Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thieves took their iPhones. Apple won't give their digital lives back

washingtonpost.com

Post reply on HN
Print view View original

21–30 of 117 posts

Re: Thieves took their iPhones. Apple won't give their digital lives back

#21

Post by IlikeKitties »

wmf wrote: post #11
crazygringo wrote: post #9

I'm curious why Apple has let it get this far that court cases are underway and WaPo is writing an article about it. What's in it for Apple? Surely it's easy enough to define some kind of verification process based on various pieces -- phone number, credit card, purchase receipt, etc. -- and requiring a police report to be filed or something. And this isn't like Google or Facebook where accounts are free, preventing…

If Apple can unlock the account from your stolen iPhone they can also unlock your account for the gestapo. Whether it's worth throwing normal people under the bus to protect a few dissidents is a matter of values on which people are going to have differing opinions of course.

This irks me A LOT and is simplified to the point of being incorrect, yet lots of people here make the same logical errors.

Protecting the contents of peoples devices and accounts with strong encryption and hardware security is great for the individual and protects them from thieves and governments alike. If Apple designed their devices so that they cannot unencrypt the content without the users secret passsword, that's sensible for a lot of users.

But E-Mail Addresses and Accounts are derivatives of your identity and companies should have ways of returning your accounts to you, even if the content is lost, in case of stolen identities.

I am pretty paranoid about this stuff and only store private data using encryption and on trusted devices running mostly hardened FOSS software (Graphene OS, Fedora Secure Blue, OpenSuse MicroOS, etc.) and my backups are rcloned encrypted to the cloud. Yet for my most important e-mail that is bound to paypal, banking, shopping etc. I use posteo. They do this exactly right. I have personally tested contacting their support to return access to the e-mail address in case of a "lost password". After some validation, they returned access for it to me, but the encrypted content was unrecoverable. That is exactly what any responsible company should do.

Re: Thieves took their iPhones. Apple won't give their digital lives back

#22

Post by SR2Z »

Forgeties79 wrote: post #13
wmf wrote: post #11

Earlier quoted context omitted.

If Apple can unlock the account from your stolen iPhone they can also unlock your account for the gestapo. Whether it's worth throwing normal people under the bus to protect a few dissidents is a matter of values on which people are going to have differing opinions of course.

>to protect a few dissidents Your opinion seems to be to trivialize how important this can be, which fine you do you, but I think saying it only protects "a few dissidents" is a bit ridiculous. Every protest I've filmed at I hit the lock button 5 times so it forces a passcode. I feel secure knowing the police can't just take it and start scrolling - they need a warrant or they're bust. You don't have to be a dissiden…

I think the point here is that either Apple has the technical ability to access your account (in which case they will be forced to do it by the government regardless) or they don't (in which case this lawsuit is ridiculous).

The middle ground option where Apple has the ability to do this but is also somehow able to take a stand against the government is kind of difficult to support, because it doesn't make much sense.

Re: Thieves took their iPhones. Apple won't give their digital lives back

#23

Post by JKCalhoun »

alabastervlog wrote: post #10

It took me a minute to figure out how this works, but it must have something to do with using a "lost password" email reset on the iCloud account, and having the relevant email account logged in (or saved to the password manager) on the phone itself, so that all you need is the passcode to get into the iCloud account. Something like that?

I still can't figure it out.

My daughter had her iPhone stolen in L.A. — she immediately wiped it remotely. The thieves were unable to access it.

I got her a new iPhone pretty fast (the budget one) and she was back in business, back in her iCloud account. (She was one of those that saw her device head to Asia. She got a handful of text messages pleading with her to remove the stolen device from her account but she ignored them.)

Re: Thieves took their iPhones. Apple won't give their digital lives back

#24

Post by popalchemist »

crazygringo wrote: post #9

I'm curious why Apple has let it get this far that court cases are underway and WaPo is writing an article about it. What's in it for Apple? Surely it's easy enough to define some kind of verification process based on various pieces -- phone number, credit card, purchase receipt, etc. -- and requiring a police report to be filed or something. And this isn't like Google or Facebook where accounts are free, preventing…

My gut tells me that they don't want to either set the precedent or let it be known that they can access your data and give/revoke access remotely, because it pokes a hole in their E2E encryption claims and opens the door to demands for backdoor access from governments.

Re: Thieves took their iPhones. Apple won't give their digital lives back

#25

Post by throwaway48476 »

popalchemist wrote: post #24
crazygringo wrote: post #9

I'm curious why Apple has let it get this far that court cases are underway and WaPo is writing an article about it. What's in it for Apple? Surely it's easy enough to define some kind of verification process based on various pieces -- phone number, credit card, purchase receipt, etc. -- and requiring a police report to be filed or something. And this isn't like Google or Facebook where accounts are free, preventing…

My gut tells me that they don't want to either set the precedent or let it be known that they can access your data and give/revoke access remotely, because it pokes a hole in their E2E encryption claims and opens the door to demands for backdoor access from governments.

