Apple Responds to Report About Thieves Spying on iPhone Passcodes to 'Steal Your Entire Digital Life'

[NagasakiGG]

It seems that the short 4-digit passcodes are not very secure so maybe best to use alphanumeric and/or long passcodes (12 or more digits) ?

Imho people who use 4-digit codes, especially stuff like 1111, 1234, 0000 etc deserve it. Idk how people can be so careless just for commodity

 

[dk001]

On my iPhone, with two factor authorization on, and when I tried to change my password through settings, I could not go any further, until a code was received from another device. The WSJ article mentioned 2FA, and it said the code was sent to the same phone. The same phone the hacker had. Obviously not a good idea. https://support.apple.com/en-us/HT204915

I have 2FA on - iPhone 13PM, iPad Pro 11, MBP.
I was able to change it on my iphone with just my passcode.
I only have had it a must on another device for a new device setup.
Are all your devices trusted devices?
What is different in your setup?

 

[CharlesShaw]

It’s about striking a balance between usability and security. Apple will never be able to plug up every scenario that a ne’er dowell would come up with.

True. And I’m thinking there are some parents reading about this and wondering if their clever kids already know their passcodes and whether or not they should be concerned about their Apple ID’s.

 

[dk001]

If Apple brought back Touch ID this would be less of a problem. Having to put your passcode in because Face ID has decided it couldn’t see your face properly for some reason is the issue here.

Just a simple “Enter Current Password” as part of the reset process would fix a lot.

 

[anthogag]

Let’s say your being held against your will and an actor has your phone trying to authenticate with Face ID, what would you want.

It’s about striking a balance between usability and security. Apple will never be able to plug up every scenario that a ne’er dowell would come up with.

Being held against your will is a much different situation. Maybe in that circumstance the iPhone can recognize when another person is holding the iPhone as your face is scanned.

In this situation people are looking over shoulders to watch iPhone users enter the code on the number pad and then wait for an opportunity to five-finger-discount the device.

If you’re at a bar use the Watch to pay. It’s 2 button presses and ‘ping-ping’.

 

[I7guy]

Just a simple “Enter Current Password” as part of the reset process would fix a lot.

Not if you forgot your password.

 

[Michael Scrip]

Long story short:

A simple PIN should be for unlocking your phone. (with FaceID/TouchID for convenience)

But any account-level changes should be locked behind multiple doors requiring your actual iCloud password.

It shouldn't be easy for anyone other than yourself to change these things.

A bad guy should not be able to reset passwords, turn off Find My, access your money, or gain access to any other vital services if they see you type in a simple PIN and steal your phone.

 

[CharlesShaw]

Just a simple “Enter Current Password” as part of the reset process would fix a lot.

Not if you forgot your password.

And dealing with forgotten passwords by users without recovery methods is probably what led to this in the first place.

I’m going to learn about the recovery contact option, since that sounds like a good one once things get locked down more.

 

[dk001]

Not if you forgot your password.

But you have options via the browser for this as an example.
But…. You can also find this password in Settings > Password.

 

[dk001]

Long story short:

A simple PIN should be for unlocking your phone. (with FaceID/TouchID for convenience)

But any account-level changes should be locked behind multiple doors requiring your actual iCloud password.

It shouldn't be easy for anyone other than yourself to change these things.

A bad guy should not be able to reset passwords, turn off Find My, access your money, or gain access to any other vital services if they see you type in a simple PIN and steal your phone.

They also need another method for most instead of having your password in Settings > Password under AppleID.apple.com or idmsa.apple.com.

Yeah, bet Apple does some changes soon.

 

[I7guy]

But you have options via the browser for this as an example.
But…. You can also find this password in Settings > Password.

Not if you get your phone ripped from your hand after someone sees you type in your password. The allegation is you can reset your password with your phone passcode and no other 2fa needed.

 

[I7guy]

And dealing with forgotten passwords by users without recovery methods is probably what led to this in the first place.

I’m going to learn about the recovery contact option, since that sounds like a good one once things get locked down more.

Yes that is the issue, imo.

 

[cupcakes2000]

If you read the article, one person lost $10,000 due to the phone being stolen (in addition to being assaulted). I don’t know about you, but losing $10k would mean I’d likely lose my house. Besides, all the utopian future education in the world isn’t going stop the actual crime that’s happening in real time.

Have you seen the yearly FBI crime statistics? Yeah, I’m not taking any chances. Again, don’t want shot, don’t assault innocent people. Simple, really.

In your country maybe. In mine, we don’t have a gun problem. We don’t just shoot everyone that we feel ‘needs a lesson’ and the police don’t either. Hence, violent crime in the manner you’re talking (whip out a gun to solve your problems), doesn’t particularly exist. So consequently, people generally don’t get murdered by civilians or by the police for what is essentially petty crime.

