I'm curious why Apple has let it get this far that court cases are underway and WaPo is writing an article about it.
What's in it for Apple? Surely it's easy enough to define some kind of verification process based on various pieces -- phone number, credit card, purchase receipt, etc. -- and requiring a police report to be filed or something.
And this isn't like Google or Facebook where accounts are free, preventing manual account recovery from being scalable. People spend thousands of dollars on Apple devices across phones and laptops and more. People who don't spend money on Apple generally aren't keeping their data in iCloud.
I'm confused because it seems like the rational, profitable thing for Apple to do here is to have these procedures for account recovery. So what's stopping them? Is there some kind of huge liability question if they ever facilitate giving access to the wrong person?
If Apple can unlock the account from your stolen iPhone they can also unlock your account for the gestapo. Whether it's worth throwing normal people under the bus to protect a few dissidents is a matter of values on which people are going to have differing opinions of course.
That doesn't make sense. This isn't a technical hurdle, is it? Apple already can unlock your account "for the gestapo" if they choose to.
If the users have enabled Advanced Data Protection and don't have another Apple device, then I can understand why it would be lost for good. But that doesn't seem to be the case in these lawsuits. They make it clear that Apple has access to the data, and could transfer/restore it if they wanted to.
This irks me A LOT and is simplified to the point of being incorrect, yet lots of people here make the same logical errors.
Protecting the contents of peoples devices and accounts with strong encryption and hardware security is great for the individual and protects them from thieves and governments alike. If Apple designed their devices so that they cannot unencrypt the content without the users secret passsword, that's sensible for a lot of users.
But E-Mail Addresses and Accounts are derivatives of your identity and companies should have ways of returning your accounts to you, even if the content is lost, in case of stolen identities.
I am pretty paranoid about this stuff and only store private data using encryption and on trusted devices running mostly hardened FOSS software (Graphene OS, Fedora Secure Blue, OpenSuse MicroOS, etc.) and my backups are rcloned encrypted to the cloud. Yet for my most important e-mail that is bound to paypal, banking, shopping etc. I use posteo. They do this exactly right. I have personally tested contacting their support to return access to the e-mail address in case of a "lost password". After some validation, they returned access for it to me, but the encrypted content was unrecoverable. That is exactly what any responsible company should do.
Your opinion seems to be to trivialize how important this can be, which fine you do you, but I think saying it only protects "a few dissidents" is a bit ridiculous.
Every protest I've filmed at I hit the lock button 5 times so it forces a passcode. I feel secure knowing the police can't just take it and start scrolling - they need a warrant or they're bust.
You don't have to be a dissident to need your privacy.
> Surely it's easy enough to define some kind of verification process based on various pieces -- phone number, credit card, purchase receipt, etc. -- and requiring a police report to be filed or something.
Apple has such a process in place: https://support.apple.com/en-us/118574 (The details aren't all laid out on that web page, but Apple support may ask for information like purchase records to confirm ownership.)
What I think is at issue here is that it will only restore access to an account which is not currently being accessed. If an account is being accessed from a logged-in device, Apple is unwilling to cut off the current user's access to that account and hand it over to another party.
And, quite honestly, I can see where Apple is coming from with this policy. Arbitrating access to a contested account can get really messy (e.g. consider a scenario where an abusive partner is trying to access the victim's online accounts).
An account is supposed to belong to a single person. If you are able to definitively prove that you are that person (for example, by showing up to an Apple store with your ID card), you should be able to restore access to it. An abusive partner won't have access to that.
Refusing restoration when someone else has access to it is understandable, but it works the other way around as well: an abusive partner would be able to prevent the legitimate owner from accessing the account.
I think it's far more likely that Apple just can't be bothered. Dealing with stuff like this is messy and complicated, and they aren't going to lose any revenue from those few thousand people a year losing their account and all their data.
> Is there some kind of huge liability question if they ever facilitate giving access to the wrong person?
This is what I was thinking as I read the article. Imagine what will be written about them when they do give iCloud access to an impostor. Depending on what's on their account thieves could dedicate a ton of time to social engineering Apple into recovering the account. The article mentions police reports being "proof", but that doesn't seem like solid evidence considering how easy it could be to fake a police report from one of the tens of thousands of jurisdictions in the US. This is a problem for a lot of industries actually, i.e. banks and death certificates.
