Live data from Hacker News

Apple users are being locked out of their Apple IDs with no explanation

9to5mac.com

201–210 of 548 posts

Re: Apple users are being locked out of their Apple IDs with no explanation

#201
post #95
post #70

As a tip: use your AppleID to generate a secondary email that you use for your day to day email, while keeping the login email secret. The problem stems from nefarious groups getting a hold of email addresses and running distributed dictionary attacks. Apple’s response is to prevent all logins (including valid ones) from accounts that are under attack. Unlocking the account involves calling Apple, they’re not going t…

i also did this: created an email address that i use exclusively on apple. it actually wasn’t hard at all. zero issues since. > The problem stems from nefarious groups getting a hold of email addresses and running distributed dictionary attacks. years back my email was leaked by a website that i never visited. apparently someone signed up using my email address and the website never verified the email. in the meantim…

Another tip is to run a custom domain for email that just serves to redirect mail to your real email address. It's is a handy way of keeping track of how and who has leaked your information.

For example I give custom email addresses to every service I sign up for, then I can see who they on-sold that information to, or if the email address turns up in database hack.

The only thing to be mindful about with this approach is to choose a service that gives you a fair bit of control over how to manage that incoming email. Such as being able to bounce or block specific email addresses including the use of wildcards, because I notice some hacking groups will try permutations based on the original email address.

Re: Apple users are being locked out of their Apple IDs with no explanation

#202
post #110

Earlier quoted context omitted.

The effort is actually minimal. Just export the passwords occasionally and save it in an encrypted file. 30 seconds The issue is rather, that most people rely on these convenient services 100% and dont (want to) think about what happens in a bad case scenario.

“Save in an encrypted file”? Christ. We really need to draw a HUGE line between “hacker news user solutions” and “things that are practical for actual people to do”.

Most people have a file encryption program of some kind on their computers. WinRAR, 7-Zip, some versions of Microsoft Windows (note: not supported in Windows 10 Home), Microsoft Word…

Re: Apple users are being locked out of their Apple IDs with no explanation

#203
post #47

To this day, I still get random "Enter your password to continue using iCloud" push notifications on my iPhone with no relevant action to trigger such a notification. My Apple ID uses a unique password, I keep a recovery key, I don't have its login credentials saved anywhere, and it's a dev account; so I have my LLC's DUNS number attached to it. My devices are the only ones listed in my settings portal. I have no ide…

Perhaps you are connecting from a VPN or endpoint that known bad actors have also used in previous attacks (university network, guest network).

Or a device on your network is or was compromised and used as a channel to attack others on the internet.

Or your ISP has given you a public address where the last owner was abusing it.. or perhaps the whole ISP block has been added to a shitlist.

Re: Apple users are being locked out of their Apple IDs with no explanation

#204
post #188

Earlier quoted context omitted.

I bought an iPhone a couple of days ago, and was planning on using the weekend to finally migrate from my old Android phone. Luckily, I haven't even opened the box so I should be able to return it for a full refund. No way I'm spending over $1000 for this kind of experience.

Black swan events can happen to you. Recently I traveled to a European country from my base (Middle East). I normally take my phone and laptop with me and they are synced. I forgot the laptop charger and could not get one locally not at least for about a week and then dropped my phone and it got damaged. I bought another phone (Adroid) and tried to log in to by google accounts. It recognized the email and the pswd bu…

> My conclusion - have two physical phones + laptop all synced, plus hardcopy of important pswds etc.

And then say, Meta decides to ask for login verification on your other device, and you lose that account because you always logged to it through a browswer in private mode, so no device actually has an active session. Happened to my wife the other day.

IT "Security" is reaching new heights of being bullshit. You can't win, and asking people to buy multiple devices and keep them continuously in sync is a bit much, and not even a guarantee of safety anyway, as next week Google or Amazon will hit you with some next weird trap to keep you "sekhure".

