How iPhone Thieves Lock You Out Of Your Apple Account | WSJ

[@juan2049]

I have over 20,000 photos on my iPhone that I have taken over the past few years. I feel for this man. I hope he gets his memories back :(

[@michaelcorcoran8768]

Yeah, it's probably worth finding a backup. If you have a prime account, I think Amazon photos gives you unlimited backup for photos but not videos.

[@jasontomica8938]

​@@michaelcorcoran8768 Google does also and it's wonderful

[@truthteller4442]

Same here. People don’t understand the unbelievable psychological damage they’re doing to people when they steal their phone. These phone are now our entire worlds. I would be devastated if all my family pictures were just gone.

[@_morgoth_]

At least once a year (usually sooner), I transfer all my photos and videos onto an external drive I keep at home. Always good to have backups. If you really want to be safe, keep a copy of that external drive at a different location, like a relatives house across town, in case of a disaster at your house. Or you could backup in the cloud (service other than iCloud) as well if you are willing to pay that extra price.

[@megapangolin1093]

And you are suggesting that these people care? They don't, and they have nothing to lose and think it is the owner's fault or Apples or the Popes, it isn't their problem, thats why they can do this time after time.@@truthteller4442

[@rinforthewin-ks1vk]

Excellent follow-up, Joanna and the WSJ team!

[@theJesai]

‼️ *THE SCREENTIME PASSCODE CAN BE REMOVED/CHANGED WITH THE DEVICE PASSCODE! :(* The solution they mentioned won't work. When you hit forget passcode to reset your screentime passcode, it asks for your Apple IID passcode. if you hit forgot password again (for the Apple Id), you can reset it with the iPhone passcode, in turn getting rid of screen time and moving forward with this attack! :(

[@richardwhite3456]

@@theJesai t lol

[@harveybolton]

Props to the WSJ for shining the spotlight on this, hopefully it forces Apple to add some preventative measures in a software update and to create a process people affected by this can use to prove their identity and get the iCloud account back.

[@mitchellquartero]

Exactly

[@fernandoluna7337]

Yeah, until people start screaming "what about my privacy or why does Apple need that information". People should research better how to be better protected and not assume that the default settings are. Only issue really is that Apple let you drop and generate a new recovery key so easily. Also never understand why rely only on the passcode. That is on Apple but also most Apple users like Apple because is "friendly" and "easy".

[@FogataMexicana]

The code should be sent in the mail like the way banks handle lost pins. Even for a fee. ❤

[@InventorZahran]

So basically, Apple's big fail here was the idea of relying on the iPhone's passcode for anything other than unlocking the iPhone itself. Resetting the Apple ID passcode or regenerating a recovery key should require at least two factors of authentication, neither of which is the iPhone's passcode. Also, when using Touch ID/Face ID to unlock apps within the iPhone, it should fallback to the app's log-in credentials if biometric authentication is not successful (instead of prompting to enter the iPhone's passcode).

[@charlesm.9858]

Correct ✅

[@legendsaud]

@@charlesm.9858 There are times you need to access your phone apps without face or touch ID. I mean there are people who you allow to access the apps - without bio-authentication.

[@hwcanotabot]

I think at the moment if FaceID fails for whatever reason, most apps I use fallback to their default login credentials like username/email and password or passcode. Have never seen a prompt asking for the iPhone passcode/phrase for third party apps.

[@legendsaud]

@@hwcanotabot I use it for whatsapp authentication and that's how it works.

[@InventorZahran]

@cranky-orange-kat Can you tell me how to set this up, or link me to a guide? This is exactly the solution I (and probably many others) have been looking for! I don't ever want to have an Apple Watch or a child account, so it's perfect for me.

[@GamingWeekends1]

Hi, you should also add the “Passcode Changes” to the list from screen time. If they have your passcode, they can also change your passcode. Without it, they can’t change it

[@mitchellquartero]

Thanks appreciate it

[@charlesm.9858]

Done! Mahalo!!🤙🏼

[@RONJAE212003]

Definitely did this as well👌🏽

[@bluekeybo]

Apple should require the Apple ID password when: Changing the pin, changing the password. Apple should require both Apple ID password and phone pin if: changing your recovery key. In my opinion though, once you create a recovery key, the only way to remove it or change it should be by providing the existing recovery key. If you forget it, then that's it, you'll never get it back. So it's not a feature for everyone.

[@InventorZahran]

You can have either security or convenience. Losing a recovery key is inconvenient, but the fact that you can't access anything without said recovery key is proof of its efficacy as a security measure. Anything that has a backdoor for the sake of your convenience can also be exploited by crackers!