> Surely it's easy enough to define some kind of verification process based on various pieces -- phone number, credit card, purchase receipt, etc. -- and requiring a police report to be filed or something
Given the stakes, Cupertino may have decided that it does not wish to arbiter such disputes. Requiring a court order shifts the dispute to that forum.
They don’t want to give these powers to a large number of customer service reps who can be bribed or coerced or socially engineered into transferring accounts to bad guys.
Look what happened to the mobile carriers and sim-jacking.
>People spend thousands of dollars on Apple devices
As long as the people cut off from the walled garden amount to less than a rounding error in Apple's bottom line, they simply don't care. They will only care when a judge forces them to care, as we had to find out the hard way in a class action lawsuit against Apple. We won, but they lost us as lifetime customers. My wife even owns Apple stock and refuses to buy anything else from them and warns others against it. They could have made it right for practically no cost to them, but they chose the dick move, and they were forced to pay out in the end anyway.
My gut tells me that they don't want to either set the precedent or let it be known that they can access your data and give/revoke access remotely, because it pokes a hole in their E2E encryption claims and opens the door to demands for backdoor access from governments.
It doesn't "poke a hole" in anything. The only way you get the full E2E encryption Apple talks about is if you enable "Advanced Data Protection", which none of the people in the article did, per the article. Apple could decrypt and return the data because Apple has the keys. Apple is refusing to do so.
I think corporate responses to most things like this is to deny and avoid until forced to get involved. It should not take WaPo getting involved but it seems to be the norm for big tech companies.
My cousin’s phone was stolen in San Francisco. My mom’s phone was hooked up to the same account. Somehow the thief was able to change the account password and email account to something else.
Now my mom cannot reset her phone because she doesn’t have access to the thieves account.
> Somehow the thief was able to change the account password and email account
That would be the fact that Apple lets anybody that knows the passcode reset the iCloud password as well, without any further authentication. And the passcode can be shoulder surfed by the thief...
It seems like a good step forward but still not perfect, and I believe it's not on by default.
On the other side, with Advanced Data Protection, it seems shockingly easy to permanently lock oneself out of an iCloud account: As far as I understand, there is absolutely no way to recover an account protected that way if the recovery code is lost – not even by deleting all data currently stored on it and starting from scratch (e.g. from a local backup).
Given the fact that an iCloud account doesn't only contain a big pile of data, but access to some purchased products and services (subscriptions, app purchases, iTunes songs, the Apple Card etc.), that seems like a pretty big oversight.
Admittedly we in security do a very poor job on equipping users with useful threat models: i.e. the number of times people either don't turn on any sort of security, or turn on extremely aggressive security but don't write down and store a recovery code is too damn high.
> That would be the fact that Apple lets anybody that knows the passcode reset the iCloud password as well, without any further authentication
Doesn't this require at least one other device to allow access and provide a one-time code?
I can't log in to iCloud in a browser, update payment information, or do anything even remotely sensitive with just one device and my screen lock mechanism(s).
EDIT: I stand corrected. On a device that's designated as "trusted" you can indeed change the password using only the screen unlock using the instructions at https://support.apple.com/en-us/102656
In the end, locking a hardware device to an online account is just stupid.
They marketed it as a tool to prevent theft (and recover if lost) but in reality, it has not prevented theft at all (if anything it has increased as the phones value has ballooned).
Apple is the only one who truly profits the most from this "innovation".
I have had an iPad stolen, and while I could track, it definitely didn't make any difference.
For those interested in the silver bullet to backup iCloud.
Get a Mac mini with enough space for your photo library and wire it into your network. Sign into iCloud.
For photos open the app and change the settings to store full res photos locally.
Enable iCloud desktop and documents sync.
Two options
1 - Sign up for Backblaze and ensure you map the folders from iCloud and photos that are being synced to the device. Let it run and do a full sync. I use this option.
2 - Buy an external drive with a lot of space and use Carbon Copy Cloner to mirror your drive. The caveat is your at the mercy of a local copy that a home fire or electrical incident can destroy.
I like Backblaze for the sheer constant syncing it does and they allow me to set up an encryption key so they don’t have access to my data.
I do that, and I'm also planning to use icloud photos downloader [0], a python script to download photos, so I can download those directly on another machine running Linux.
