Apple Responds to Report About Thieves Permanently Locking Out iPhone Users

[fredrik9]

so, don't use a simple password, don't get your device stolen, or leave it behind for someone to grab.

If you do, go to Find my on another device and quickly mark it as lost, and/or remotely erase it. Same goes for your wallet and credit cards, although you can't mark them as stolen or erase them

”Don’t get your device stolen”. Sure also on everyone’s list:
Don’t get robbed
Don’t get hit by a mad driver
Don’t get hit in the face by violent people
Don’t get raped
Don’t get murdered

Easy. Just don’t do it.

 

[jarman92]

So first WSJ publishes an article suggesting it's too easy to change your account security/Apple ID password and Apple should make it harder. Now they publish an article suggesting it's too difficult to change your account security/Apple ID password and Apple should make it easier. So Apple is damned it they do, damned if they don't, and people continue to refuse to recognize their responsibility for their own security and data.

 

[thejadedmonkey]

I never used to have to enter my passcode when I used TouchID.

FaceID needs to be replaced.

 

[sk1ski1]

And now with Apple's new savings account, the thief can lock you out of it, transfer all your Apple account savings to Apple Cash, and go on a spending spree.

 

[addamas]

It’s no longer works.
Try reset your Screen Time password and perform actions that’s you don’t know your iCloud account…

I have just filled feedback ticket to Apple giving all steps to erase iCloud password knowing only:
> iPhone unlock password
> First Name (from greyed out top of Settings app)
> Last Name (from greyed out top of Settings app)
> email address linked with iCloud which will be 99% times already in Email App on this iPhone without any security
> phone number allocated with probably the same iPhone you have from first part of this list (just call someone number to know it)

It’s even worse…

In Settings > Wallet and Apple Pay

There are private unprotected data about iPhone user under “Transaction Defaults” (no way to hide it behind Screen Time)

Edit: It can be disabled via Screen Time > Restrict… > Allowed apps

Edit2: It blocks just Control Center Wallet app not this part in Settings 🙁

Removing private data from this Menu allows to enter this submenus (when you tap to change address / email / cell phone) and shows as suggestion… iCloud account details (cell number and email )

Also made Feedback ticket for that 🙁

 

[TECK]

I recently set up a recovery key and keep a printed version stashed with important documents. I'm now considering enabling the Screen Time passcode to prevent account changes.

The recovery key is useless in this context. If the thief has access to your Apple ID through the stolen iPhone, he can replace the recovery key easy or disable it, all they ask is the current iPhone passcode. A proper way would be to ask you enter the old recovery key or at least the Apple ID password.

Just don't have your iPhone stolen, is the only safe alternative.

 

[jarman92]

Just use Face ID or Touch ID and you should be fine. At times like this, I wish Apple had introduced an In-Display Fingerprint Scanner. The technology is obviously there.

The technology isn't there, though, at least not to Apple's standards. In-display readers are still slower and less reliable than Touch ID was. Plus, Face ID is better in just about every way.

 

[BaldiMac]

I never used to have to enter my passcode when I used TouchID.

FaceID needs to be replaced.

Not sure what you are referring to here. The passcode rules are the same whether you use FaceID or TouchID.

 

[jarman92]

This would be less of an issue if iOS didn't randomly fail to FaceID and ask for a passcode, often at the least convenient time.

I wish Apple would get this resolved.

Seconded. It's ridiculous how many times I take my phone out and it requires a passcode for some reason.

 

[jarman92]

Not sure what you are referring to here. The passcode rules are the same whether you use FaceID or TouchID.

But Face ID seems to randomly activate a lot more than Touch ID ever did. Apple should allow for like 5 failed Face ID attempts instead of the 2 they allow for now.

 

[ypl]

The problem is how much the devices with Face ID and Touch ID still rely on you inputting your passcode in everyday use. “Just use FaceID” can’t be the answer when apple themselves doesn’t let you just use FaceID

Countless times have I been ready to pay for something, double tap the side button to pull up my card and tap to pay, when I’m suddenly prompted to put in my entire password just to use Apple Pay. Instead of FaceID which is like, what the iPhone is supposed to use? Isn’t this the entire reason why the iPhone has FaceID in the first place?


It’s honestly a stupid system if the iPhone is only going to rely on FaceID sometimes and force you to input the password other times.


Not only does this hold up the line wherever I am, now everyone behind me can clearly see me type in my entire password. Awesome.


Add to that all the times that FaceID actually does attempt to activate but fails anyway and you still have to put in your password, and it’s a system that ultimately can’t be relied on for security OR convenience.

Seems like I should keep my iPhone SE 2022 for as long as possible? Can't remember when I had to use password instead of TouchID.

 

[dk001]

This is not Apple specific.

It can happen on Windows/Android/ATM/your numeric house lock. Basically anything with a passcode can be stolen if one is not careful. Like the ATM has the signs posted "Be aware of your surroundings and enter your key when no one is watching.......", every user has to use this caution at all times.

