Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thieves took their iPhones. Apple won't give their digital lives back

washingtonpost.com

Post reply on HN
Print view View original

61–70 of 117 posts

Re: Thieves took their iPhones. Apple won't give their digital lives back

#61

Post by crote »

duskwuff wrote: post #53
crazygringo wrote: post #9

I'm curious why Apple has let it get this far that court cases are underway and WaPo is writing an article about it. What's in it for Apple? Surely it's easy enough to define some kind of verification process based on various pieces -- phone number, credit card, purchase receipt, etc. -- and requiring a police report to be filed or something. And this isn't like Google or Facebook where accounts are free, preventing…

> Surely it's easy enough to define some kind of verification process based on various pieces -- phone number, credit card, purchase receipt, etc. -- and requiring a police report to be filed or something. Apple has such a process in place: https://support.apple.com/en-us/118574 (The details aren't all laid out on that web page, but Apple support may ask for information like purchase records to confirm ownership.) Wh…

I think you're jumping the gun here.

An account is supposed to belong to a single person. If you are able to definitively prove that you are that person (for example, by showing up to an Apple store with your ID card), you should be able to restore access to it. An abusive partner won't have access to that.

Refusing restoration when someone else has access to it is understandable, but it works the other way around as well: an abusive partner would be able to prevent the legitimate owner from accessing the account.

I think it's far more likely that Apple just can't be bothered. Dealing with stuff like this is messy and complicated, and they aren't going to lose any revenue from those few thousand people a year losing their account and all their data.

Re: Thieves took their iPhones. Apple won't give their digital lives back

#62

Post by XorNot »

crazygringo wrote: post #28
alabastervlog wrote: post #10

It took me a minute to figure out how this works, but it must have something to do with using a "lost password" email reset on the iCloud account, and having the relevant email account logged in (or saved to the password manager) on the phone itself, so that all you need is the passcode to get into the iCloud account. Something like that?

Yup, I'm guessing that's it: https://support.apple.com/en-us/102656 This article seems to make it pretty clear that having a passcode on a signed-in device is enough to reset the password.

That seems like an insane security hole really.

One of the big distinctions I make in my life is whether a passcode is being typed in frequently and in view of the public. And since these are shorter codes, the entity on guessing from a distance is much lower.

Re: Thieves took their iPhones. Apple won't give their digital lives back

#63

Post by Hizonner »

oarsinsync wrote: post #54
Hizonner wrote: post #7

Earlier quoted context omitted.

OK, but what model would you suggest? Apple has no adequate way to actually verify who anybody is without (a) forcing them to physically visit one of a small number of offices (it can't be every store), and (b) probably charging a significant fee to cover the cost of doing real verification. And even that demands assuming that the identifying information on the account is right.

> Apple has no adequate way to actually verify who anybody is without (a) forcing them to physically visit one of a small number of offices (it can't be every store), and (b) probably charging a significant fee to cover the cost of doing real verification. My bank is able to verify me remotely to login to their app from a new device in under 15 minutes, just with a photo of my ID card and a video of my face. And the…

Your bank verifies that against the copy of your ID that was collected in person when you opened the account (unless you're using some fly-by-night FinTech "bank", anyway). At a minimum, the bank has already collected, and checked, a bunch of other information that it can use to verify you (more than Apple can collect without mass user rebellion). It has reasonable confidence you haven't lied about that information. The bank can use that information to look up more about you in public records (which the bank knows how to do because, unlike Apple, it doesn't operate in every jurisdiction in the world). And I suspect that the ID/video check is on top of proving you already know a password.

Perhaps even more important, the bank knows exactly what liability it's assuming, and what risk it's exposing you to. There's a limit on how much money the app will let you move (even if the bank doesn't tell you what it is). All the transactions you can do are defined by the bank, it knows what's going on at all times, and it can and does apply extra checks for risky-looking transactions.

And bank transactions in general have a whole reversal-based security layer on top of all that.

On the other hand, people use their Apple accounts to log into God-knows-what third party systems with God-knows-what risks and God-knows-what other security measures or lack thereof.

Oh, and also the bank charges you ongoing overt or hidden fees specifically to cover the costs of securing your money. And of insurance if it fails to do so.

Re: Thieves took their iPhones. Apple won't give their digital lives back

#64

Post by wmf »

JumpCrisscross wrote: post #55
crazygringo wrote: post #9

I'm curious why Apple has let it get this far that court cases are underway and WaPo is writing an article about it. What's in it for Apple? Surely it's easy enough to define some kind of verification process based on various pieces -- phone number, credit card, purchase receipt, etc. -- and requiring a police report to be filed or something. And this isn't like Google or Facebook where accounts are free, preventing…

> Surely it's easy enough to define some kind of verification process based on various pieces -- phone number, credit card, purchase receipt, etc. -- and requiring a police report to be filed or something Given the stakes, Cupertino may have decided that it does not wish to arbiter such disputes. Requiring a court order shifts the dispute to that forum.

