BFU.
Interesting- searching says you're right. I thought the enclave discarded the derived decryption keys in those situations. Looks like it just goes extra locked down.
It really seems it should. It's a quick distress signal, no time to ask the user how locked they want their phone to be.
For iPhones your eyes have to be open.
I’ve got to think some cops are good at holding up the phone and saying look at this text message and people opening eyes to see it though.
Not just open, but (by default) “paying attention” and not actively trying to “look away” from the phone:
The TrueDepth camera will provide an additional level of security by verifying that you are looking at iPhone before unlocking. Some sunglasses may block attention detection.
If you have Face ID enabled, you can put your iPhone in hard-lock mode and require a passcode by pressing and holding the side (aka power) button and either of the volume buttons for a couple seconds.
It will pop up an emergency screen, but just tap the power button once more to cancel it.
I'm fortunate to be in a position where I don't attract negative attention from law enforcement, but this is still muscle memory to me.
Edit: You can also do the same thing by quickly pressing the side button alone five times.
Edit 2: mcc1ane beat me while I was editing!
Or even better: turn off the device. Cracking cold/BFU (before first unlock) devices is not supported in many cases by tools like Cellebrite [1].
[1] https://discuss.privacyguides.net/t/updated-cellebrite-iphon... : support matrix from 2024, in many cases only AFU (after first unlock) is supported.
Both of these methods have an undesirable side effect for me, which is that it immediately pops up the passcode dialog saying that a passcode is required to activate Face ID. Depending on the situation, that could be construed as an attempt to actively interfere with a police investigation, which could bring consequences of its own. It would be better if it silently dropped you to the normal lock screen, and only showed the passcode dialog when you attempt to unlock the phone normally.
Another thing I've often wished for with kids is a mode that removes all notifications and widgets from the lock screen - the only things you should be able to do is to unlock the phone and emergency calls. You can remove most notifications with the right Focus, but not notifications to control playing music/video apps, for example, nor any other widgets you happen to put on your lock screen.
The same passcode prompt appears after software updates, multiple previous failed Face ID login attempts, and maybe more.
Not a lawyer, but everyone has a password locked phone and its standard practice for device security. I'm not optimistic for a prosecutor winning on an interference charge.
> Depending on the situation, that could be construed as an attempt to actively interfere with a police investigation
IANAL but I highly doubt this would hold up in court with even mildly competent attorneys. Anyone can easily accidentally trigger it, I do all the time.
100%. But important to caveat that not everyone here falls under US jurisdiction.
> Both of these methods have an undesirable side effect for me, which is that it immediately pops up the passcode dialog saying that a passcode is required to activate Face ID.
Must be an iOS 26 thing? I haven't dared upgrade yet. No immediate passcode dialog on iOS 18 if you follow the instructions above. It does pop up like you describe if you press the cancel button on the screen, but if you are whipping out your phone to play with the screen you're not exactly acting inconspicuously anyway.
Note: do not try the "click the side buttons a few times" on pixels. It starts an emergency alarm and you have 5 seconds to cancel before it starts reaching out to your emergency contacts. I almost pissed myself in bed.
Thankfully, you can disable that feature
or 5 times the lock (power) button only
… or you can just close your eyes, and move your face around. The device will not unlock if you're not looking at it and after 3 or 4 tries will ask for the password.
Right, there’s a multitude of ways to trigger a passcode requirement, but the point here is quick/immediate procedures that can be learned into muscle memory.
How many times do you unlock your phone a day? For some people it’s over 100+ times a day Face ID is convenient, useful and secure. The alternative? People will use short numeric passcodes that are easy to bypass with devices like Cellulite.
Instead, we should push for laws and protections around our private devices. The 4th Amendment actually protects our personal effects and imo this biometric loophole is illegal.
As the other commenter pointed out, in the meantime, practice how to quickly lock your phone - and better yet, when in dangerous situations, leave it behind or turn it off.
Does anyone know how devices like Cellebrite work? Like high level I assume it taps the numbers and has some algorithm that prioritizes common passcode patterns.
But how does it not get locked out the same way we do when we fail our passcode 5+ times in a row? Is it just super easy to get around that exponential lock-out for iOS?
It is not super easy to get around that tech. It used to be easier a long time ago. Apple patches the methods every time they can, and have made hardware adjustments in attempt to make it as hard as possible. A lot of these methods involve tricking the counter so it doesnt increment at all, or somehow rolling it back. If the phone isnt set to wipe after 10 attempts, tricking the timer that time has passed would be enough.
Im not sure if anyone other than Cellebrite knows the exact details of what they are doing. (If they can even unlock latest iPhones that are properly secured. I’m seeing a recent article that implies recently unlocked iPhones had biometrics enabled) I wouldn’t be surprised if their techniques involved disassembling the phone, and tampering with every connection of the chips involved, or depowering them in weird ways as they are counting attempts, or even desoldering and transferring the chips to other boards. I suspect that if apple knew and could patch the method, they would.