Locking you out of your digital id/world is Apple specific.
In the other systems you can create havoc but lock you out? No.

 

[diddl14]

Phone should lockup completely if not near my Apple Watch. Might be some situations where I like to temporary switch this of but this should be the default. And clearly not a universal solution as not everyone with an iPhone has an Apple Watch.

 

[Marie.D]

"OMG!!!!! I left my keys on at the bar when I was drunk! I'm gonna sue Schlage for making it so easy for the guy who took 'em to break into my house!"

Do stupid things, win stupid prizes. Sorry folks, it may sound harsh but don't do stupid things!

You've never made a mistake in your life? Stuff happens. Sometimes you might be exhausted after work and your mind slip and your guard is down for a single minute. Let's not victim blame here. The fact that you can sidestep most protections and take control of a person entire ecosystem with a 4-6 digit PIN is absolutely insane. the PIN should only be asked to unlock the phone, not make changes to accounts or disable Find My.

 

[dk001]

It needs some kind of solution.
Currently Apple doesn't think so.

 

[UKMacDude]

Holy s… it’s damn easy to erase iCloud password using workaround when forgot Screen Time password.

Edited: removed all steps I wrote I have followed to reset iCloud password knowing only numeric password used to unlock this device I use as “stolen” dummy

Really I am scared now

I think about this risk way too much after the WSJ article. My biggest worry is a snatch theft when I'm using the phone out in the open.

 

[MrRom92]

Seems like I should keep my iPhone SE 2022 for as long as possible? Can't remember when I had to use password instead of TouchID.

My iPad Pro occasionally makes me enter a full password there as well so I’m not sure Touch ID devices are completely better in this regard

 

[BaldiMac]

It needs some kind of solution.
Currently Apple doesn't think so.

What makes you think Apple doesn't think so?

Any solution is going to be a balance between losing access to your account because you forget something or losing access to your account because someone steals something. I'd argue the former is much more common than the latter.

 

[AbSoluTc]

So, Apple’s response was “aahh… sympathies” ?

I mean, what do you want them to say? Apple gives EVERYONE tools to prevent exactly whats happening. It's not Apples problem to solve. People need to stop using codes. The amount of people still using 4/6 digit codes this day in age is alarming.

 

[AbSoluTc]

Seems like I should keep my iPhone SE 2022 for as long as possible? Can't remember when I had to use password instead of TouchID.

False.

The passcode can always be used instead of Touch ID, and it’s still required under the following circumstances:

• The device has just been turned on or restarted.
• The device has not been unlocked for more than 48 hours.
• The passcode has not been used to unlock the device in the last six days and TouchID has not unlocked the device in the last eight hours.
• The device has received a remote lock command.
• After five unsuccessful attempts to match a fingerprint.
• When setting up or enrolling new fingers with Touch ID.

 

[AbSoluTc]

I never used to have to enter my passcode when I used TouchID.

FaceID needs to be replaced.

Yes you did. See above.

 

[Shirasaki]

"blah blah blah, we remain committed to... highest standards of... love our users," said Apple, even though the company provides no support whatsoever for password- or account lockout-related issues. If this happens to you, you're 100% up a creek.

Yeah. Apple has zero care of customers beyond their money. That should’ve been the default of how people treat them, but sadly it is not.

And the irony is that my wife forgot her password and locked herself out of her dot.Mac address and subsequently her iPad mini and iPhone 4s back in 2017 and the devices have been sitting, uselessly on the shelf for five years. Apple refuse to unlock them even if she provides a passport and current proof of address... For some reason, they will only accept a receipt from the shop where they were purchased... But we can't find the receipts.

Their sage advice re the iPad mini was, "it's an old device. New ones have a Retina display."

Just one more count on Apple trashing customers with unfortunate scenarios.

 

[jimbobb24]

Apple convenience in this case is the fault.

Something as simple as having the device access code is only for device access.
Changing anything requires a second unique passcode/password. Even if you use keychain, this secondary code should be required to view.

I am sure there are other solutions.

Not fault....trade off. Everything is a trade off and for a user who only makes an apple ID on the phone and never interacts with apple another way using the pass lock is a reasonable trade off.

 

[gadgetfreak98]

I wonder who's been encouraging these stories at WSJ. Definitely been a hitpiece feel to Stern's recent columns.

Why do you think so? Clearly there are criminals out there who are aware of these vulnerabilities and are able to exploit them, at least sometimes.

I’m glad to know about these things, so I can try to mitigate the risk. I know I have mindlessly (and carelessly) entered my passcode in public if Face ID fails for whatever reason. I’m glad — at a minimum — to be reminded of the power of that passcode, and the need to protect it. I certainly was operating under the assumption that if someone stole my phone, I could always just wipe it remotely and my data would be fine. That’s just not so certain.

If you don’t care about this, or believe you are adequately protected, then I guess it’s just not interesting to you. But I would like to always be alerted of what I can do to better protect myself and my devices.

 

[bobcomer]

What makes you think Apple doesn't think so?

Apple's statements at the head of this thread?