Locking Down the IPhone

By default, Apple devices are moderately secure.

For those that are interested, here is a link to its Security Whitepaper (currently dated 2015, and for iOS¹ 8.3 or later). Its not always easy to find where on the line between security and convenience you want to be (and that doesn’t address the issue of changing your mind as new things happen, or you discover new ways of doing things). This article will cover a number of things you can do to improve the physical security of your device. Some of this will also apply to an iPod Touch, or an iPad.

Settings → Touch ID & Passcode

Under Settings → Touch ID & Passcode, we find the ‘Turn Passcode On’ settings:

Enable passcode

If you didn’t do this when you first setup the phone, you should do it now. After a bit of (real world) testing, I’ve concluded that a traditional password can be too complicated to enter on the lock screen under any kind of short time duration (This isn’t an issue for a normal cell call because Apple lets you accept the call from the lock screen, but VoIP applications don’t have that privilege, so apps like Groundwire or Silent Phone² will stop ringing by the time you enter a complex password). That said, a traditional 4 digit PIN is certainly not long enough. Fortunately, Apple thought this through and provided the option of a long numeric PIN code (something that is longer than 4 digits). That’s easy to enter in a time crunch, but long enough its not practical for guessing. There are many numerical sequences that you could use. Some examples are ‘1, 3, 6, 10, 15, 21’ (Triangular numbers, if you start with one dot, add another row, you have 3, add another row, you have 6, etc), Pi (3.1415926), e (2.7182818). The passcode is what controls how difficult the phone is to get in to. It also unlocks other capabilities (discussed later). Choose a good passcode that you will be able to remember.

Passcode	Passcode Options

Lock screen

After creating a passcode, we can choose what we want to show up on the lock screen. This is important because it can tell a 3rd party information about you with out having to actually get into your phone. Things like missed calls, text messages (including reply to message), or access to Siri (which could allow them to call or send text messages to anybody in your contact list).

Before	After

Enable wipe after failed login

Apple offers the ability to automatically have the phone wipe itself after 10 failed login attempts (password or passcode). Provided you don’t hand your phone to people who will constantly try to login to your phone (kids?), enabling this is a good idea. You can find this setting under: Settings → Touch ID & Passcode. When testing this out, simply creating a passcode caused this to be enabled, so you may not actually have to do anything for this.

Touch ID

If you have an iPhone 5S or newer, you can (optionally) take advantage of the fingerprint scanner built-in to the home button (Apple calls this Touch ID). Its worth mentioning that Touch ID doesn’t bypass the passcode. When you boot your phone, or go 48hrs (or longer), the phone will require you to enter the passcode. The passcode unlocks the ability for the Touch ID to unlock the phone, approve purchases (and app installs), and Apple Pay. if you aren’t comfortable using it, leave it off.

Automatically locking the device

Devices should be setup to automatically lock when you’re not using them. This will help keep other people from being able to pick up your phone and use if when you set it down. I have my phone set to lock after 1min. You can configure the auto-locking settings under: Settings → General → Auto-lock

SIM Password

If you enable this feature on, your iPhone will require you to type in a four-digit passcode whenever you turn on the phone (to unlock the SIM³). This will prevent someone from making calls with your SIM³ in your iPhone (provided its not already turned on), or removing your SIM³ and using it in another phone. You can find the SIM³ Password under Settings → Cellular → SIM³ PIN

• Enter the Current Password (for AT&T, the default is 1111. For other carriers check here )

• Enter the New Password, a 4-digit passcode that you can remember; re-enter it to confirm.

The next time you turn on your iPhone you will be prompted to unlock your SIM³. If you forget your PIN, you will need to contact your carrier to unlock the SIM³ with a PUK⁴ code. If the PUK⁴ code is entered incorrectly too many times, the SIM³ will be blocked and you’ll have to get a new one.

Password Manager

If you’re going to be accessing and/or creating passwords on your iPhone, you should have a password manager. Many password managers are capable of integrating with desktop apps (with various methods of synchronizing). 2 examples are 1Password , and Lastpass . Both of these products are capable of keeping data in sync with a desktop app, generating and remembering passwords, and more.

Charging your iPhone

iPhone’s charge like many devices, via USB⁵. In addition to power, USB⁵ offers data capabilities. A malicious actor could reconfigure a USB⁵ port to try to hack your device. Don’t plug your phone into USB⁵ sockets you don’t know are safe. If you are in doubt, bring your apple power adapter. Alternatively, you can look at Portapow ⁶. They offer inline USB⁵ adapters that disable the data pins, resulting in only power coming across the cable.

Footnotes & References