It’s impressive that it is so hard to get into iPhones imo. People use 6 digit passcodes to lock their entire digital life. That would be considered horrendously insecure for anything that isn’t an iPhone. You can (and should) increase it to a full password. But a lot of people don’t.
>People use 6 digit passcodes to lock their entire digital life. That would be considered horrendously insecure for anything that isn’t an iPhone.
That's not really true, it's just the black box magic that is a TPM. Windows Hello for Business does the same thing.
[dead]
I don't understand why Apple and Google don't just use biometrics as a second factor, like GrapheneOS does. When you first start up, you have to enter your real long and complicated password, and then every time you unlock it after that, a short PIN + your fingerprint is enough. If you enter the PIN incorrectly too many times or hold your finger on it at the wrong angle, it locks and you have to use the real password. There is also a duress password. If you enter this instead of the real PIN, all data is deleted. This means that even if someone threatens you and tries to force you to cooperate, you can prevent the device from being unlocked.
Stop using biometrics generally.
This is the advice I give to everyone who comes to me for digital security advice. I let them know that building habits of using lengthy PINs (my own personal PIN is far more than four or six digits) takes some time to get used to but makes them immune to device seizure followed by law enforcement-compelled or court-ordered biometric unlock (this is specific to US law).
Too useful
And also more secure unfortunately, when you need to unlock your phone in public for example.
Until one person or one CCTV camera catches the code over your shoulder and you're done.
That is what they meant
The same public where you're constantly leaving your fingerprints, where your face is being constantly recorded and scanned into multiple facial recognition systems, where your DNA is being constantly shed? When everything needed to unlock your phone can be taken off of your corpse or just reconstructed from what you leave everywhere you go you're not really "secure".
Nobody is going to all that trouble to unlock my phone, they'll just beat me with a hammer until I unlock it for them
If your threat model includes abduction and torture, then you probably don’t need to worry about your rights to begin with, and probably shouldn’t be using a regular cell phone for anything important
Exactly! Biometrics have never been less secure than they are now. It's approaching Social Security number levels of insecure. LOL
It's like using a password that can never be reset, writing it on a stack of post-it notes, then tearing one off and throwing it over your shoulder every 10 feet you travel
Ffs, taking usable fingerprints is not that easy
Facial recognition cameras don’t use or give you the same data that FaceID’s 3D depth mapping FaceID uses, besides few cameras get close enough to practically reconstruct a useful 3D mask that could fool it.
And if you’re a corpse why would you care?
No, because for most people, the alternative to "no biometrics" isn't "secure password/pin", it's a weak password (eg. 1234 or the S pattern that half the people with a pattern lock uses) because the ergonomics of a secure password are terrible.
Bad security, either in the form of weak passwords or biometrics is a choice.
It has always been a trade off of security and convenience.
The fact is most people will favor the latter.
I've been thinking about this recently and I disagree. Keep biometrics and know how to disable them quickly (usually 5x power button)
I think the most likely case where you'll be compelled to hand over your device is an airport immigration desk / room. And what do airports have? Lots and lots of CCTV. From the moment you step off the plane or jetway into the terminal there are cameras everywhere. Enter your PIN once in view of those cameras and it's on record for forensics to pick up.
I actually hate when my phone requires me to enter my PIN on public because I have to angle it away from cameras and eyes like I'm looking at smut.
Thats why some PIN screen implementations have PIN screen scrambling. It can defeat shoulder surfing.
The worst for me is when I am prompted to re-enter my password manager's master password. Trying to keep that out of view while entering all those characters is difficult and nerve wracking.
Nobody should use biometric ID systems. Resetting my password requires plastic surgery? No thanks.
Involuntary compliance [1], false positives and false negatives are all big, unsolvable problems with biometrics.
[1] To some extent, all authentication systems are vulnerable to legitimate users acting under coercion. https://xkcd.com/538/
Biometric systems take the choice of compliance away from the user, they can physically force you to unlock your phone. With a password you have a choice not to comply even in coercive scenarios; you have the option to say "I'm willing to die from getting hit with the wrench before I'll give up the password."
To me this article is “meta” and tells a very different story: “America is an authoritarian hellhole where trivial matters such as how you lock your phone can put you in real danger. Not from gangs, but from the government.”
I went to the US on holidays recently and several people sat me down before I left to give me a very serious talk warning me about the police being deadly dangerous to anyone that doesn’t behave “just right”. You know: show your hands, don’t reach for things unless prompted, that kind of thing that I just don’t have to worry about over here — where “here” is most of the rest of the Planet.
The last time I felt like this — that I had to worry about the police as a law abiding citizen — was in communist country behind the iron curtain.
You’ve all managed to turn the “land of the free” into a copy of the enemy you made fun of.
I guess Trump is right: the US and Russia should be friends. You’re more similar than different.