AskMeAnything
Ask
Ask
30
@shortcut_sam ·

One UI 9.0 permanently locks the phone after 13 wrong PIN attempts: which Galaxy devices does this actually apply to?

This landed in the last few days and the write-ups disagree on the one detail that matters to me.

What is being reported about the One UI 9.0 lock screen change:

  • failed unlock attempts now escalate instead of retrying forever: a 1 minute wait after 5 wrong entries, then 5, 15, 30 and 90 minutes, then multi-hour waits from around the 10th
  • on the 13th consecutive failure the device is permanently locked and the only documented way to use it again is a factory reset, which erases it
  • entering the exact same wrong credential twice in a row is counted once, so muscle memory does not double-punish you

Two things I cannot pin down:

  1. Does this hit a phone that was updated to One UI 9, or only phones that shipped with 9.0 preloaded? Coverage keeps saying "devices launched with One UI 9.0" and then names the newest foldables, which is a much narrower claim than "One UI 9 devices".
  2. If you are at attempt 11 and you finally remember the PIN, does a successful unlock reset the counter, or is it cumulative for the life of the device?

If you have a retail unit on 9.0, what does the lock screen settings page actually say? I am not testing this on the phone I use.

7 answers Share
Report

7 answers

BestTopNewOldControversial

Answering anonymously — a moderator will review it first.

  • @airgap_amir · yesterday · 2 replies
    @airgap_amir ·

    The brute-force framing is the least interesting part of this. Thirteen guesses was never going to stop anyone who knows what they are doing, and the escalating timers already did the heavy lifting.

    The part that changes your life is that a forgotten PIN is now a wipe-level event with a hard floor. So the question to answer this week is not "is 13 the right number", it is "what dies if this phone is wiped tonight". Authenticator seeds with no export. Passkeys that only exist in the device keystore. Anything in a secure container that is not in a backup. If those are on the phone and nowhere else, the lock policy is not your problem, your recovery plan is.

    16
    Share
    Reply

    Answering anonymously — a moderator will review it first.

    Report
    • @hot_heap_hana · yesterday
      @hot_heap_hana ·

      And the wipe is not the end of it. A factory reset puts you into reset protection, so you then need the account credentials the phone was signed into. If the PIN is gone and the account password only lives in a manager unlocked by that phone, the reset does not rescue you, it just moves the wall. Test that chain before you need it.

      7
      Share
      Reply

      Answering anonymously — a moderator will review it first.

      Report
  • @etcd_eli · yesterday · 2 replies
    @etcd_eli ·

    On your question 1: every write-up I read this week traces back to the same wording, and it is the narrow claim. The policy is described as applying to devices that launch with One UI 9.0 preloaded, and the examples named are the newest foldables (Z Fold 8, Z Fold 8 Ultra, Z Flip 8). Devices updated to One UI 9 from an earlier version are described as not affected.

    The published escalation table is: 5 attempts = 1 minute, 6 = 5 minutes, 7 = 15 minutes, 8 = 30 minutes, 9 = 90 minutes, 10 = 4 hours, 11 = 12 hours, 12 = 24 hours, 13 = permanent lock.

    Caveat worth stating out loud: that is documentation as quoted in press coverage, not something I have watched happen on a handset. Carrier firmware and enterprise policy can layer on top. If someone has a retail 9.0 device, the interesting screenshot is the lock screen settings page, not the marketing page.

    20
    Share
    Reply

    Answering anonymously — a moderator will review it first.

    Report
    • @interval_ida · yesterday
      @interval_ida ·

      On question 2, the word used everywhere is "consecutive", which implies a successful unlock resets the counter, and that is how every lock screen implementation I have looked at behaves. But I have not seen it stated explicitly for 9.0, so treat it as the likely behaviour rather than a promise. The number you should plan around is not 13, it is "how many tries do I get before waits make the phone useless for a day", and that is 9 or 10.

      9
      Share
      Reply

      Answering anonymously — a moderator will review it first.

      Report
  • @rust_rescue_rin · yesterday · 2 replies
    @rust_rescue_rin ·

    It rolls out to every Galaxy that takes the One UI 9 update, S22 and newer, and it silently wipes at 10 attempts. Turn off automatic updates if you have kids.

    10
    Share
    Reply

    Answering anonymously — a moderator will review it first.

    Report
    • @coldstorage_cy · yesterday
      @coldstorage_cy ·

      Three corrections, because this is the version that will get repeated.

      1. The reported threshold is 13 consecutive failures, not 10. The 10th attempt is a 4 hour wait.
      2. Scope in the reporting is devices that ship with 9.0 preloaded, not everything that receives the update.
      3. "Permanently locked" is not "auto-wipe". The device described stops accepting unlock attempts, and you then have to factory reset it to make it usable. That distinction matters: a phone that wiped itself has already destroyed the data, a phone that is locked has data on it that you still cannot reach. Neither gets your photos back, but they are different failure modes if you were hoping a repair shop could help.
      1
      Share
      Reply

      Answering anonymously — a moderator will review it first.

      Report
  • @proof_pilar · yesterday
    @proof_pilar ·

    Run the arithmetic on the toddler scenario, because it is the one everyone panics about. To reach attempt 13 you have to sit through 1 + 5 + 15 + 30 + 90 minutes and then 4, 12 and 24 hours of enforced waiting. That is more than a day and a half of deliberate, spaced-out attempts.

    A child in a pram or a pocket touch cannot get there in one session, and repeated identical entries collapse into one failure anyway. The realistic victim is a person who genuinely forgot the PIN and keeps coming back to it over two days, which is exactly the person least able to afford a wipe.

    1
    Share
    Reply

    Answering anonymously — a moderator will review it first.

    Report