SEARCH
diglloydTools™
WSJ: The iPhone Setting Thieves Use to Lock You Out of Your Apple Account
Related: Apple, Apple iOS, Apple iPhone and iPad, cyber social engineering, iOS, passphrase, security, The Wall Street Journal
re: Data Loss by Failing To Backup
re: WSJ: A Basic iPhone Feature Helps Criminals Steal Your Entire Digital Life
Life has simple challenges and hard ones. Get the simple things right—they’re easy—and do your best on the hard things. Counting on a corporation like Apple for your data is a major error about a very simple thing that no one should ever make.
It is incredibly foolish to not maintain multiple backups.
UPDATE, Dec 12 2023: Apple Makes Security Changes to Protect Users From iPhone Thefts
WSJ: The iPhone Setting Thieves Use to Lock You Out of Your Apple Account
2023-04-19
The recovery key was designed to make Apple IDs safer. Instead, these victims permanently lost family photos and other precious digital possessions.
Greg Frasca has been locked out of his Apple account since October, and he’ll do just about anything to get back in.
He has offered to fly from Florida to Apple’s California headquarters to prove his identity in person, or write a check for $10,000 to reclaim the account. It holds the only copies of eight years of photos of his young daughters.
This is all because the thieves who stole Mr. Frasca’s iPhone 14 Pro at a bar in Chicago wanted to drain cash from his bank account and prevent him from remotely tracking down the stolen phone. They used his passcode to change the 46-year-old’s Apple ID password. They also enabled a hard-to-find Apple security setting known as the “recovery key.” In doing so, they placed an impenetrable lock on his account.
In February, we reported that thieves, often in and around bars at night, watch iPhone owners tap in their passcodes, then steal the targets’ phones. With this short four- or six-digit string, criminals can change the Apple account password and rack up thousands of dollars in charges using Apple Pay and financial apps.
Dozens of victims contacted The Wall Street Journal after the report was published, confirming similar crimes in at least nine U.S. cities, including New York, New Orleans, Chicago and Boston. Many are able to get their money back, but those locked out of their Apple accounts by thieves using the recovery key face a bigger challenge: finding a way through Apple’s complex policies and bureaucracy to retrieve their lost photos, contacts, notes, messages and other files.
Apple introduced the optional recovery key in 2020 to protect users from online hackers. Users who turn on the recovery key, a unique 28-digit code, must provide it when they want to reset their Apple ID password.
iPhone thieves with your passcode can flip on the recovery key and lock you out. And if you already have the recovery key enabled, they can easily generate a new one, which also locks you out.
Apple’s policy gives users virtually no way back into their accounts without that recovery key. For now,a stolen iPhone could mean devastating personal losses.
...After Cameron Devine’s iPhone 13 Pro was stolen from a Boston bar in August, the 24-year-old said he spent hours on the phone with Apple customer support trying to regain access to over a decade of data. Each representative told him the same thing: No recovery key, no access. Mr. Devine said he had never heard of the key, let alone set one up.
...If someone takes over your Google account, Google’s password-reset process lets you provide a recovery email, phone number or account password, and you can use them to regain access later, even if a hijacker changes them.
...
MPG: it’s outrageous that Apple allows a thief to destroy your entire digital life/history and that users have no ability whatsoever to implement any defensive measures, such as disabling the recovery key and/or requiring some time to pass.
This is an inherently unsafe product design that would make any competent security engineer blush with embarrassment. Why can’t Apple be sued in a massive class-action lawsuit?
Shame on you Apple. This is Apple’s tone-deaf response:
“We sympathize with people who have had this experience and we take all attacks on our users very seriously, no matter how rare,” an Apple spokesman said. “We work tirelessly every day to protect our users’ accounts and data, and are always investigating additional protections against emerging threats like this one.”
The threats are not emerging, this has been an issue for years. This viciously insulting and irrelevant response sums up what a bunch of feckless jerks these people at Apple are—it does not address the reality of the problem, it does not provide any means to disable the recovery key, and it does nothing to help the victims but insults them with corporate weasel words.
Apple *can* in fact disable the recovery key:
After months of calls to Apple customer support and letters to the company about how the thieves had his 28-digit recovery key, he said he finally reached a representative who was willing to do more. Once Mr. Allen answered additional verification questions, Apple disabled the recovery key, he said. He then reset his password, regaining access to the account.
For a guy like Tim Cook to allow people to lose everything when he could fix it in a 5-minute meeting by delegating it makes me think he is of a very low moral character.
