Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
iOS Device Ransom Attacks Continue to Target Users in U.S. and Europe
- Thread starter MacRumors
- Start date
- Sort by reaction score
My bank has a "feature" which annoys the hell out of me, because it is not well thought out.
You log in , but it doesn't make a distinction between upper or lower case, but one gets a picture
to verify that it is the account you want to log into.
Every 6 months one MUST change the password. If somebody forgets, the account becomes unaccessible.
Then one has to call the bank, they reset things and the "feature" starts over.
Only problem is that after they reset I can use my old password again.
Imagine the outcry if Apple would automatically block all access after 6 months w/o password change.
This actually happened to me a few months ago. I (stupidly) had used the same password on a variety of different sites. It was secure, but one of the sites was breached a while back and I didn't change them. I woke up to a message that said my iPhone was locked. Fortunately I was able to reset my Apple ID password because of the personal questions, but they locked my computer, ipad, and iPhone. They also took over several other sites that used the same username and password combination and I had to get those back. Point is, before it happens to you, start using a password database. I use Dashlane now.
Understand the frustration, but it's for your safety, to prevent the very thing you are trying to prevent.
phrases people, phrases. it's really easy, just say iCloud.comIsThe1ToRuleThemAll and outlook.comIsThe1ToRuleThemAll (bonus points if you add spaces, no one said you couldn't)
You do stuff like this, and you aren't reusing your password, the password is easy to remember, and a hacker is going to have a great time trying to break your password. Yes it takes a bit of time, but that's what keychain and similar programs are for.
You do stuff like this, and you aren't reusing your password, the password is easy to remember, and a hacker is going to have a great time trying to break your password. Yes it takes a bit of time, but that's what keychain and similar programs are for.
The Macrumors summary says the problems were 1) people used same passwords on other sites and those sites got hacked (not Apple's fault if other sites get hacked), and 2) phishing scams. For phishing scams, I think Apple can do better. Most are sms messages or imessages with a web link to a fake Apple site from people not in your address book. Apple should make it hard to launch links from unknown people by displaying "are you sure" prompt or something.
Apple has on file all the data like MAC addresses etc for each device owned by the user. A simple start, No access to AppleId from any device except those registered. Like two-factor without all the hassles. Then add additional lyers for other access if needed. Not perfect but maybe a good place to start.
Correct me here, but can't Find my iPhone can only ever use password (one factor) authentication? They can't very well ask you to receive a text or notification on a phone that you can't find / lost or was stolen.
Or am I missing something?
With your recovery key you could reset your password to recover your account, however, the phone would remain locked. Or can you unlock the phone with your account password? I've never had to lock my phone before.
What do you know
cheers, it's been that kind that I've setup a new phone instead of doing a restore
Had a lot of trouble finding a comment quoting this. Thought I'd help out.
Great, so some idiot changes their password from Password1 to Password2 thus believing that they're doing the 'right thing' but doesn't actually fix anything. The real solution is to actually punish idiots whose accounts are hacked because of moronic passwords - $500 fine, and then you'd suddenly start to see people take choosing a password seriously. Oh, and to people who keep saying, "OMG! I have so many passwords to remember" - so you have enough memory capacity to remember inane crap about celebrity gossip or some sports trivia but something incredibly important like your own security becomes a little too much? really?
People are dumb and lazy.
An email wouldn't change anything.
People have to pay for their stupidity, it's a natural tax.
Apple is 2 factor.
iMessage is end-end secure, unlike SMS, which is easily spoofed at the source, and due to lax phone company policies, easily spoofed at the client side as well.
If you enable 2FA on your AppleID, you must know the password, and a code sent by iMessage to the TRUSTED device you nominate for that message. You have to pick one device as trusted when you set up 2FA, and you can then use THAT trusted device to authorise other trusted devices. Not all of your devices need to be trusted.
It is just as secure as external authentication tokens IF:
- you are sending the one time code to iOS devices, AND
- you haven't jail broken those devices, AND
- you are using iMessage to send the code
If you send the code as an SMS, you are increasing your risk.
I generate 32+ character passwords as answers to any security question. The first time I have to provide one of those to a phone support tech they will hate me
How do you remember them?I generate 32+ character passwords as answers to any security question. The first time I have to provide one of those to a phone support tech they will hate me
It would help, but 1) is people don't use password managers, and 2) they would use same password.
eg... why would u use a password manager to store the same in-sceure password for all sites ? Apart from syncing, u already know it, thus no reason for one. I'd be blaming the password manager itself for lack of security. A good password managers forces the user to have different password on all sites... No exceptions to this rule. And any 2 passwords the same is not ok.
But to remember passwords gets the better of all of us at one stage. All of this can be avoided.
I generate 32+ character passwords as answers to any security question. The first time I have to provide one of those to a phone support tech they will hate me
Well... I for one would even call 'knowing' security answers in-secure...
May be a second line of defense for forgetting stuff, but for me, there is never a second line .... If there is, there there also is for others too who get access to your account...
Only 1 way in, and one way out
That's how i play my game..
Last edited:
Doesn't help against this ransom scam, since you can access "find my iphone" on icloud.com without entering a security code (Apple probably did this in case you lose your only trusted device, which would make it impossible to receive a security code).