[@kyrbies]

Yes, it could be that simple... but then more people would probably lose their "memories"! There is currently only one major problem with Apple's approach: After 3 incorrect recognition attempts, FaceID is deactivated and MUST be activated by entering the PIN. And that's exactly where a thief can look on in public. Typical examples: Payment process does not recognize the face and asks for the PIN at the checkout... It is mounted in the car and does not recognize me because of the angle and asks for the PIN... On the slopes with sunglasses and helmet the same... so theoretically it would be one already helped if the biometrics were not switched off automatically after failed attempts.

[@kyrbies]

I wouldn't mind Apple's policy that if you forgot the password AND didn't create a recovery code, biometrics ALWAYS works to reset the password, but NEVER just the device PIN...

[@scapella1789]

Big issue, glad you guys are bringing the spotlight on it, changing my settings now

[@ydorni5923]

The Screen Time PIN doesn't work. 1. ⁠Set Screen Time PIN. When it asks for your Apple ID, hit cancel 2. ⁠Try to Change Screen Time PIN 3. ⁠Say you forgot it 4. ⁠Phone will offer to let you reset with your Apple ID 5. ⁠Say you forgot it 6. ⁠Phone will offer to reset your Apple ID password with your device lock passcode

[@ylihao]

@@ydorni5923 Tag Joanna lol

[@leoceoliveira]

@@ydorni5923 I tried these steps and that's not what happened. Maybe I missed something? But I agree, more protections are needed urgently!

[@kenclx]

@@ydorni5923shouldnt the passcode be only known to the owner? You forgot to include that part

[@itsalltakenup]

The suggested fix also introduces other exploitable loopholes unfortunately

[@seth8629]

lol why do they let you create a new recovery key without the old one?! They would be on firm footing if they said once you *choose* to create a recovery key it cannot be replaced. But letting people just erase and create a new one is ridiculous!

[@L2002]

because there is no the old one?

[@mitchellquartero]

Exactly

[@j10001]

Because the recovery key is an encryption key for securing _iCloud storage._ If you forget it, they are essentially using 2FA (that is, your iPhone) to allow you to change your iCloud encryption key. It makes sense, since iCloud is really just a backup of your iPhone. So if you have the phone, there are no secrets. They clearly didn’t design the recovery key to be an _iPhone recovery_ key! I wish they would create something like that.

[@Dfgbuiiyyyybb]

Your passcode can be a… - 4 digit pin - 6 digit pin for even more security - An alphanumeric pass phrase for even more security. There are even more enhanced security features such as hardware UBI KEY if you want but would you as the average consumer sacrifice the convenience?

[@Addlibs]

Security key (or "UBI KEY" as you put it) wouldn't stop this attack at all, as it relies on physically stealing a logged-in iPhone, and Apple allows making significant changes to your Apple ID account using just the iPhone's PIN -- no 2nd factor required, even if configured.

[@escobyte]

@@Addlibs its more than that, they spy on you to see when you unlock your phone and write down the pin. Thats how they're able to get access to other parts of the phone, because they have the actual pin, not because it was unlocked

[@Dfgbuiiyyyybb]

@@Addlibs Yes I was referring to making it harder for people to steal your pin or passcode by choosing to use the longer pin but if they have all of that it wouldn't stop them.

[@neil78b]

Or just lock Apple ID changes and passcode changes through Screen Time which you set a completely different secondary passcode...Settings>Screen Time>Content & Privacy Restrictions>Account changes> Don't Allow

[@urquell6483]

all yubikeys can be easily deleted in ios settings.

[@lachlanhunt]

That screen time settings can be trivially bypassed by going through the forgotten screen time passcode flow. Eventually, an attacker can get to a password reset screen, and there’s nothing you can do to prevent that. It is absolutely flawed and Apple needs to fix it.

[@FoxHatLeo]

No, to reset screen time passcode, you need Apple ID and password. And since the attacker cannot get into the Apple ID screen to reset it, they can't reset the screen time passcode either.

[@javtimestwo]

@@FoxHatLeo 👏🏽

[@samyili]

@@FoxHatLeo When going down the forgotten screen time passcode flow, select "I forgot my apple ID password" and it allows you to reset the apple ID password without knowing the screen time passcode...

[@v827]

@samyili If you have a recovery key set, you can’t reset your password without the recovery key. Just make sure you have Passcode Changes restricted along with Account Changed in Screen Time.

