Login Settings

Laptops at the studio hold the source code of a game that hasn't been released, and a laptop left in a car or a café is the theft the IT lead worries about most. The laptops' drives are encrypted, so whoever takes one can't read the disk in another computer; they get as many tries at the sign-in screen as the laptop allows. So the IT lead sets the laptops' sign-in rules one at a time, starting with what a password has to look like.

Three rules are on the table. A keyboard offers 26 lowercase letters, and 94 characters in all once uppercase letters, digits, and symbols are counted.

Rank the three rules by the number of passwords each one permits. Then check with the counts below.

Rule B looks like the clear winner, since it allows every character on the keyboard. Rule A allows $26^{10}$ passwords, about 141 trillion. Rule B allows $94^{10}$, about 54 quintillion, some 380,000 times as many. Rule C allows $26^{14}$, about 65 quintillion, more than rule B with no symbols at all. Adding characters to choose from helps, and adding length helps at least as much. These counts assume the characters are random, and people's aren't: a rule that demands a symbol tends to get one exclamation point at the end. The IT lead requires both anyway, a 14-character minimum and the mix of sets, and counts on the length to do most of the work.

A password kept for years has had years to be seen over someone's shoulder or saved somewhere it shouldn't be, and a rule that forces a new one does little if the old one can come straight back. The laptops remember each user's recent passwords, as hashes, and refuse a new one that matches.

The IT lead turns on password history now and leaves the question of a maximum age for the managers to settle.

The last setting controls what happens when someone keeps getting the password wrong.

Syed Rizwan Farook and his wife killed 14 people at a holiday gathering of his coworkers in San Bernardino, California, on December 2, 2015, and died hours later in a shootout with police. The FBI recovered the iPhone 5C his employer had issued him, locked with a passcode nobody knew. After the first few wrong passcodes, its software made each further miss cost more time, up to an hour of waiting, and it offered a setting that erased the phone's data after ten wrong passcodes. Nobody could tell whether that setting was on. What did the FBI need before it could start guessing?

It needed a phone that wouldn't erase itself or make it wait between guesses. The erasing and the delays were carried out by the phone's own software, and an iPhone loads new software only if Apple has signed it, so software the FBI wrote itself would not load on the phone. On February 16, 2016, a federal magistrate judge ordered Apple to help, most directly by writing a special version of the phone's software that would turn off the erasing and the added delays and let a computer submit passcodes electronically. Apple refused, and its chief executive, Tim Cook, wrote to customers that such software would be the equivalent of a master key, one that could unlock any iPhone in someone's physical possession, and the company fought the order in court.

The fight ended before the court ruled on Apple's challenge. On March 21, 2016, the Justice Department told the court that an outside party had shown the FBI a possible way in. A week later it reported that the FBI had unlocked the phone, and it asked the court to cancel the order. Five years later The Washington Post identified the outside party as Azimuth Security, a small Australian firm whose researchers chained together flaws in the phone's software to take control of it, then ran a program that tried passcodes without triggering the erasure. A senator said in 2017 that the FBI paid 900,000 dollars for it. Nothing of real significance turned up on the phone, The Post reported, and no links to foreign terrorists.