6

Once you have defined a passcode to unlock an iPhone, and for every application asking a password, when waiting for a password an iPhone makes a transient display of any character you type. It is clear that this transient display was purposefully set in place to help people who have problems with passwords or with the on screen keyboard. This transient display lasts 3 seconds to avoid too big a security problem. But this is still largely sufficient for anyone behind you to read it really easily. Moreover this transient display can be easily captured by any camera or by a software on the iPhone:

iPhone password transient display

I evaluate this echo of any password as a serious risk. This echo partially exposes a secret.

Is there any simple configuration method to suppress everywhere this mechanism of transient display of any password?


For information, I reported this security problem at Apple:

Once I have defined a passcode to protect my iPhone, and within every application asking me a password, when entering my password iOS makes a transient display of any character I type. I guess that this transient display of passwords was purposefully set in place to help people who have problems with passwords or with the on screen keyboard. This transient display lasts 3 seconds to avoid to create too serious a security problem. But this is still amply sufficient for anyone behind you to read it really easily.

This transient display can be easily captured by a camera surreptitiously activated by a malicious neighbour.

I didin't find any easy way to block this security weakness with iOS 7 up to iOS 9.

How to disable this transient display of any password on iOS?

  • 1
    For many applications, including Safari, you can use a third-party application such as 1Password, which unlocks based on the Touch ID sensor. In addition to auto-fill password forms, it also lets you copy a password (without displaying it) to the clipboard for you to paste in the appropriate location. Pasting doesn't display the characters. This is more of a workaround, and not an answer to your question though. – Kent Dec 1 '15 at 22:30
  • Thank you for your helpful trick. Unfortunatly, I am using passwords to avoid the biggest weakness of biometry: the information is public (i.e. ≠ secret). – daniel Azuelos Dec 2 '15 at 13:12
  • 2
    It can't be captured by a software on the phone unless your phone is jailbroken. And @Kent: Software on the phone CAN access your clipboard without even asking. IIRC XCodeGhost used this and uploaded clipboard data along with the rest of the tracking code. – 0942v8653 Dec 2 '15 at 13:12
  • @0942v8653 (I like your password :)) please note the above screen capture was made on a newly installed iPhone with a standard iOS (neither jailbroken, nor any code injected). – daniel Azuelos Dec 2 '15 at 13:17
  • You can't remove this feature unless you jailbreak I'm afraid. And the latest public firmware iOS 9.1 cannot be. – Brick Dec 2 '15 at 13:21
7

You can't, at least not in any iOS version that has been released by Apple.

I understand this isn't the answer you were looking for.

  • A clear negative answer is a valid answer! – daniel Azuelos Dec 25 '15 at 14:39
-1

The use of TouchID is the only way to kind of get around this issue, but after a reboot, you still have to enter it. Even if you could suppress the characters appearing, you still have to TYPE IN the password, and anyone who could see the letters of the non-suppressed entry string could also see what you're typing even if the entry string was suppressed. Hence why TouchID is really the only way to fly, other than concealing your screen.

  • I use passwords because TouchID as any biometry technic, is a risk, a new problem source and not at all a solution in the security field. My question is just about "transient display of passwords". – daniel Azuelos Dec 27 '15 at 10:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .