Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thieves took their iPhones. Apple won't give their digital lives back

washingtonpost.com

Post reply on HN
Print view View original

51–60 of 117 posts

Re: Thieves took their iPhones. Apple won't give their digital lives back

#51

Post by Mystery-Machine »

JKCalhoun wrote: post #23
alabastervlog wrote: post #10

It took me a minute to figure out how this works, but it must have something to do with using a "lost password" email reset on the iCloud account, and having the relevant email account logged in (or saved to the password manager) on the phone itself, so that all you need is the passcode to get into the iCloud account. Something like that?

I still can't figure it out. My daughter had her iPhone stolen in L.A. — she immediately wiped it remotely. The thieves were unable to access it. I got her a new iPhone pretty fast (the budget one) and she was back in business, back in her iCloud account. (She was one of those that saw her device head to Asia. She got a handful of text messages pleading with her to remove the stolen device from her account but she ig…

> she immediately wiped it remotely > She was one of those that saw her device head to Asia

What, the guy just jumped into the Pacific and started swimming?

Re: Thieves took their iPhones. Apple won't give their digital lives back

#52

Post by voidspark »

JCattheATM wrote: post #20

Not exactly helpful, but I have little sympathy for people who put their digital lives in the control of a free service from a company, that, frankly, doesn't care about you at all - 'consumers are the product', etc etc.

It's not a free service. One of them had a 2TB+ iCloud account. That has a monthly cost. Not free. The free plan only gives you 5GB storage. Apple is not an advertising company. We pay for the phone and we pay for iCloud.

Re: Thieves took their iPhones. Apple won't give their digital lives back

#53

Post by duskwuff »

crazygringo wrote: post #9

I'm curious why Apple has let it get this far that court cases are underway and WaPo is writing an article about it. What's in it for Apple? Surely it's easy enough to define some kind of verification process based on various pieces -- phone number, credit card, purchase receipt, etc. -- and requiring a police report to be filed or something. And this isn't like Google or Facebook where accounts are free, preventing…

> Surely it's easy enough to define some kind of verification process based on various pieces -- phone number, credit card, purchase receipt, etc. -- and requiring a police report to be filed or something.

Apple has such a process in place: https://support.apple.com/en-us/118574 (The details aren't all laid out on that web page, but Apple support may ask for information like purchase records to confirm ownership.)

What I think is at issue here is that it will only restore access to an account which is not currently being accessed. If an account is being accessed from a logged-in device, Apple is unwilling to cut off the current user's access to that account and hand it over to another party.

And, quite honestly, I can see where Apple is coming from with this policy. Arbitrating access to a contested account can get really messy (e.g. consider a scenario where an abusive partner is trying to access the victim's online accounts).

Re: Thieves took their iPhones. Apple won't give their digital lives back

#54

Post by oarsinsync »

Hizonner wrote: post #7
throwaway48476 wrote: post #6

Earlier quoted context omitted.

A security model that the user does not understand and contains traps is not a good security model.

OK, but what model would you suggest? Apple has no adequate way to actually verify who anybody is without (a) forcing them to physically visit one of a small number of offices (it can't be every store), and (b) probably charging a significant fee to cover the cost of doing real verification. And even that demands assuming that the identifying information on the account is right.

> Apple has no adequate way to actually verify who anybody is without (a) forcing them to physically visit one of a small number of offices (it can't be every store), and (b) probably charging a significant fee to cover the cost of doing real verification.

My bank is able to verify me remotely to login to their app from a new device in under 15 minutes, just with a photo of my ID card and a video of my face. And the bank is liable for any losses caused if they misidentify me.

Why can my bank do it but apple cant?

Re: Thieves took their iPhones. Apple won't give their digital lives back

#55

Post by JumpCrisscross »

crazygringo wrote: post #9

I'm curious why Apple has let it get this far that court cases are underway and WaPo is writing an article about it. What's in it for Apple? Surely it's easy enough to define some kind of verification process based on various pieces -- phone number, credit card, purchase receipt, etc. -- and requiring a police report to be filed or something. And this isn't like Google or Facebook where accounts are free, preventing…

> Surely it's easy enough to define some kind of verification process based on various pieces -- phone number, credit card, purchase receipt, etc. -- and requiring a police report to be filed or something

Given the stakes, Cupertino may have decided that it does not wish to arbiter such disputes. Requiring a court order shifts the dispute to that forum.

