Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's new iPhone security setting keeps thieves out of your digital accounts

theverge.com

Post reply on HN
Print view View original

21–30 of 74 posts

Re: Apple's new iPhone security setting keeps thieves out of your digital accounts

#21

Post by KolmogorovComp »

diffeomorphism wrote: post #14
blokey wrote: post #12

Earlier quoted context omitted.

No, it's way more than that. It forces an hour delay for people using the device passcode to reset the Apple ID password EXCEPT if its in a known location like home (also blocks changing the device passcode and turning off FindMy), and forces FaceID for these, even if the phone has been forced to forget the FaceID keys and require the device passcode. And it requires FaceID without a passcode ID fallback for certain…

> And it requires FaceID without a passcode ID fallback for certain categories of authentication. Judging by how often finger print readers get false negatives, this seems like an incredibly bad and frustrating idea.

That's why I always enlist at least a few of my fingers, even though I'm effectively always using the same on a day-to-day basis.

Re: Apple's new iPhone security setting keeps thieves out of your digital accounts

#22

Post by meindnoch »

gojomo wrote: post #16

After a iPhone theft in Europe earlier this year, I don't quite trust Apple's assurances with regard to stolen iPhones. My phone was snatched from my hands in the street. I was able to wipe it via 'Find Devices' within a few minutes; I was able to track its location for the rest of the day, until I requested that my carrier irrevocably disable its network service. There was no evidence of any accesses of my informati…

According to my friend at Apple, sometimes fairly low level employees have access to the internal system which can be used to dissociate devices from AppleIDs. I wouldn't be surprised if some of them were compromised, as the pay is not great.

What's more surprising is if they have no audit logs that would let them discover the compromised employee in these cases.

Re: Apple's new iPhone security setting keeps thieves out of your digital accounts

#23

Post by miki123211 »

What I really wish apple had is the ability to have multiple passcodes with different behavior.

Something like one passcode for ordinary phone use, one that would immediately and covertly send an emergency text to your family with your current location, one that would instantly wipe the device and one that would give you access to the hidden gay dating app you don't want people to know about.

Re: Apple's new iPhone security setting keeps thieves out of your digital accounts

#25

Post by tycho-newman »

miki123211 wrote: post #23

What I really wish apple had is the ability to have multiple passcodes with different behavior. Something like one passcode for ordinary phone use, one that would immediately and covertly send an emergency text to your family with your current location, one that would instantly wipe the device and one that would give you access to the hidden gay dating app you don't want people to know about.

You can do this if you enable screen time for your own phone. At least for unwanted changes.

Re: Apple's new iPhone security setting keeps thieves out of your digital accounts

#26

Post by Zapped »

gojomo wrote: post #16

After a iPhone theft in Europe earlier this year, I don't quite trust Apple's assurances with regard to stolen iPhones. My phone was snatched from my hands in the street. I was able to wipe it via 'Find Devices' within a few minutes; I was able to track its location for the rest of the day, until I requested that my carrier irrevocably disable its network service. There was no evidence of any accesses of my informati…

Well I kind of did circumvent this hurdle.

I got an iPhone from a relative, the relative had forgotten the passcode and the Apple ID password.

I did a factory reset of it via iTunes and of course when it started up and I started with the setup it said it was locked to *@*.com.

I contacted Apple support and they said I needed proof of purchase for them to unlock it.

I did not have any proof of purchase and neither did my relative.

But I refused to let that stop me. So I made a proof of purchase, printed it and went to an Apple store.

I told the Apple Genius about the iPhone and that it was locked but factory reset and presented the "proof of purchase".

The Apple Genius went to get a manager or something and the manager checked the "proof of purchase" and then connected the iPhone to the store Wi-Fi and did some stuff on their iPad and rebooted the iPhone. The iPhone did a reset and then it was unlocked and ready to be setup without any hurdles.

So I am guessing some thieves have figured this out.

Re: Apple's new iPhone security setting keeps thieves out of your digital accounts

#27

Post by hellrope »

ro_bit wrote: post #2

Related article and thread from Feb: https://www.wsj.com/articles/apple-iphone-security-theft-pas... https://news.ycombinator.com/item?id=34936015 Now it seems like thieves would not be able to immediately unlink a phone from Find My if they have the passcode, because of the security delay

Wow, that seems scary

Re: Apple's new iPhone security setting keeps thieves out of your digital accounts

#28

Post by jsjohnst »

diffeomorphism wrote: post #14
blokey wrote: post #12

Earlier quoted context omitted.

No, it's way more than that. It forces an hour delay for people using the device passcode to reset the Apple ID password EXCEPT if its in a known location like home (also blocks changing the device passcode and turning off FindMy), and forces FaceID for these, even if the phone has been forced to forget the FaceID keys and require the device passcode. And it requires FaceID without a passcode ID fallback for certain…

> And it requires FaceID without a passcode ID fallback for certain categories of authentication. Judging by how often finger print readers get false negatives, this seems like an incredibly bad and frustrating idea.

Good thing Apple hasn’t used TouchID on phones in a long time then?

Re: Apple's new iPhone security setting keeps thieves out of your digital accounts

#29

Post by nerdjon »

I always found it odd that sensitive apps like Banking I could just fall back to the same pin I use on my phone... that seems a bit wrong?

Like ok I get it, there should be a fall back to biometrics not working for whatever reason. But for getting into your phone, but for apps that use biometrics since generally those have their own fall back of just using your password to login.

Unless I am missing it, I don't see this being a change here? I hope that is coming if not.

Re: Apple's new iPhone security setting keeps thieves out of your digital accounts

#30

Post by brookst »

Zapped wrote: post #26
gojomo wrote: post #16

After a iPhone theft in Europe earlier this year, I don't quite trust Apple's assurances with regard to stolen iPhones. My phone was snatched from my hands in the street. I was able to wipe it via 'Find Devices' within a few minutes; I was able to track its location for the rest of the day, until I requested that my carrier irrevocably disable its network service. There was no evidence of any accesses of my informati…

Well I kind of did circumvent this hurdle. I got an iPhone from a relative, the relative had forgotten the passcode and the Apple ID password. I did a factory reset of it via iTunes and of course when it started up and I started with the setup it said it was locked to * @* .com. I contacted Apple support and they said I needed proof of purchase for them to unlock it. I did not have any proof of purchase and neither d…

Makes sense. No theft deterrence is perfect, and your solution required a lot of investment of time and would not scale to a substantially large theft ring.
Post reply on HN