11–20 of 74 posts
Finally. For current iOS versions, there is a workaround: use the “screentime” feature to disallow pincode changes. In screentime you can set a different code, so when anyone else can access your phone, they can’t change the code and lock you out of your phone.
If you get the screen time password wrong a few times it will let you put the device passcode in.
This is basically a branding and broader application of the existing Keychain access control presence requirement, whose documentation specifically calls out these scenarios. All finance apps should be using presence verification post login and preceding an outgoing transaction or possible takeover action.
It forces an hour delay for people using the device passcode to reset the Apple ID password EXCEPT if its in a known location like home (also blocks changing the device passcode and turning off FindMy), and forces FaceID for these, even if the phone has been forced to forget the FaceID keys and require the device passcode.
And it requires FaceID without a passcode ID fallback for certain categories of authentication.
It's a welcome change, especially the time-lock is something that I always thought about. SMS and EMail as 2FA are dead when someone can unlock your phone. Still though, why don't iPhone owners use face unlock? Is it not good?
This is basically a branding and broader application of the existing Keychain access control presence requirement, whose documentation specifically calls out these scenarios. All finance apps should be using presence verification post login and preceding an outgoing transaction or possible takeover action.
No, it's way more than that. It forces an hour delay for people using the device passcode to reset the Apple ID password EXCEPT if its in a known location like home (also blocks changing the device passcode and turning off FindMy), and forces FaceID for these, even if the phone has been forced to forget the FaceID keys and require the device passcode. And it requires FaceID without a passcode ID fallback for certain…
Judging by how often finger print readers get false negatives, this seems like an incredibly bad and frustrating idea.
Earlier quoted context omitted.
No, it's way more than that. It forces an hour delay for people using the device passcode to reset the Apple ID password EXCEPT if its in a known location like home (also blocks changing the device passcode and turning off FindMy), and forces FaceID for these, even if the phone has been forced to forget the FaceID keys and require the device passcode. And it requires FaceID without a passcode ID fallback for certain…
> And it requires FaceID without a passcode ID fallback for certain categories of authentication. Judging by how often finger print readers get false negatives, this seems like an incredibly bad and frustrating idea.
My phone was snatched from my hands in the street. I was able to wipe it via 'Find Devices' within a few minutes; I was able to track its location for the rest of the day, until I requested that my carrier irrevocably disable its network service. There was no evidence of any accesses of my information or accounts linked on the phone, then or since.
In the following days, it was still visible in my Apple device lists as mine, with reference information like its model and serial number – as it should have remained, indefinitely, to prevent anyone else from associating it with their accounts. (Until recently, I still had an iPhone 4 listed there that hasn't been turned on for many years.)
But sometime since then, it was removed from my Apple account – without my permission, and with no notification to me. This step would also apparently allow someone else to use the device with Apple services.
Apple Support insists only a person who authenticated to them as me could have done that, and that they have no records of when/how that happened – a policy that seems designed to help criminals cover their tracks, with no help to customers other than: "you should change your password".
Further, even if I provide the serial-number/IMEI with a police report, Apple says they can't determine if they've activated Apple services to that stolen property for someone else or provide me with any further help.
I thus suspect theft networks have figured a way around Apple's breezy assurances about locking-out stolen devices, perhaps similar to how they've often deeply pierced major telecom providers in order to carry out SIM-swap attacks.
But: if anyone on HN knows more about how the smartphone theft/fencing (chop shop?) operations typically work, or how Apple's systems do or don't protect against post-theft hijacking of registered Apple devices, I'd love to hear perspectives that either flesh-out, or refute, my impressions that Apple's related systems involve some false bluster & "security theater".
After a iPhone theft in Europe earlier this year, I don't quite trust Apple's assurances with regard to stolen iPhones. My phone was snatched from my hands in the street. I was able to wipe it via 'Find Devices' within a few minutes; I was able to track its location for the rest of the day, until I requested that my carrier irrevocably disable its network service. There was no evidence of any accesses of my informati…
After a iPhone theft in Europe earlier this year, I don't quite trust Apple's assurances with regard to stolen iPhones. My phone was snatched from my hands in the street. I was able to wipe it via 'Find Devices' within a few minutes; I was able to track its location for the rest of the day, until I requested that my carrier irrevocably disable its network service. There was no evidence of any accesses of my informati…
Also sounds like something doable by compromised Apple insiders. :/
After a iPhone theft in Europe earlier this year, I don't quite trust Apple's assurances with regard to stolen iPhones. My phone was snatched from my hands in the street. I was able to wipe it via 'Find Devices' within a few minutes; I was able to track its location for the rest of the day, until I requested that my carrier irrevocably disable its network service. There was no evidence of any accesses of my informati…
After a iPhone theft in Europe earlier this year, I don't quite trust Apple's assurances with regard to stolen iPhones. My phone was snatched from my hands in the street. I was able to wipe it via 'Find Devices' within a few minutes; I was able to track its location for the rest of the day, until I requested that my carrier irrevocably disable its network service. There was no evidence of any accesses of my informati…
The key thing is to protect your data first and that means wiping it remotely. Leave it attached to your iCloud account device list though because that'll leave the provisioning / device lock in place. I'm sure they have a way around that now but it'll make it more difficult and devalue it for the thief at least.