In this case it wasn't E2E encrypted in the first place.

Re: Thieves took their iPhones. Apple won't give their digital lives back

#26

Post by throwaway48476 »

IlikeKitties wrote: post #21
wmf wrote: post #11

Earlier quoted context omitted.

If Apple can unlock the account from your stolen iPhone they can also unlock your account for the gestapo. Whether it's worth throwing normal people under the bus to protect a few dissidents is a matter of values on which people are going to have differing opinions of course.

This irks me A LOT and is simplified to the point of being incorrect, yet lots of people here make the same logical errors. Protecting the contents of peoples devices and accounts with strong encryption and hardware security is great for the individual and protects them from thieves and governments alike. If Apple designed their devices so that they cannot unencrypt the content without the users secret passsword, tha…

The people suing didn't turn on E2E encryption. The government could already get access to their data via subpoena. Apple already has access to their data as well. Apple just doesn't want to be forced into doing basic customer service.

Re: Thieves took their iPhones. Apple won't give their digital lives back

#27

Post by tonyedgecombe »

alabastervlog wrote: post #10

It took me a minute to figure out how this works, but it must have something to do with using a "lost password" email reset on the iCloud account, and having the relevant email account logged in (or saved to the password manager) on the phone itself, so that all you need is the passcode to get into the iCloud account. Something like that?

Presumably they will need mail notifications enabled on the Lock Screen as well.

Re: Thieves took their iPhones. Apple won't give their digital lives back

#28

Post by crazygringo »

alabastervlog wrote: post #10

It took me a minute to figure out how this works, but it must have something to do with using a "lost password" email reset on the iCloud account, and having the relevant email account logged in (or saved to the password manager) on the phone itself, so that all you need is the passcode to get into the iCloud account. Something like that?

Yup, I'm guessing that's it:

https://support.apple.com/en-us/102656

This article seems to make it pretty clear that having a passcode on a signed-in device is enough to reset the password.

Re: Thieves took their iPhones. Apple won't give their digital lives back

#29

Post by alabastervlog »

JKCalhoun wrote: post #23
alabastervlog wrote: post #10

It took me a minute to figure out how this works, but it must have something to do with using a "lost password" email reset on the iCloud account, and having the relevant email account logged in (or saved to the password manager) on the phone itself, so that all you need is the passcode to get into the iCloud account. Something like that?

I still can't figure it out. My daughter had her iPhone stolen in L.A. — she immediately wiped it remotely. The thieves were unable to access it. I got her a new iPhone pretty fast (the budget one) and she was back in business, back in her iCloud account. (She was one of those that saw her device head to Asia. She got a handful of text messages pleading with her to remove the stolen device from her account but she ig…

Yeah, that's why I'm having to think at it some to figure out what's going on here. Usually I need my iCloud password to do anything related to that account, so I guess they're using some kind of iCloud password reset bypass that relies on the phone having access to necessary reset-related accounts (like email—though, IDK, I don't think I've ever tried to "lost password" reset my iCloud account, so I'm not sure if even that's enough)

Re: Thieves took their iPhones. Apple won't give their digital lives back

#30

Post by mingus88 »

tacker2000 wrote: post #14

Why should Apple open this can of worms and give users access to locked out data. How would this process even work on a larger scale? In the end if you dont backup your data locally, then its not your data and you risk losing it. If your business shuts down because you lost your phone its your own fault for not mitigating this type of risk enough.

Have you ever tried to fully backup data from iCloud?

I try to do it every month because I am that type of techie. They don’t make it easy.

For photos, i have a 2TB family plan. There is no export functionality I can centrally backup my families photos and shared albums

The supported way to do this is to use a Mac, force it to store all images locally in settings, then highlight all your albums and File->export

This takes hours. I need to stay connected to my network drive because I don’t have 4TB of local storage on my laptop. If there is a failure it’s game over. You can’t resume or even know what failed. There is a tiny progress bar icon to work with. That’s all

iCloud Drive? Same thing. You need to force it to sync all your files, and there is no way to know if it’s hung or what. You can’t do this as family account owner for everyone.

What about all that app data that is saved to iCloud? I don’t even know how to access that to back it up.

Apple makes many things very easy and other things practically impossible.

Backing up your entire iCloud data for disaster recovery is one of those things that’s basically impossible.

Post reply on HN