Re: Thieves took their iPhones. Apple won't give their digital lives back

#56

Post by JumpCrisscross »

crazygringo wrote: post #15
wmf wrote: post #11

Earlier quoted context omitted.

If Apple can unlock the account from your stolen iPhone they can also unlock your account for the gestapo. Whether it's worth throwing normal people under the bus to protect a few dissidents is a matter of values on which people are going to have differing opinions of course.

That doesn't make sense. This isn't a technical hurdle, is it? Apple already can unlock your account "for the gestapo" if they choose to. If the users have enabled Advanced Data Protection and don't have another Apple device, then I can understand why it would be lost for good. But that doesn't seem to be the case in these lawsuits. They make it clear that Apple has access to the data, and could transfer/restore it i…

> Apple already can unlock your account "for the gestapo" if they choose to

But they don't.

Re: Thieves took their iPhones. Apple won't give their digital lives back

#57

Post by justjonathan »

Mystery-Machine wrote: post #51
JKCalhoun wrote: post #23

Earlier quoted context omitted.

I still can't figure it out. My daughter had her iPhone stolen in L.A. — she immediately wiped it remotely. The thieves were unable to access it. I got her a new iPhone pretty fast (the budget one) and she was back in business, back in her iCloud account. (She was one of those that saw her device head to Asia. She got a handful of text messages pleading with her to remove the stolen device from her account but she ig…

> she immediately wiped it remotely > She was one of those that saw her device head to Asia What, the guy just jumped into the Pacific and started swimming?

I believe “She” here refers to the original owner (the victim). Apple offers a feature to remotely wipe your device if lost, and that was what I understood the owner to have done. I’ve done the same thing for a stolen iPhone.

Re: Thieves took their iPhones. Apple won't give their digital lives back

#58

Post by ddtaylor »

voidspark wrote: post #52
JCattheATM wrote: post #20

Not exactly helpful, but I have little sympathy for people who put their digital lives in the control of a free service from a company, that, frankly, doesn't care about you at all - 'consumers are the product', etc etc.

It's not a free service. One of them had a 2TB+ iCloud account. That has a monthly cost. Not free. The free plan only gives you 5GB storage. Apple is not an advertising company. We pay for the phone and we pay for iCloud.

You pay to rent the phone I'm pretty sure.

Re: Thieves took their iPhones. Apple won't give their digital lives back

#59

Post by JumpCrisscross »

oarsinsync wrote: post #54
Hizonner wrote: post #7

Earlier quoted context omitted.

OK, but what model would you suggest? Apple has no adequate way to actually verify who anybody is without (a) forcing them to physically visit one of a small number of offices (it can't be every store), and (b) probably charging a significant fee to cover the cost of doing real verification. And even that demands assuming that the identifying information on the account is right.

> Apple has no adequate way to actually verify who anybody is without (a) forcing them to physically visit one of a small number of offices (it can't be every store), and (b) probably charging a significant fee to cover the cost of doing real verification. My bank is able to verify me remotely to login to their app from a new device in under 15 minutes, just with a photo of my ID card and a video of my face. And the…

> Why can my bank do it but apple cant?

Banks write off tens of billions of dollars of fraud costs a year. They can do this because money is fungible.

Re: Thieves took their iPhones. Apple won't give their digital lives back

#60

Post by XorNot »

lxgr wrote: post #35
nashashmi wrote: post #2

My cousin’s phone was stolen in San Francisco. My mom’s phone was hooked up to the same account. Somehow the thief was able to change the account password and email account to something else. Now my mom cannot reset her phone because she doesn’t have access to the thieves account.

> Somehow the thief was able to change the account password and email account That would be the fact that Apple lets anybody that knows the passcode reset the iCloud password as well, without any further authentication. And the passcode can be shoulder surfed by the thief... "Stolen device protection" was developed as a response to a wave of such thefts: https://support.apple.com/en-us/120340 It seems like a good ste…

Admittedly we in security do a very poor job on equipping users with useful threat models: i.e. the number of times people either don't turn on any sort of security, or turn on extremely aggressive security but don't write down and store a recovery code is too damn high.
Post reply on HN