Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

In which Apple destroys my daughter’s iPad forever

ericasadun.com

Post reply on HN
Print view View original

71–80 of 152 posts

Re: In which Apple destroys my daughter’s iPad forever

#71

Post by gambiting »

falsedan wrote: post #67
matthewmacleod wrote: post #55

Earlier quoted context omitted.

That's really only the case if the owner isn't able to show that they own the device, and hasn't set up a password recovery mechanism to demonstrate they own the account. I do feel bad for them, but it's kind of a confluence of a lot of different mistakes that led to this point.

Don't blame the user for poor product decisions.

I just don't see this as a poor product decision - the mechanism here is extremely simple - if you lock out your device completely, Apple will only ever unlock it for you if you can prove it's yours. How is it different to cars for example? If I lost both of my keys to my car, Mercedes would only produce a duplicate and re-program the ignition if I could prove that the car is indeed mine. I don't want someone to be able to just roll into the dealership and go "hey I just got this car, can you reprogram the ignition for me please thanks".

Re: In which Apple destroys my daughter’s iPad forever

#72

Post by matthewmacleod »

falsedan wrote: post #67
matthewmacleod wrote: post #55

Earlier quoted context omitted.

That's really only the case if the owner isn't able to show that they own the device, and hasn't set up a password recovery mechanism to demonstrate they own the account. I do feel bad for them, but it's kind of a confluence of a lot of different mistakes that led to this point.

Don't blame the user for poor product decisions.

I'm not sure it _is_ a poor product decision though.

There are a large number of hurdles between "I have a functioning device" and "I can no longer use my device". Passcodes, password resets, account ownership claims, device ownership claims. There's an extensive path of steps to follow which allow a legitimate user to regain access.

In this situation we have:

- Someone who has disabled their access, probably through entering the wrong password a few times

- No knowledge of the security details on the linked account

- No access to the email address associated with the account

- No proof of ownership of the device

In other words, from Apple's perspective, the user in question could easily be using a stolen device.

I'm curious though – what's the 'correct' product decision that should have been made here? Is it possible to build a system which is both secure and allows _any_ user to gain access to their device, no matter how many safeguards they have avoided?

Re: In which Apple destroys my daughter’s iPad forever

#73

Post by sgtmas2006 »

nyreed wrote: post #68
sgtmas2006 wrote: post #10

Earlier quoted context omitted.

I wonder if you created a network with an SSID and password that matched the original if it would pick it up and update the date? This is what I did with my TV when I lost the remote, so I could add a phone as a remote.

After reboot, all iDevice SSIDs and passwords are encrypted with the device passcode. This means the iPad can't automatically connect to known networks until the passcode is entered.

Is this true for all versions? If it's a 2nd or 3rd hand-me-down iPad as stated, chances are it's on a lower version.

I forgot that this was even a feature.

Re: In which Apple destroys my daughter’s iPad forever

#74

Post by falsedan »

developer2 wrote: post #50

> She did not do anything to trigger the Apple ID issue. I chalk this up to the child not wanting to admit they entered the wrong passcode too many times. iOS devices "disable" themselves after enough failed attempts. This is a good thing - you want this to happen if your device is stolen. "Disabled" only means you need to prove ownership by either: a) Connecting the iPad (via USB) to iTunes on a Mac or PC that is lo…

> This is a good thing - you want this to happen if your device is stolen

How does the device know it's been stolen? It can't possibly tell the difference between "snatched on the bus and in the black market tech's lab" and "oh lol whups I forgot how to used my fingers".

Provide a "my device was stolen" service for the user to initiate lockouts instead (and report the theft to the relevant authorities with location tracking data) imo.

Re: In which Apple destroys my daughter’s iPad forever

#75

Post by askmike »

nailer wrote: post #61
askmike wrote: post #21

Earlier quoted context omitted.

That tends to happen when a website gets on the HN frontpage. Try refreshing, eventually that worked for me.

You're just hitting the database with more requests. The only reason it'll work is if the site owner fixes something or, if the capacity doesn't change, your additional requests stop other users from accessing the DB. Just use a cached version and stop hammering the site.

I'm not saying to hammer down the refresh button.

