Alpha-numeric Passcode on your iPhone and iPod touch

Mark Gurman
|
February 18, 2010
|
Share

photo.jpg

Today we've got something interesting for you security-minded folks with iPhones or iPod touches.  You know how Apple only lets you use four numbers as your passcode to unlock your device?  That's as weak as banks PINs and school lockers.  Everyone knows you need at least six characters and alpha-numeric at that.

We have your answer.  We've built a profile from Apple's corporate developement kit that allows alphanumeric passcodes.  All you have to do is open this link (On your iDevice only!) and you will be prompted to pick a new passcode. You will be required to make a passcode with a mix of letters and numbers and you cannot put numbers in a consecutive order. For example you cannot choose "max1234" you would have to do something such as "max2746." If you ever want to remove this feature simply go to Settings/General/Profiles/9to5mac/ then click remove and confirm.  Then change your code back to something numeric.

We aren't responsible for you forgetting your passcode and locking yourself out of your iPhone.  Or anything else.  Use at your own risk.

If you want to know how to do this yourself, iClarified coincidentally has a good tutorial this morning.

 

Comments (49)

9to5Mac Noob (not verified) | February 18, 2010 - 9:19pm

Fishy. Very, very fishy.

Fishy (not verified) | May 03, 2010 - 6:30am

I am with you!! Sounds like a back door! Also why are the keys displayed when entering the passcode? These should be hidden with astericks!!!! We need someone to sniff the traffic after installing this? Is the passcode stored encrpted on the hard drive?

9to5Mac Noob (not verified) | February 18, 2010 - 9:21pm

How exactly did you do this?
And could you make an android styled lock screen?
What else can you edit on the iPhone with these profiles?

9to5Mac Noob (not verified) | February 19, 2010 - 8:11am

There already is an android lock-screen, you just have to have a jailbroken iPhone/iTouch, and then go on Rock or Cydia and search AndroidLock. I use it on my phone all the time and i find it is a lot easier to remember than a code!

9to5Mac Noob (not verified) | February 19, 2010 - 8:12am

There already is an android lock-screen, you just have to have a jailbroken iPhone/iTouch, and then go on Rock or Cydia and search AndroidLock. I use it on my phone all the time and i find it is a lot easier to remember than a code!

augwell (not verified) | February 18, 2010 - 9:44pm

Would you please write more about this?
Who wrote it; How is it implemented; MOAR

9to5Mac Noob (not verified) | February 18, 2010 - 9:47pm

Yes lock your iphone using a remote web site.... how secure, and if your web site hacked, changed protocols, crashed database or all data stolen then all those millions or hundreds of thousands of iPhones are impaired... ;-)

9to5Mac Noob (not verified) | February 19, 2010 - 1:00am

The website isn't holding the data. You're just downloading a settings change for your phone created using the utility Apple provides for businesses.

9to5Mac Noob (not verified) | February 19, 2010 - 4:40pm

It a profile, you set the password offline without their knowing...

9to5Mac Noob (not verified) | February 18, 2010 - 9:51pm

I can confirm this works, the mechanism for setting the password is no different than from the 4 digit PIN. Parental restrictions are unaffected.

9to5Mac Noob (not verified) | February 18, 2010 - 9:54pm

That's kinda nifty, I like it. I wonder how long it'll take me to get annoyed by having to type in a longer password since I've pretty much got my current one down in muscle memory.

Mark (not verified) | February 18, 2010 - 10:49pm

Don't *ever* do what the author is suggesting. The link points to a policy generated by the iPhone Configuration Utility. You can download the utility from Apple yourself and make the change to your iphone's password policy.

But don't *ever* listen if someone tells you to follow a link to a configuration profile unless you are absolutly sure you trust the person providing the link.

Configuration profiles are very powerful and can make all kinds of changes to your iPhone that can compromise your security.

This is the iPhone equivelent of telling windows users to download some random .exe and run it. Not a good thing to train people to do.

Bebbo (not verified) | February 19, 2010 - 1:03am

I know you mean well 9to5 but in an article aimed at security of an iPhone telling users to download a profile is just irresponsible and kind of hypocritical. If people start to take the warning messages for granted that pop up on the iPhone when they download this type of file they will ignore it elsewhere and end up with numerous issues. These types of files can cause browser redirect (man-in-middle) attacks and many other problems including completely locking you out of your own phone.

The better way would be to instruct people how to do this themselves with the software provided by apple.

9to5Mac Noob (not verified) | February 19, 2010 - 2:02am

It's save and it works. 9to5 is not some russian mafia clan. I don't see any reason why one should avoid this other than one does not want to have a passphrase. It's nonsense to say that when you downloaded this file, one would download every profile.

Alex (not verified) | February 19, 2010 - 2:16am

Hey!how do you install it? Do you need the 3.1.3 firmware? It's because I click on the link from my iPhone an it says: download or play. If I press download,it downloads but nothing happens. If I press play,I open a QuickTime window,as if it was a movie or so and nothing happens...
Need help plz!

9to5Mac Noob (not verified) | February 19, 2010 - 3:37am

I would not use it.
I use the lock screen to prevent people to mess around with my phone if they get a hold of it when I'm taking dump, or drops it.
.
But my password has to be fast to type in when I have to use my phone.
.
I have PIN code on my SIM card, and I have mobile me, so I can remove wipe it if I need to.

Snapper (not verified) | February 19, 2010 - 5:22am

As much as it's ilegal in the UK to use a phone while driving - if I use mine to play music through my car etc, I need to unlock it with ease, often without looking at the iPhone itself.

Though this is a good idea, it would be better for me personally if I could just have 6 numbers, as apposed to just 4, or similar. The big buttons on the default unlock (numerical) are good for ease-of-use. This config means using the alpha/numeric keypad which is just too dam small.

Still, good for some people, just perhaps not me.

Snapper (not verified) | February 19, 2010 - 3:38am

Thanks for this 9to5!

9to5Mac Noob (not verified) | February 19, 2010 - 4:02am

Nice work, and people it's just a profile. Don't get so worked up about it

9to5Mac Noob (not verified) | February 19, 2010 - 4:20am

I installed it, got lazy, uninstalled it. It stayed. I restarted my phone. I stayed. I can't return to regular passcode and I would love to know how.

9to5Mac Noob (not verified) | February 19, 2010 - 8:04am

Settings>General>Passcode Lock> type in the passcode you just set, it will let you into the passcode lock menu, press change passcode then type that password one more time, then in the new passcodes sections, type in the numeric 4 digit passcode you want, confirm it, and it will fix it.

9to5Mac Noob (not verified) | February 19, 2010 - 9:07am

You first have to remove the 9to5mac profile.

9to5Mac Noob (not verified) | February 19, 2010 - 4:30am

Got the same problem like Alex. Got a blackra1nt ipod touch 2G

Lorenzo Lillo Aragonés (not verified) | February 19, 2010 - 4:33am

Wow, awesome, is there any chance that you could do something like this, that works on a not-jailbroken iPod to get the percentage of battery like the 3Gs ? :O

Lorenzo Lillo Aragonés (not verified) | February 19, 2010 - 4:40am

If you get the problem that it stayed, you just have to go to Settings>General>Passcode Lock and deactivate it, then it'll be like always :B

9to5Mac Noob (not verified) | March 09, 2010 - 3:52pm

but i am wondering how you can deactivate it... i tried doing what someone said earlier about only using numbers but then it said i must use numbers so that didn't work.. how else can i get rid of it?

9to5Mac Noob (not verified) | February 19, 2010 - 5:04am

hey,

i am using this since october last year. this was written by pwncenter , http://www.funkyspacemonkey.com/howto-iphoneitouch-protection-alpha-nume...

9to5Mac Noob (not verified) | February 19, 2010 - 6:28am

Ditto. been using it for a while as well. FSM had it for a while

Lock and Key (not verified) | February 19, 2010 - 6:31am

Where are you leaving your phone that you need a 13 character alpha-numeric passcode, fingerprint scanning and other 007 decoders??? It's in my pocket and if it isn't, I can disable it from MoblieMe... Not only is this overkill, it sounds a little fishy to simply download a link from this website.

I say, beware- if it causes issues, it's your fault for downloading it in the first place...

International Moment of Zen (not verified) | February 19, 2010 - 8:42am

Actually I have very sensible information (contacts for example) on my shiny little iDevice. So in case it gets stolen I do absolutely not want anyone to be able to access that data. At least not the easy way. Of course, nothing is bullet proof and un-hackable, but at least some form of protection against the normal dumb thief.

And again. It's not fishy, just save and very nice of 9o5 to provide the file.
And no, it does not cause any issues.