[@charlesrank93]

@@v827 if they have your passcode, they can view saved passwords on the iPhone or on something like google chrome.

[@mutunekk]

The big issue here is really the ability to make such significant changes to your security without any stronger safeguards than the PIN. My 5 year old is able to remember PINs just after 2 demonstrations - its really not that hard finding someone's PIN. I can understand why Apple did this... but for people who live in the Apple ecosystem this is really quite worrying. Luckly for the android users, Google OS is just not polished enough for this to be a problem.

[@absyusuf4932]

I am terrified after watching this lol

[@anand.chaudhari]

Heard about Samsung Knox?

[@Dk-qf8dd]

Actually it is almost as much especially if you use Chrome as it can be a password repository like Settings > Passwords in iOS. One thing the thief cannot do though is permanently lock you out of you digital world.

[@anand.chaudhari]

@@Dk-qf8dd I use Samsung secure folder as well as Samsung pass too, bro

[@mutunekk]

@@Dk-qf8dd Yes, once you are in the phone, there is not much difference. However, there is 1 major difference between the platforms and its the fingerprint reader. On Android, a lot of phones only need the PIN/pattern on boot the rest is done using the fingerprint reader. So even if you figured out the PIN, you are still massively limited as the biometrics and or passwords are needed to change/access anything important. On my IPhone, the PIN is randomly needed and used for all sorts of security features. So as much as both are not perfect, the current Apple execution thanks to its convenience is by far riskier. All a android user neeeds to do, is to set access to passwords only via biometrics and the risk reduces significantly.

[@andersonsystem2]

Great video thanks. Apple needs to protect their customers.

[@theJesai]

‼️ *THE SCREENTIME PASSCODE CAN BE REMOVED/CHANGED WITH THE DEVICE PASSCODE! :(* The solution they mentioned won't work. When you hit forget passcode to reset your screentime passcode, it asks for your Apple IID passcode. if you hit forgot password again (for the Apple Id), you can reset it with the iPhone passcode, in turn getting rid of screen time and moving forward with this attack! :(

[@Failure_Is_An_Option]

You are responsible for your own protection. Get after it.

[@TheStrategyWargamer]

Joanna Stern is amazing. I love everything she does. A few years ago I got to meet other legends in the Technology industry like Nilay Patel, Dieter Bohn, and even the legendary Walt Mossberg. Was hoping Joanna would be at The event (it was the last CNTL WALT DLT podcast episode ) Hopefully I can meet Joanna one day and meet another huge legend.

[@TheStrategyWargamer]

Keep on reporting on these amazing stories Joanna you are incredible!

[@ruzzelladrian907]

Thanks, Joanna! The Screen Time lock tip has given me peace of mind.

[@micahwilgus]

It also depends on where you are as well. You have to be aware of your surroundings. Having a privacy screen protector so others can’t see what your doing on your phone as well as making sure you are in a safe environment before doing something on your phone. I know that we all like to think everyplace is ok but it isn’t

[@burlhorse61]

you sshouldn't be leaving your phone lying about in a public place anyway

[@micahwilgus]

I’ve seen a comment on a previous KZbin video on how to make it harder for thieves to do this. You have to set a screen time passcode and then from there turn on the setting to prevent account changes so they can’t get into your iCloud account on your iPhone. You’ll also have to turn off of your email being accessed on the phone as well, because if you don’t and your email address on your phone is linked to your Apple ID they can just reset your Apple ID password. If they have the technical knowledge

[@Dk-qf8dd]

You also need to make sure you have turned off keychain and use a 3rd party password app.

[@JeremyDeBose]

I dunno. Feels like these issues aren’t so much Apple or general tech “loopholes.”We can’t sit back and rely on a device to protect our devices and memories; we have to be smart and proactive and protect them ourselves, too.

[@irrelevant2235]

I agree. This is just someone blaming someone else for his mistakes.

[@NinjaRunningWild]

“An ounce of prevention is worth a pound of cure.” -Benjamin Franklin

[@jannertfol]

For convenience's sake, some of us have put all our eggs in one basket. Unless it's absolutely necessary, I wouldn't use the cloud for ANY storage. Back up your files onto SSDs, flash drives, etc ...and don't store them online at all. Don't do banking on a phone! I know it's the coming/done thing ...but resist. Use bank/credit cards or cash to pay for things. Do your online banking on a desktop computer at home. Etc. If you can't remember passwords, write them down someplace safe. If you have to carry them with you, ensure they aren't obvious, ARE written down, and aren't stored on your devices anywhere. Think in terms of scattering your data around, not collecting it all in one place.