 

[lovehateapple]

You just have to be careful when using your iPhone outside in public.
Apple needs to consider bringing back Touch-ID. Two Factor Authentication: Touch ID + Face ID simultaneously

I agree. I hope apple is able to figure out under the screen TouchID or move it to the power button. I wouldn't want them to bring back the home button in order to have TouchID.

 

[xdmys]

If you’re stupid enough to lose your phone then maybe you should go back to using a flip phone instead

 

[Speed38]

Please help as I fail to see the problem here. A pal & I have been emailing back and forth about this "vulnerability".

He writes this:
I log into my wife's iPhone using only her four-digit passcode all the time. It doesn't recognize my face so it gives me the option to inter her four-digit passcode; I do that, and I'm in, and then I can do as I like. So of course I've emptied her bank account, numerous times, etc., but thank heaven she's a forgiving soul.

I respond with this:
This is very interesting and it leads me to conclude that there must be some security setting somewhere that you have not turned on yet because I cannot replicate what you did on your iPhone on my iPhone

I...
• logged into my wife’s iPhone X using her 4-digit passcode,
• went to iCloud.com which required I input a password to enter,
• tapped on the blank where the email or userid is required,
• at the bottom of the screen I get [Log into Apple.com using a password from iCloud Keychain] and when I tap there I get [Face not recognized. Try again/Cancel] and I cannot get into her iCloud account.

So...where's the vulnerability?

 

[ADrunkenMarcus]

Long story short:

A simple PIN should be for unlocking your phone. (with FaceID/TouchID for convenience)

But any account-level changes should be locked behind multiple doors requiring your actual iCloud password.

It shouldn't be easy for anyone other than yourself to change these things.

A bad guy should not be able to reset passwords, turn off Find My, access your money, or gain access to any other vital services if they see you type in a simple PIN and steal your phone.

Agree 100%

I'm very careful with my iPhone and don't use my PIN in public. However, following this discussion thread, I have activated Screen Time and set it so that nobody with the device PIN could access my Apple ID or alter the password (also turned off so they couldn't stop me doing a remote wipe via Find my iPhone).

I also went through all my App settings turning them to the max, so - for example - the app to access my email account requires Face ID and requires it again immediately. Finance apps (i.e. online banking) are accessed by Face ID and I do not use Keychain for passwords related to finance accounts.

And I do think Apple need to change it so you need the OLD password to change your iCloud password.

 

[centauratlas]

Just a simple “Enter Current Password” as part of the reset process would fix a lot.

Something like, confirm this on another logged in device (except the watch that is on your wrist) would be helpful too.

I'd also like the ability to sign my phone out of iCloud from my watch - or lock it so that it could only be unlocked with the password AND confirmation from a different Apple device.

 

[golfnut1982]

I have 2FA on - iPhone 13PM, iPad Pro 11, MBP.
I was able to change it on my iphone with just my passcode.
I only have had it a must on another device for a new device setup.
Are all your devices trusted devices?
What is different in your setup?

My MBP is a trusted device. I see what you mean now. When I tried to change my PW, apple wanted to know my iCloud password. Once I put that in, then the passcode came up. Too easy.

 

[Damian83]

Huh?

sorry, i thought u intend that once face id is enabled, code is disabled. however, using touch id or face id in a disco, can be difficult. i think those factors are well considered by thiefs and this article is intended for phones with face/touch id enabled. meaning that people uses code even if "IDs" are enabled for various reasons

 

[dk001]

Not if you get your phone ripped from your hand after someone sees you type in your password. The allegation is you can reset your password with your phone passcode and no other 2fa needed.

Your premise and not what I was answering to. I may have misunderstood you. I was just looking at other ways to reset your password if you forget it.

 

[MrTangent]

If you were being assaulted my guess is you give up everything to save your life. In this case all the security in the world wouldn’t help. Of course you could use the phone and not have any financial apps or information or apple pay set up. I know people who use an iPhone like that. The most a thief would get is the weekly Costco circular.

But the article makes good points about protecting your assets.

My life and my possessions are mine. Muggers choose their destiny. I’ll choose mine. If their destiny includes imperiling my life, my family’s life or trying to steal from me I will take necessary steps to defend the aforementioned. They forfeit the right to exist if they threaten my right to do the same.

 

[zoomp]

It's become common practice where I live to setup screen time local passcode and app limit every important app to 1 min. Then you have an extra security layer over Face ID. Also, with this scheme, you can prevent easy change of your Apple ID password.

It's very common to be robbed by bicycle or from the car window (heavy traffic), with the iPhone unlocked. The thieves manage to change our Apple ID while cycling full speed. Amazing. With Screentime, it's way more difficult.

 

[hans1972]

Android has a nice feature in that you can set multiple users. You can have a secondary user that only has access to a tightly locked down feature set and only use that in crowds. The users the phone signs into is dependent on which passcode you enter.

And I believe 3+ billion Android users are doing this today.

In many societies it's learned at an early age. Greenlanders learn their kids this even before they learn any of their 58 words for snow.

 

[hans1972]

Why would anyone be entering their PIN in front of other strangers?

Those of us living in civilised society?