It took me a minute to figure out how this works, but it must have something to do with using a "lost password" email reset on the iCloud account, and having the relevant email account logged in (or saved to the password manager) on the phone itself, so that all you need is the passcode to get into the iCloud account. Something like that?
One of the big distinctions I make in my life is whether a passcode is being typed in frequently and in view of the public. And since these are shorter codes, the entity on guessing from a distance is much lower.
My daughter had her iPhone stolen in L.A. — she immediately wiped it remotely. The thieves were unable to access it.
I got her a new iPhone pretty fast (the budget one) and she was back in business, back in her iCloud account. (She was one of those that saw her device head to Asia. She got a handful of text messages pleading with her to remove the stolen device from her account but she ignored them.)
Yeah, that's why I'm having to think at it some to figure out what's going on here. Usually I need my iCloud password to do anything related to that account, so I guess they're using some kind of iCloud password reset bypass that relies on the phone having access to necessary reset-related accounts (like email—though, IDK, I don't think I've ever tried to "lost password" reset my iCloud account, so I'm not sure if even that's enough)
The 3-2-1 rule is wisdom of the ages. The "2" in the rule is all about having your data in at least two different types of "media". A modern read on this is anything tied to the same account counts as the same type of "media". So, you need at least one copy of your data not tied to your Apple ID.
A few things you can do here:
- Own a mac with enough storage to download your entire iCloud / Apple Photos data set. Configure your mac to do so. Your mac is still activation locked to your Apple ID though, so backup that local copy through Time Machine or the service of your choice (e.x. Backblaze). A NAS is very helpful to automate this.
- Use app(s) on your phone that will copy of your data to the location of your choice, such as Photo Sync.
Is there a consensus on what you should actually do in the event your phone is stolen? Someone I know's phone was stolen and I helped them through it (remotely) in real time, and I remember looking up what to do and having to sort through a lot of straight up bad advice, including articles that seem naive as to what actually happens in real life when thieves steal a phone.
In this case, the phone was marked as lost immediately, but a couple of days later the thieves started trying to reset the password on the owner's iCloud account using various methods, the first of which produced 1st party push notifications asking to confirm the account password reset that were sent to the owner's other signed-in devices that were still in their possession. In the moment, it would be so easy for a confused & stressed person to accidentally or mistakenly tap those notifications and enable their own account hijacking.
The thieves then evidently called Apple Support and tried to get the iCloud account password reset over the phone, but by this point the owner had already gotten a new phone and SIM for their phone number, which meant that Apple Support's 2FA SMS codes were received by their replacement phone (in their possession) instead of the stolen phone (in the thieves' possession, and which no longer had cell service). It seems like if they had delayed in getting their new phone and left the stolen device with functional cell service, the hijacking might have succeeded at this point.
Apple's own "What to do if your iPhone is stolen" page [0] has no info these tactics that are actually used in the moment by phone thieves. That page does link to a page about social engineering scams [1] but approaches that in a general sense.
I think Apple's way of handling it should be way more intuitive. For example, they should differentiate between phones that are lost and stolen. If your phone is lost, you want to protect against someone finding it and being able to access the phone's contents. If your phone is stolen, the thieves will most likely try to hijack your iCloud account as well, and they'll try and social engineer both the owner and Apple Support to do so, so add a "Mark as Stolen" option that also adds protections against iCloud account hijacking.
> In the moment, it would be so easy for a confused & stressed person to accidentally or mistakenly tap those notifications and enable their own account hijacking.
That won't give them access. When you respond to the reset password notifications, it then asks for a new password on the same device you responded on, not on the device that requested the reset.
Readit News
What's in it for Apple? Surely it's easy enough to define some kind of verification process based on various pieces -- phone number, credit card, purchase receipt, etc. -- and requiring a police report to be filed or something.
And this isn't like Google or Facebook where accounts are free, preventing manual account recovery from being scalable. People spend thousands of dollars on Apple devices across phones and laptops and more. People who don't spend money on Apple generally aren't keeping their data in iCloud.
I'm confused because it seems like the rational, profitable thing for Apple to do here is to have these procedures for account recovery. So what's stopping them? Is there some kind of huge liability question if they ever facilitate giving access to the wrong person?