[@priultimus]

I have a physical security key linked to my Apple ID. This would circumvent that. The whole point is for it to be the most secure option, incredibly frustrating you can bypass all this security with a 6 digit number. I wish I could disable changing apple ID passwords with your phone.

[@realericanderson]

You can it’s at the end of the video dingus

[@neil78b]

Or just lock Apple ID changes and passcode changes through Screen Time which you set a completely different secondary passcode...Settings>Screen Time>Content & Privacy Restrictions>Account changes> Don't Allow

[@denumerable]

Wait... a physical security key is bypassed by the recovery key setting? I thought the physical key would be the ultimate solution so I had some on order... (one for my person, one for a safe at home).

[@reddbendd]

the idea is to guard your phone with your life and keep it in a pocket with a zipper

[@theJesai]

‼️ *THE SCREENTIME PASSCODE CAN BE REMOVED/CHANGED WITH THE DEVICE PASSCODE! :(* The solution they mentioned won't work. When you hit forget passcode to reset your screentime passcode, it asks for your Apple IID passcode. if you hit forgot password again (for the Apple Id), you can reset it with the iPhone passcode, in turn getting rid of screen time and moving forward with this attack! :(

[@Owen-il8ws]

Apple truly can't do anything once you add a recovery key. It's not that they don't want to or don't believe him; it's that his data is encrypted and locked, and not even Apple can unencrypt it to change the password without the recovery key.

[@africa_everyday]

Apple can surely do it, they just don't want to do it, as a result of preserving their image

[@Mohammad_Ali__]

Quite informative content. Better to be prepared before it actually happens.

[@Okamine]

Apple should do something about this as soon as possible!

[@mdribblecastle]

Great video! Most consumers will never do it because they have no clue how to manage files or backups..... but a local backup is the only real solution for these types of scenarios. You can't rely on Apple as your only source for photos + videos. Reply

[@trenauldo]

I only backup locally, never to the cloud. Would never trust my important photos and files to an Apple server farm somewhere.

[@solracer66]

There are 4 different ways to control access and of course requiring a combination of them is the best. The 4 ways, of which only 3 of them are generally in use are 1) Something you know like your pin or password; 2) Something you have like a Yubkey; 3) Something you are like a retina scan or fingerprint or; 4) Something you can perform like playing a short musical number or juggling or whatever. I really think #4 should be used more as for example people have a typing cadence that is fairly unique and hard to duplicate. Obviously this can change in different situations but there could be simple ways like having a pattern you wave the phone (triangle, square, figure eight with a certain cadence) in as a way to enter the passcode which could be used.

[@andresate6314]

So basically, a thief can only do this if they actually have ur first passcode and are able to use the phone

[@JC-jx9bp]

Exactly, I don't know why such a fuzz. Just illiterate people who have no foundation on security.

[@leoceoliveira]

yes, which CAN happen. Some thieves are observing people from afar and getting their passcodes and then stealing their devices as a coordinated attack.

[@Randii225]

This is why I always use Face ID

[@neil78b]

Or just lock Apple ID changes and passcode changes through Screen Time which you set a completely different secondary passcode...Settings>Screen Time>Content & Privacy Restrictions>Account changes> Don't Allow So even if the thief somehow gets your first passcode he/she cant do any changes without the second one.

[@dmarti47]

Yes. This could happen because of the owner’s irresponsibility, or also at gun point.

[@ceciliatorres9690]

I think Apple should allow the users to create PASSWORDS for each app, I think that will make it harder for the thieves to get to our info.

[@finalfan321]

WSJ is my fav media from the US.

[@AntennaMan]

This just happened to my roommate. His phone was stolen in NYC and the iCloud password was immediately changed. It seems Apple hasn't done enough to prevent this major flaw in their system.

[@dominicrincker8280]

Wait!! Can we use screen time to limit any sensitive apps too!!?

[@davidv496]

So enable FaceID, don’t use your passcode in public so the thieves can’t walk into your house and change the locks

[@nightlore000]

Apple still sometimes asks for your iD passcode even with face iD unlock .. I only answer calls when I'm out so no one could get my passcode number.

[@truthteller4442]

In Chicago, thieves were driving around holding people at gunpoint and stealing their phones. But they were also demanding their passcodes, too. It’s much more than just having the phone passively and slyly stolen.