Will Apple obey court orders? Have they ever?

Re: Thieves took their iPhones. Apple won't give their digital lives back

#65

Post by voidspark »

ddtaylor wrote: post #58
voidspark wrote: post #52

Earlier quoted context omitted.

It's not a free service. One of them had a 2TB+ iCloud account. That has a monthly cost. Not free. The free plan only gives you 5GB storage. Apple is not an advertising company. We pay for the phone and we pay for iCloud.

You pay to rent the phone I'm pretty sure.

I don't know what you are talking about. You can buy an iPhone. They sell 200 million iPhones every year. Just go to the shop and buy one.

Re: Thieves took their iPhones. Apple won't give their digital lives back

#66

Post by crote »

XorNot wrote: post #60
lxgr wrote: post #35

Earlier quoted context omitted.

> Somehow the thief was able to change the account password and email account That would be the fact that Apple lets anybody that knows the passcode reset the iCloud password as well, without any further authentication. And the passcode can be shoulder surfed by the thief... "Stolen device protection" was developed as a response to a wave of such thefts: https://support.apple.com/en-us/120340 It seems like a good ste…

Admittedly we in security do a very poor job on equipping users with useful threat models: i.e. the number of times people either don't turn on any sort of security, or turn on extremely aggressive security but don't write down and store a recovery code is too damn high.

And it's made even worse by companies not wanting to deal with meatspace. Secure account recovery isn't too difficult if you're willing to do ID verification in physical stores, but no tech company wants to do that.

Re: Thieves took their iPhones. Apple won't give their digital lives back

#67

Post by crote »

XorNot wrote: post #62
crazygringo wrote: post #28

Earlier quoted context omitted.

Yup, I'm guessing that's it: https://support.apple.com/en-us/102656 This article seems to make it pretty clear that having a passcode on a signed-in device is enough to reset the password.

That seems like an insane security hole really. One of the big distinctions I make in my life is whether a passcode is being typed in frequently and in view of the public. And since these are shorter codes, the entity on guessing from a distance is much lower.

The even more insane security hole is allowing someone with physical access and the password to permanently lock out all recovery options.

Re: Thieves took their iPhones. Apple won't give their digital lives back

#68

Post by VincentEvans »

Forgeties79 wrote: post #13
wmf wrote: post #11

Earlier quoted context omitted.

If Apple can unlock the account from your stolen iPhone they can also unlock your account for the gestapo. Whether it's worth throwing normal people under the bus to protect a few dissidents is a matter of values on which people are going to have differing opinions of course.

>to protect a few dissidents Your opinion seems to be to trivialize how important this can be, which fine you do you, but I think saying it only protects "a few dissidents" is a bit ridiculous. Every protest I've filmed at I hit the lock button 5 times so it forces a passcode. I feel secure knowing the police can't just take it and start scrolling - they need a warrant or they're bust. You don't have to be a dissiden…

>hit lock button 5 times so it forces a passcode

I didn’t know what that meant - so I googled it. And it says something entirely different….

Quote: Pressing the lock button (or side button) five times quickly on an iPhone or many Android devices will activate Emergency SOS. This will prompt a countdown and eventually, if not cancelled, initiate a call to emergency services, potentially alerting emergency contacts and sharing your location.

Re: Thieves took their iPhones. Apple won't give their digital lives back

#69

Post by JumpCrisscross »

wmf wrote: post #64
JumpCrisscross wrote: post #55

Earlier quoted context omitted.

> Surely it's easy enough to define some kind of verification process based on various pieces -- phone number, credit card, purchase receipt, etc. -- and requiring a police report to be filed or something Given the stakes, Cupertino may have decided that it does not wish to arbiter such disputes. Requiring a court order shifts the dispute to that forum.

Will Apple obey court orders? Have they ever?

> Will Apple obey court orders? Have they ever?

What on earth are you referring to?

Re: Thieves took their iPhones. Apple won't give their digital lives back

#70

Post by _rutinerad »

VincentEvans wrote: post #68
Forgeties79 wrote: post #13

Earlier quoted context omitted.

>to protect a few dissidents Your opinion seems to be to trivialize how important this can be, which fine you do you, but I think saying it only protects "a few dissidents" is a bit ridiculous. Every protest I've filmed at I hit the lock button 5 times so it forces a passcode. I feel secure knowing the police can't just take it and start scrolling - they need a warrant or they're bust. You don't have to be a dissiden…

>hit lock button 5 times so it forces a passcode I didn’t know what that meant - so I googled it. And it says something entirely different…. Quote: Pressing the lock button (or side button) five times quickly on an iPhone or many Android devices will activate Emergency SOS. This will prompt a countdown and eventually, if not cancelled, initiate a call to emergency services, potentially alerting emergency contacts and…

I just tried on my iPhone and it does not do that, there is no countdown. It will force a passcode and give you the option to call SOS, shut off your phone or show your medical id.
Post reply on HN