If the users have enabled Advanced Data Protection and don't have another Apple device, then I can understand why it would be lost for good. But that doesn't seem to be the case in these lawsuits. They make it clear that Apple has access to the data, and could transfer/restore it if they wanted to.
Protecting the contents of peoples devices and accounts with strong encryption and hardware security is great for the individual and protects them from thieves and governments alike. If Apple designed their devices so that they cannot unencrypt the content without the users secret passsword, that's sensible for a lot of users.
But E-Mail Addresses and Accounts are derivatives of your identity and companies should have ways of returning your accounts to you, even if the content is lost, in case of stolen identities.
I am pretty paranoid about this stuff and only store private data using encryption and on trusted devices running mostly hardened FOSS software (Graphene OS, Fedora Secure Blue, OpenSuse MicroOS, etc.) and my backups are rcloned encrypted to the cloud. Yet for my most important e-mail that is bound to paypal, banking, shopping etc. I use posteo. They do this exactly right. I have personally tested contacting their support to return access to the e-mail address in case of a "lost password". After some validation, they returned access for it to me, but the encrypted content was unrecoverable. That is exactly what any responsible company should do.
Your opinion seems to be to trivialize how important this can be, which fine you do you, but I think saying it only protects "a few dissidents" is a bit ridiculous.
Every protest I've filmed at I hit the lock button 5 times so it forces a passcode. I feel secure knowing the police can't just take it and start scrolling - they need a warrant or they're bust.
You don't have to be a dissident to need your privacy.
Apple has such a process in place: https://support.apple.com/en-us/118574 (The details aren't all laid out on that web page, but Apple support may ask for information like purchase records to confirm ownership.)
What I think is at issue here is that it will only restore access to an account which is not currently being accessed. If an account is being accessed from a logged-in device, Apple is unwilling to cut off the current user's access to that account and hand it over to another party.
And, quite honestly, I can see where Apple is coming from with this policy. Arbitrating access to a contested account can get really messy (e.g. consider a scenario where an abusive partner is trying to access the victim's online accounts).
An account is supposed to belong to a single person. If you are able to definitively prove that you are that person (for example, by showing up to an Apple store with your ID card), you should be able to restore access to it. An abusive partner won't have access to that.
Refusing restoration when someone else has access to it is understandable, but it works the other way around as well: an abusive partner would be able to prevent the legitimate owner from accessing the account.
I think it's far more likely that Apple just can't be bothered. Dealing with stuff like this is messy and complicated, and they aren't going to lose any revenue from those few thousand people a year losing their account and all their data.
This is what I was thinking as I read the article. Imagine what will be written about them when they do give iCloud access to an impostor. Depending on what's on their account thieves could dedicate a ton of time to social engineering Apple into recovering the account. The article mentions police reports being "proof", but that doesn't seem like solid evidence considering how easy it could be to fake a police report from one of the tens of thousands of jurisdictions in the US. This is a problem for a lot of industries actually, i.e. banks and death certificates.
Given the stakes, Cupertino may have decided that it does not wish to arbiter such disputes. Requiring a court order shifts the dispute to that forum.
Look what happened to the mobile carriers and sim-jacking.
As long as the people cut off from the walled garden amount to less than a rounding error in Apple's bottom line, they simply don't care. They will only care when a judge forces them to care, as we had to find out the hard way in a class action lawsuit against Apple. We won, but they lost us as lifetime customers. My wife even owns Apple stock and refuses to buy anything else from them and warns others against it. They could have made it right for practically no cost to them, but they chose the dick move, and they were forced to pay out in the end anyway.
Various entities will still be able to get to the data, while users might incorrectly assume that that's not the case.
Dead Comment
That would be the fact that Apple lets anybody that knows the passcode reset the iCloud password as well, without any further authentication. And the passcode can be shoulder surfed by the thief...
"Stolen device protection" was developed as a response to a wave of such thefts: https://support.apple.com/en-us/120340
It seems like a good step forward but still not perfect, and I believe it's not on by default.
On the other side, with Advanced Data Protection, it seems shockingly easy to permanently lock oneself out of an iCloud account: As far as I understand, there is absolutely no way to recover an account protected that way if the recovery code is lost – not even by deleting all data currently stored on it and starting from scratch (e.g. from a local backup).
