Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Lost access to my Apple account even though I have the password

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 31 posts

Re: Tell HN: Lost access to my Apple account even though I have the password

#21

Post by ChadNauseam »

Tagbert wrote: post #17
shyn3 wrote: post #15

Earlier quoted context omitted.

Just don't put random characters as the answer.

True. That makes it very hard when you have to recite it back to a customer service person. Best just to use arbitrary, real words and then store the questions and answers in your password manager.

Once I was on the phone with Blizzard support, and they asked me to verify the answer to one of my security questions. I said “oh, it’s probably just a bunch of random letters” and she said “uh, yeah, it is actually” and let me into my account. So be aware of that as an attack vector too

Re: Tell HN: Lost access to my Apple account even though I have the password

#22

Post by nullfield »

mixmastamyk wrote: post #12

Similar happened to me the other day with Google. Tried to log in for the first time in a few years. Browser has correct login name and password. Upon login, they demand a phone number to text a code to. Aren't getting it. That was rather disturbing, and then to pour some salt on the wound, they sent an email to my inbox with the text, "someone has tried to login with your password!" Thanks. :-/

I’m really tired of “your valid credentials aren’t good enough, comrade. Please come with us to print your extra papers!”

Re: Tell HN: Lost access to my Apple account even though I have the password

#23

Post by kadoban »

olliej wrote: post #19

How else do you think 2FA is meant to work? If you could simply bypass it that defeats the point of 2FA. The question should really be why you would put random gibberish in for your 2FA answers: at the very least they should be systematic responses.

Secret questions are _barely_ 2fa or not 2fa at all, depending on the implementation, they're just about the worst idea in security.

They're either public info, arbitrary, or some combination of the two.

If you answer them honestly you're very vulnerable to account takeover. Many places treat them as a strict override of the password instead of something additional to a password.

The only sensible way to treat them, as a user, is as backup passwords, which ends up making quite little sense.

Re: Tell HN: Lost access to my Apple account even though I have the password

#24

Post by edp »

olliej wrote: post #19

How else do you think 2FA is meant to work? If you could simply bypass it that defeats the point of 2FA. The question should really be why you would put random gibberish in for your 2FA answers: at the very least they should be systematic responses.

But I never set up 2FA on my Apple account, security questions were meant to be used as an account recovery procedure if you lost access to your account email. THEY set it up as 2FA and as a result I can't log in. I have accounts on numerous website and this is the first time I'm completeoy lockout. I would gladly send my ID card to Apple but apparently this is not an option.

Re: Tell HN: Lost access to my Apple account even though I have the password

#25

Post by edp »

rantallion wrote: post #9

> How is this acceptable ? Of course, the support told me that my data is secure ... so secure I cannot access it ! Well, this is kind of the point. You may or may not remember that mere weeks before Apple rather forcefully encouraged people to set up 2FA, numerous female celebrities had their accounts breached and rather personal images leaked to the world. When you were prompted to set up 2FA, you were given warnin…

As the sibling comment is saying, I never set up 2FA on my account. When I do, I'm using totp and store backup codes. Apple decided to force 2FA and use security questions as the second factor on my behalf.

On top of this, many companies provide customer support to reset 2FA with an other way to verify who you are.

Re: Tell HN: Lost access to my Apple account even though I have the password

#26

Post by musicale »

matvp wrote: post #2

Give their chat another try. I went through the same a while back and they reset my password.

I believe this is the right answer. They can usually fix it over the phone.

Apple's primary technical support issue is people who are locked out of their Apple ID/iCloud/iTunes/etc. accounts for various reasons. It's tricky because another big issue is scammers trying to steal or break into other people's accounts.

It's also why Apple veers away from privacy by encouraging key escrow for iCloud - otherwise users will lock themselves out with no recourse.

In this case it sounds like it is Apple's fault and they should be able to fix it.

If you still own an Apple device (presumably you do if you care about the App Store) usually it can be registered (Apple may have to do this if you can't) and used for 2FA.

Since you own the payment method for your purchases, that should help as well.

Re: Tell HN: Lost access to my Apple account even though I have the password

#27

Post by matvp »

olliej wrote: post #20
matvp wrote: post #11

Earlier quoted context omitted.

The person I was chatting with triggered the password reset mail, and stripped my security questions. As said, I was in exactly the same situation and probably entered random answers to their security questions years ago. When I went through the password reset they set up, I no longer had to enter those security questions. Point is, they're able to remove the additional step of providing answers to the security quest…

what is with people giving random answers for security questions? I understand not providing "true" answers, but random gibberish you have no hope of recalling? why on earth would you ever do that?

They were valid years ago when I was a kid but god knows what my favorite food was 10 years ago.

Re: Tell HN: Lost access to my Apple account even though I have the password

#28

Post by musicale »

mixmastamyk wrote: post #12

Similar happened to me the other day with Google. Tried to log in for the first time in a few years. Browser has correct login name and password. Upon login, they demand a phone number to text a code to. Aren't getting it. That was rather disturbing, and then to pour some salt on the wound, they sent an email to my inbox with the text, "someone has tried to login with your password!" Thanks. :-/

Yeah I hate that Google (and others) all demand a mobile number so they can a) send you text spam and b) use it as a unique customer identifier to match you with their advertising and business partners.

Re: Tell HN: Lost access to my Apple account even though I have the password

#29

Post by LilBytes »

shyn3 wrote: post #15
LilBytes wrote: post #14

Earlier quoted context omitted.

My secret questions have nonsensical answers but are all unique per app/website which are recorded. Makes social engineering nearly impossible.

Just don't put random characters as the answer.

Yep, they're all similar to correct horse battery staple or "toilets excite pregnant cabbages".

Re: Tell HN: Lost access to my Apple account even though I have the password

#30

Post by olliej »

matvp wrote: post #27
olliej wrote: post #20

Earlier quoted context omitted.

what is with people giving random answers for security questions? I understand not providing "true" answers, but random gibberish you have no hope of recalling? why on earth would you ever do that?

They were valid years ago when I was a kid but god knows what my favorite food was 10 years ago.

ah, ok that makes more sense :D
Post reply on HN