And yes there is a very good reason for it too work: in most scenarios the amount of concurrent connections to the DB is at the limit. If you refresh once a minute later you're really not that much of an impact while the PHP instance might get the handle to the database needed to fetch the content. As a matter of fact, it worked for me with this exact article.

Re: In which Apple destroys my daughter’s iPad forever

#76

Post by developer2 »

falsedan wrote: post #74
developer2 wrote: post #50

> She did not do anything to trigger the Apple ID issue. I chalk this up to the child not wanting to admit they entered the wrong passcode too many times. iOS devices "disable" themselves after enough failed attempts. This is a good thing - you want this to happen if your device is stolen. "Disabled" only means you need to prove ownership by either: a) Connecting the iPad (via USB) to iTunes on a Mac or PC that is lo…

> This is a good thing - you want this to happen if your device is stolen How does the device know it's been stolen? It can't possibly tell the difference between "snatched on the bus and in the black market tech's lab" and "oh lol whups I forgot how to used my fingers". Provide a "my device was stolen" service for the user to initiate lockouts instead (and report the theft to the relevant authorities with location t…

Unlocking a disabled device takes 2 minutes - connect it to iTunes. It's a minor inconvenience if you happen to disable your own device. The point is you have to prove ownership by unlocking it using the same Apple ID. This person is unable to log into their Apple ID account, and is unable to perform account recovery because they don't have the answers to the security questions, nor access to the inbox of the email address that would allow for a password reset.

Re: In which Apple destroys my daughter’s iPad forever

#77

Post by csomar »

cannam wrote: post #22

Oh, this is a painful topic. A couple of years ago my son forgot the (3-digit!) PIN for his iPod touch. He tried various possibilities, with the device responding with increasingly long lockouts between attempts, until it locked him out permanently. I'm not an iOS user and I had no idea it would do that. I am still angry that it did. It wasn't associated with a Mac, so we couldn't unlock it that way. He eventually sh…

Then you don’t understand why this feature exists. The 3 digit pin will get hacked given enough time. The erase was to garantuee that your data is safe.

Re: In which Apple destroys my daughter’s iPad forever

#78

Post by nailer »

askmike wrote: post #75
nailer wrote: post #61

Earlier quoted context omitted.

You're just hitting the database with more requests. The only reason it'll work is if the site owner fixes something or, if the capacity doesn't change, your additional requests stop other users from accessing the DB. Just use a cached version and stop hammering the site.

I'm not saying to hammer down the refresh button. And yes there is a very good reason for it too work: in most scenarios the amount of concurrent connections to the DB is at the limit. If you refresh once a minute later you're really not that much of an impact while the PHP instance might get the handle to the database needed to fetch the content. As a matter of fact, it worked for me with this exact article.

> Try refreshing, eventually that worked

> I'm not saying to hammer down the refresh button.

OK.

> If you refresh once a minute later you're really not that much of an impact

If every user does this, the site now has 2x the amount of incoming requests.

Re: In which Apple destroys my daughter’s iPad forever

#79

Post by [deleted] »

cannam wrote: post #22

Oh, this is a painful topic. A couple of years ago my son forgot the (3-digit!) PIN for his iPod touch. He tried various possibilities, with the device responding with increasingly long lockouts between attempts, until it locked him out permanently. I'm not an iOS user and I had no idea it would do that. I am still angry that it did. It wasn't associated with a Mac, so we couldn't unlock it that way. He eventually sh…

[deleted]

Re: In which Apple destroys my daughter’s iPad forever

#80

Post by Gupie »

matthewmacleod wrote: post #72
falsedan wrote: post #67

Earlier quoted context omitted.

Don't blame the user for poor product decisions.

I'm not sure it _is_ a poor product decision though. There are a large number of hurdles between "I have a functioning device" and "I can no longer use my device". Passcodes, password resets, account ownership claims, device ownership claims. There's an extensive path of steps to follow which allow a legitimate user to regain access. In this situation we have: - Someone who has disabled their access, probably through…

Couldn't Apple make it be standard to provide a name and address when buying such a product? You could then for example take ti to your local apple store with some ID to get it unlocked.
Post reply on HN