Apple steps up security with native two-factor and 6-digit passcodes in iOS 9

Nestled in the middle of iOS 9 announcements were two security-related bumps: Apple now suggests you sete a six-digit passcode instead of a four-digit one; and two-factor authentication becomes a built-in part of iOS (and OS X) rather than an afterthought.

Orders of magnitude harder

The first change is easier to explain. It’s up to 100 times harder to crack a truly random six-digit code (that is, not a pattern like “111111” or “123456”) than the same four-digit code. While brute forcing 10,000 codes into an iOS device seems unlikely, a set of researchers recently exploited a power-off issue in iOS devices to create an automated four-digit cracking system. Breaking the code takes from 6 seconds to 17 hours, they say.