Given the fact that an iCloud account doesn't only contain a big pile of data, but access to some purchased products and services (subscriptions, app purchases, iTunes songs, the Apple Card etc.), that seems like a pretty big oversight.
Doesn't this require at least one other device to allow access and provide a one-time code?
I can't log in to iCloud in a browser, update payment information, or do anything even remotely sensitive with just one device and my screen lock mechanism(s).
EDIT: I stand corrected. On a device that's designated as "trusted" you can indeed change the password using only the screen unlock using the instructions at https://support.apple.com/en-us/102656
Apple is the only one who truly profits the most from this "innovation".
I have had an iPad stolen, and while I could track, it definitely didn't make any difference.
For those interested in the silver bullet to backup iCloud.
Get a Mac mini with enough space for your photo library and wire it into your network. Sign into iCloud.
For photos open the app and change the settings to store full res photos locally.
Enable iCloud desktop and documents sync.
Two options
1 - Sign up for Backblaze and ensure you map the folders from iCloud and photos that are being synced to the device. Let it run and do a full sync. I use this option.
2 - Buy an external drive with a lot of space and use Carbon Copy Cloner to mirror your drive. The caveat is your at the mercy of a local copy that a home fire or electrical incident can destroy.
I like Backblaze for the sheer constant syncing it does and they allow me to set up an encryption key so they don’t have access to my data.
[0] https://github.com/icloud-photos-downloader/icloud_photos_do...
https://support.apple.com/en-us/102656
This article seems to make it pretty clear that having a passcode on a signed-in device is enough to reset the password.
One of the big distinctions I make in my life is whether a passcode is being typed in frequently and in view of the public. And since these are shorter codes, the entity on guessing from a distance is much lower.
My daughter had her iPhone stolen in L.A. — she immediately wiped it remotely. The thieves were unable to access it.
I got her a new iPhone pretty fast (the budget one) and she was back in business, back in her iCloud account. (She was one of those that saw her device head to Asia. She got a handful of text messages pleading with her to remove the stolen device from her account but she ignored them.)
I’ve read a couple stories where someone was held in an alley while an accomplice went to an ATM to withdraw as much cash as they could.
What, the guy just jumped into the Pacific and started swimming?
It's all about posturing and pretending, image is the only thing that matters to Apple.
A few things you can do here:
- Own a mac with enough storage to download your entire iCloud / Apple Photos data set. Configure your mac to do so. Your mac is still activation locked to your Apple ID though, so backup that local copy through Time Machine or the service of your choice (e.x. Backblaze). A NAS is very helpful to automate this.
- Use app(s) on your phone that will copy of your data to the location of your choice, such as Photo Sync.
Deleted Comment
In this case, the phone was marked as lost immediately, but a couple of days later the thieves started trying to reset the password on the owner's iCloud account using various methods, the first of which produced 1st party push notifications asking to confirm the account password reset that were sent to the owner's other signed-in devices that were still in their possession. In the moment, it would be so easy for a confused & stressed person to accidentally or mistakenly tap those notifications and enable their own account hijacking.
The thieves then evidently called Apple Support and tried to get the iCloud account password reset over the phone, but by this point the owner had already gotten a new phone and SIM for their phone number, which meant that Apple Support's 2FA SMS codes were received by their replacement phone (in their possession) instead of the stolen phone (in the thieves' possession, and which no longer had cell service). It seems like if they had delayed in getting their new phone and left the stolen device with functional cell service, the hijacking might have succeeded at this point.
Apple's own "What to do if your iPhone is stolen" page [0] has no info these tactics that are actually used in the moment by phone thieves. That page does link to a page about social engineering scams [1] but approaches that in a general sense.
I think Apple's way of handling it should be way more intuitive. For example, they should differentiate between phones that are lost and stolen. If your phone is lost, you want to protect against someone finding it and being able to access the phone's contents. If your phone is stolen, the thieves will most likely try to hijack your iCloud account as well, and they'll try and social engineer both the owner and Apple Support to do so, so add a "Mark as Stolen" option that also adds protections against iCloud account hijacking.
[0] https://support.apple.com/en-us/120837
[1] https://support.apple.com/en-us/102568
That won't give them access. When you respond to the reset password notifications, it then asks for a new password on the same device you responded on, not on the device that requested the reset.