10

Once you have defined a passcode to unlock an iPhone, and for every application asking a password, when waiting for a password an iPhone makes a transient display of any character you type. It is clear that this transient display was purposefully set in place to help people who have problems with passwords or with the on screen keyboard. This transient display lasts 3 seconds to avoid too big a security problem. But this is still largely sufficient for anyone behind you to read it really easily. Moreover this transient display can be easily captured by any camera or by a software on the iPhone:

iPhone password transient display

I evaluate this echo of any password as a serious risk. This echo partially exposes a secret.

Is there any simple configuration method to suppress everywhere this mechanism of transient display of any password?


For information, I reported this security problem at Apple:

Once I have defined a passcode to protect my iPhone, and within every application asking me a password, when entering my password iOS makes a transient display of any character I type. I guess that this transient display of passwords was purposefully set in place to help people who have problems with passwords or with the on screen keyboard. This transient display lasts 3 seconds to avoid to create too serious a security problem. But this is still amply sufficient for anyone behind you to read it really easily.

This transient display can be easily captured by a camera surreptitiously activated by a malicious neighbour.

I didin't find any easy way to block this security weakness with iOS 7 up to iOS 9.

How to disable this transient display of any password on iOS?

Update: weakness still present on iOS 12, 13, 14, 15.

2
  • Be aware that software on the phone cannot screen-record the keyboard or text field
    – Ezekiel
    Commented Apr 26, 2023 at 13:50
  • Please guess how I made the included screen capture 😎.
    – dan
    Commented Apr 26, 2023 at 13:55

2 Answers 2

12

You can't, at least not in any iOS version that has been released by Apple.

I understand this isn't the answer you were looking for.

1
  • A clear negative answer is a valid answer!
    – dan
    Commented Dec 25, 2015 at 14:39
-1

The use of TouchID is the only way to kind of get around this issue, but after a reboot, you still have to enter it. Even if you could suppress the characters appearing, you still have to TYPE IN the password, and anyone who could see the letters of the non-suppressed entry string could also see what you're typing even if the entry string was suppressed. Hence why TouchID is really the only way to fly, other than concealing your screen.

1
  • 1
    I use passwords because TouchID as any biometry technic, is a risk, a new problem source and not at all a solution in the security field. My question is just about "transient display of passwords".
    – dan
    Commented Dec 27, 2015 at 10:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .