Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

A few minutes ago, after unlocking my phone (iPhone 4, iOS 7.0.1) I got a dialog over the home screen:

Passcode Requirement

You must change your passcode within 60 minutes

and it offered to let me do so. I canceled. I've never seen this dialog before and I am worried it may be a sign of malware fishing for my passcode.

There is very little on Google about this message, but what there is is:

I changed my passcode manually, but am still worried about the source of the dialog and why it appeared. Is there a definitive answer?

share|improve this question
    
I would be very surprised if iOS would do that. –  Buscar웃 Mar 18 at 12:35
    
This isn't definitive so I'm adding it as a comment. I agree that it more than likely isn't malware. In my opinion it sounds like a profile is installed, either through your employers MDM or may have been installed while installing an app outside of the app store. One such example of an app that also installs a profile is found here - lifehacker.com/…. You can check for the presence of installed profiles in Settings > General > Profiles. –  Mr Rabbit Mar 18 at 12:52
    
@MrRabbit Interesting... but I don't seem to have a Profiles section under Settings > General. Maybe that means none are installed? I haven't given my employer access to my phone, nor have I installed an app from outside the app store, nor have I installed that specific app although as you said others might do the same thing. –  David M Mar 18 at 12:54
    
Since it showed right after you unlocked, what do you have starting up automatically? –  Buscar웃 Mar 18 at 13:06
2  
This does not directly answer your question, but when restoring my 4S to 7.1 and selecting a new passcode, I was informed it was too simple (and no, it wasn't 1234 or similar) and required to choose a different one. I suspect iOS does indeed attempt to protect against poor passcodes. –  zigg Mar 18 at 13:07
show 6 more comments

3 Answers 3

up vote 6 down vote accepted

This message is the case when either:

See image here

Obvious codes start with the following numbers:

  • 196*
  • 197*
  • 198*
  • 199*
  • 200*
  • 201*

But also include:

  • 1234
  • 0000 (or any 4 same number combination)
  • 0001 or 0010 or 0100 or 1000 (or any number with this pattern)
  • 1379
  • 2580
  • 2468
share|improve this answer
    
I don't have MDM set up. What is "too obvious"? I don't want to write it here, of course, but it was not a code that seemed (to me) to be obvious. It wasn't a pattern like "1234" or "2580" or anything, for example. –  David M Mar 18 at 12:56
    
@DavidM Check my edit, there are many more obvious patterns. –  Rob Mar 18 at 13:11
    
I wonder Robuust if you are referring to the "potentially insecure" warning that some passcodes provoke when you enter them at passcode selection time or just you are taking this from lists of common pass codes. –  bmike Mar 18 at 13:13
    
@bmike My list (last edit) was a list with commonly used numbers resulted from an investigation. Not the one Apple warns for specifically. –  Rob Mar 18 at 13:14
    
@Robuust Interesting list, thanks for adding it. My code didn't match any of those, but... I guess Apple knows what are insecure codes better than I do :) –  David M Mar 18 at 13:16
add comment

Go to Settings app > General > Profiles

  • Delete any configuration profile that you don't want to keep, then delete any that control passcode.
  • If Profiles is not near the end of the list (below VPN and above Reset >) then you may have no profiles and can continue to the next step.

Next, go to Settings app -> Passcode

  • enter your passcode, turn passcode off, then set it up again

Lastly, Exchange servers can institute a passcode requirement, so you might disable any Exchange mail accounts - temporarily removing them from the device to see if the Exchange server was sending the message or setting any requirements. I don't know if this sets a profile or not, but will edit things if I can find a reference to how this works in practice.

You can choose your same pin again, but the OS will likely want to keep reminding you that a change is required until you clear the "warning". Enough people have reported that just "changing" the passcode doesn't work that something must be up.

If you have jailbroken the device, I might consider rolling back to a stock iOS for a bit and choosing an entirely more complicated passphrase for a while just in case it is some phishing attempt. Just because this is considered to be very unlikely doesn't make it impossible.

share|improve this answer
2  
Thanks bmike. I haven't jailbroken, nor have I got Exchange set up, nor is there a Profiles option in my General settings. I have manually changed my passcode already as a precaution, but there was nothing on that page of the Settings that indicated I needed to change it. –  David M Mar 18 at 13:17
2  
@DavidM When iOS prompts for a change in the pin, you don't see anything in the settings app. Just that nagging pop-over and no other visible sign. You did your homework well, so I wanted to reinforce that it could be something odd and put the "expected" behavior into concrete words and steps. I don't doubt you are clear of profiles (or at least they aren't showing in the UI). My suspicion is your change will dismiss the warning and you don't need to remove the pin as I described. –  bmike Mar 18 at 14:01
1  
The warning hasn't reoccurred, so I think you're right - changing seems to have dismissed it. I can relax :) –  David M Mar 18 at 14:26
add comment

I had this problem tonight too. I "bit" before I thought it being malware, but it doesn't seem to have been malware. I changed my PIN and the phone reset, then the new PIN worked. BUT... the phone immediately asked for me to change the PIN again... now I was thinking Malware. I kept changing the PIN and it kept asking me to do it again. I used the tip earlier in this thread about too simple of a PIN and tried a 9 digit PIN and that worked, the message didn't return. Funny thing is that after, I was able to go into settings and set the PIN back to the 4 digit PIN that I had originally, no further messages.... yet.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.