[jackric]

Who was smart enough to implement rate limiting there, but not an exponential lockout period?

[vxNsr]

They did, the exploit here is shutting down the phone before it has a chance to log there was a password attempt.

[TwoBit]

Doesn't that apply only to older phones?

[bildung]

The probable standard answer for every large organization: Those were the responsibilities of different teams.

[Scoundreller]

Someone who never got DDoS’d by their own app after their server went down, that’s who.

[dylan604]

Haven't there been stories of parent's losing their phones because their kids randomly entering in passcodes forced the exponential time outs to be into the years (and longer) time frames?

[spideymans]

The lockout period progresses something like 60 seconds, 5 minutes, 30 minutes, 1 hour, 3 hours, 6 hours, 1 day and so on. This should only be possible if the child had sole possession of the phone for days. Not saying it’s impossible, but this appears to be an extreme edge case.

I suspect most of these reports come from either bugs in the software (and some quick Googling suggests this has been the case), or perhaps that even someone (heck, even a savvy child) was trying using some sort of brute force exploit to unlock the phone.

[astrange]

My phone once entered permanent lockout because I left it upside down on a surface that registered a passcode button press every few minutes.

[alias_neo]

I can see it happening. My 1.5 year old daughter routinely locks me out of my phone by touching the in-screen fingerprint reader when she takes my phone from the desk or wherever it's lying around at home.

I have a password the maximum length allowed so it's not trivial to unlock when she does that.

[FearlessNebula]

Reset the phone and restore from backup

[russh]

Not possible, it is now a paper weight. Found this out when a disgruntled employee “forgot” the passcodes to several devices before quitting.

[tinus_hn]

That happens when you can’t access the Apple account that has the activation lock for the device. You don’t need the device passcode to reinstall it.

[dylan604]

Seems like it would be safer to enable wipe device after 10 wrong entries than allowing the exponential time out to increase