Re: Apple users are being locked out of their Apple IDs with no explanation

#205
post #42

The thing that scared me recently was two updates that gave me new encryption keys. At first I trusted apple and wrote down the new key. But I became suspicious after the second update and checked online. It seems like it's happening to others, so I used the recommended command-line tool to verify my new encryption key and it didn't verify. Apparently it works after disabling and enabling encryption, but I'm just kee…

Sorry, can you give a few more details? Are you talking about FileVault encryption on your Mac? Or the newish iMessage encryption?

And what command line tool are you referencing?

Re: Apple users are being locked out of their Apple IDs with no explanation

#206
post #188

Earlier quoted context omitted.

Black swan events can happen to you. Recently I traveled to a European country from my base (Middle East). I normally take my phone and laptop with me and they are synced. I forgot the laptop charger and could not get one locally not at least for about a week and then dropped my phone and it got damaged. I bought another phone (Adroid) and tried to log in to by google accounts. It recognized the email and the pswd bu…

This is standard Google behavior. Logging into Google on any new device always asks me to confirm it on one of the other devices that are logged in (i.e. phones, tablets). Suppose it's some kind of 2FA.

I understand the security concept of it. Luckily my trip was short. As I also use wechat to communicate with some Chinese friends, my experience was different. First it send me an OTP on the new phone, then asked for two friends to send a number to the phone. Luckily I had the phone number of one and I managed to restore and to be honest having humans in the pipeline was a plus. Negative this had to be done over 5 minutes otherwise you back to square one.

Re: Apple users are being locked out of their Apple IDs with no explanation

#207
post #188

Earlier quoted context omitted.

I bought an iPhone a couple of days ago, and was planning on using the weekend to finally migrate from my old Android phone. Luckily, I haven't even opened the box so I should be able to return it for a full refund. No way I'm spending over $1000 for this kind of experience.

Black swan events can happen to you. Recently I traveled to a European country from my base (Middle East). I normally take my phone and laptop with me and they are synced. I forgot the laptop charger and could not get one locally not at least for about a week and then dropped my phone and it got damaged. I bought another phone (Adroid) and tried to log in to by google accounts. It recognized the email and the pswd bu…

Don't bind your online identity to Apple or Google or Microsoft, in particular not the email addresses you use for accounts. That at least limits the damage they can do.

Re: Apple users are being locked out of their Apple IDs with no explanation

#208

With risk of being spammy, this is probably the most relevant discussion I've seen so far on HN w.r.t my experience of being locked out from my Apple ID. I hope legislation will force Apple to step up and be more transparent / helpful. https://skogsbrus.xyz/dont-put-all-your-apples-in-one-basket...

I would expand to cover not only Apple, but Google and Microsoft.

You don't have a requirement to have an email account to login to Windows. MS is pushing it hard, (deceptive trend in big software) but the user can still push back.

Re: Apple users are being locked out of their Apple IDs with no explanation

#209
post #162
post #42

The thing that scared me recently was two updates that gave me new encryption keys. At first I trusted apple and wrote down the new key. But I became suspicious after the second update and checked online. It seems like it's happening to others, so I used the recommended command-line tool to verify my new encryption key and it didn't verify. Apparently it works after disabling and enabling encryption, but I'm just kee…

Dumb question but how did you find this out? Do you manually check after every software update?

On the first update when it showed me the message, I trusted it and wrote down the new key and threw the original piece of paper into the trash. Then the second time it showed up, I became suspicious and did a quick google search and then ran the command tool just to confirm that the new backup key validates, but it didn't. My hunch is that it was still using the original key I had set up myself, but I couldn't confirm since I had tossed it.

Re: Apple users are being locked out of their Apple IDs with no explanation

#210
post #42

The thing that scared me recently was two updates that gave me new encryption keys. At first I trusted apple and wrote down the new key. But I became suspicious after the second update and checked online. It seems like it's happening to others, so I used the recommended command-line tool to verify my new encryption key and it didn't verify. Apparently it works after disabling and enabling encryption, but I'm just kee…

> updates that gave me new encryption keys On iOS or macOS? Was a consent dialog presented before the update was installed?

Sorry, macOS, I don't remember about the consent.
Post reply on HN