Dual Lock: two things, every time

Why one way in isn’t always enough

Each way of opening a vault has a weak spot. A passcode can be watched. A face can be used by someone who holds the phone up to you. Asking for one or the other means the weaker one wins.

There is a second gap that surprises people. With Face ID unlock on, and Dual Lock and Maximum Security off, Sealed asks iOS for owner authentication and not for a face match alone. In iOS, an app that asks for owner authentication gets Face ID or Touch ID first, and the device passcode when biometry isn’t available or the person taps the fallback button. With plain Face ID unlock on, someone who knows your iPhone passcode can open Sealed through the Face ID prompt.

If anyone else knows your iPhone passcode, that matters more than any face check.

What Dual Lock does

Dual Lock asks for your passcode and a Face ID match together, and it is part of Sealed Pro.

Dual Lock’s second step takes Face ID or Touch ID only: your iPhone passcode can’t stand in for it, so one watched passcode can’t do both halves.

That closes both gaps at once. A watched passcode isn’t enough, because the face step follows. A face isn’t enough, because the passcode comes first. And the phone’s own passcode can’t be used for the face step.

Dual Lock applies to a pattern as well as a passcode: after either, Sealed asks for your face.

When it says no

If Dual Lock can’t ask for a face, because Face ID is off for Sealed or locked, the vault stays shut instead of opening on the passcode alone, and your recovery key can turn Dual Lock off.

That is the price of a lock that never falls back to the passcode alone. If you turn off face unlock for the app in the phone’s settings, or the face check locks itself after failed tries, the vault waits.

The way out is your recovery key. If Dual Lock is what keeps you out because Face ID can’t be asked, the recovery key also switches Dual Lock off, and Sealed tells you so. Keep it somewhere you can reach without the phone: the recovery key page has ideas.

The decoy and Dual Lock

With Dual Lock on, the decoy passcode opens the decoy vault without the Face ID step that your real passcode needs.

Keep that in mind if you set up both. The decoy vault page has the details.

Turning it on

1. Save your recovery key first. It is your way back if the face step can’t run.
2. Make sure Sealed has a passcode of its own: Dual Lock pairs it with your face, and won’t turn on without one.
3. Dual Lock, Lock Screen, Maximum Security and Vault Passphrase are in Settings, under Passcode & Unlock, in the Extra Protection section. Turn on Dual Lock there.
4. Lock the vault, then open it once: passcode first, then your face.

Dual Lock and the other protections

• With Maximum Security, your face also releases the vault key. With Maximum Security on, every unlock ends with a live Face ID or Touch ID match that releases your vault key.
• With a vault passphrase, Dual Lock can’t be on. A vault passphrase must be at least 12 characters, needs your recovery key saved first, and can’t be on together with Maximum Security or Dual Lock.

Free or Pro

Dual Lock asks for your passcode and a Face ID match together, and it is part of Sealed Pro.

Where Sealed helps, and where it doesn’t

It helps when one way in could be taken from you: a code someone watched, or a face someone could use. Dual Lock’s second step takes Face ID or Touch ID only: your iPhone passcode can’t stand in for it, so one watched passcode can’t do both halves.

It doesn’t do these things:

• Let you in when the face step can’t run. If Dual Lock can’t ask for a face, because Face ID is off for Sealed or locked, the vault stays shut instead of opening on the passcode alone, and your recovery key can turn Dual Lock off.
• Stop someone who has both your passcode and your face. That pair is what it asks for. Dual Lock asks for your passcode and a Face ID match together, and it is part of Sealed Pro.
• Apply to the decoy. With Dual Lock on, the decoy passcode opens the decoy vault without the Face ID step that your real passcode needs.
• Work with a vault passphrase. A vault passphrase must be at least 12 characters, needs your recovery key saved first, and can’t be on together with Maximum Security or Dual Lock.
• Come with the free plan. Sealed Pro adds privacy tools including the decoy vault, a duress code, break-in photos, Dual Lock, Location Lock, Maximum Security, locked stacks and seven lock screens.