[@the_alien293]

wow so smart

[@mitchellquartero]

Apple should do that with that feature

[@mathmanchris666]

@@nightlore000 Thats only if you restarted your phone or you didnt position your phone within view of your face

[@kgerakopoulos]

How they know the original password?

[@mitchellquartero]

They do it in bars they shoulder surf you in other words that thief stands back secretly looking at your passcode and then wait a couple hours until you go out and then have another person steals your phone

[@Ryan256]

4:12 shows how to prevent this. Great tip!

[@leo_nidas]

You’re a freaking awesome, Joanna! Thank you so much!

[@stefanjohansson2373]

I think I’m one of the few that blocks access to my Apple ID account with a demand for passcode for any account changes. It’s very rare that I temporarily have to remove this lock myself to be able to access the Apple ID account settings. If the thieves can’t turn of the “find my iPhone” they rarely can reset and sell them. 1. This is set under screen time - content / privacy restrictions - account changes, and of course that is a a unique code, not the same as used for unlocking the phone. 2. You can also set passcode to “always required”. This will block 99% of the thieves, but 1% of them just sell the phone to specific countries where IMEI-lock and all the other protections is removed very easily. It’s a myth that IMEI-lock works globally.

[@MrMooCow199]

This is why I make a backup of ALL my photos and videos on iCloud on January 1st, every year. Everything is duplicated on 3 USB keys, and placed in my home, my parent's home, and a bank safe deposit box. Never log into banks on the phone. Never use payment apps or phone chips to pay anything. There might be a slight convenience for storing everything on the phone, but not worth the potential cost and consequences of losing that phone.

[@xotvi]

You must be fun at parties, if that's your Jan 1st chore :D

[@cobracommander.1958]

Good job keep educating the new thieves and give the old thieves a heads up lol...

[@mgilija1588]

WSJ, always informative. Thank you for this.

[@alexdasliebe5391]

@4:17 Very nice security workaround

[@brncllhn]

Thanks so much for sharing on how to change the settings to prevent the takeover of iPhones! Much appreciated and I’ll definitely share this video.

[@SteveMorton]

Thank you for sharing the tip about the screen time passcode I would have never discovered that. But it is fairly effective once set. Apple need to do more to stop this issue

[@olafvonbraun7300]

Thank you for making part 2❤

[@Freakazoid12345]

Where's part one? They didn't even put a link in the description?

[@charlesm.9858]

THANK YOU SO MUCH!!! Holy cow this world is getting crazy!! I left Samsung for Apple because of its security measures that it has which devices I really hope Apple fixes this, but thank you so much for this video I took the steps to safeguard my iPhone!! thank you again

[@SeBastian-wi4rg]

How to protect from this on android/ Samsung s23 ?

[@OHHHHUSBANT]

Not using any sort of banking app, and storing every single password on your computer on a notepad

[@Netryon]

It's situation they had in Lost in Space, when overseer Hastings took over control of doors and tried to override permissions and vent the airlocks.

[@Kikusgca]

The screentime passcode can also be bypassed easily if I remember correctly I saw one of the comments in your last video mentioning that.

[@Halloweenguy101]

every part of the iphone NEEDS to be locked behind face id AND a password. you should need both instead of one or another

[@dusty3194]

Also u can connect a cable and brute force generated pin in few hours

[@rmb_dev]

Apparently, creators of this video did know about it )

[@Imammaryasir000]

Need Joannas take on the sideloading app feature coming to iOS 17 in the coming months. What is Apple doing to keep its ecosystem secure?

[@jessonmallari7619]

Loophole? More like negligence on the owner’s part.

[@andymartin5755]

Add Advanced Data Protection into the mix and you are well and truly up the creek without a paddle.

[@WANNA_BE_FRIENDS]

Now they keep signing me out of my Apple ID account on my phone. Login me out of apps

[@sn350channel]

One of the worst feelings is getting your phone stolen. It’s like an intruder/stranger has violated your privacy

[@javierisaai]

What people don’t understand is these keys are effectively and literally keys to their iCloud accounts, and no matter what shape or form of identification they offer Apple the latter will never be able to decrypt their iCloud access. It’s all programmatic, for the good of us the users and our privacy. One recommendation is to AVOID using their passcode in any public space or anywhere they may feel someone will see them. Treat them as if it were their ATM PIN, their iPhone passcode at this point is even more important.

[@michaelcorcoran8768]

I think people understand this. They just think there could be a better system in place. You have to remember, apple has a huge chunk of the senior citizen market. You really going to blame them for not knowing all the sophisticated ways to protect themselves?

[@NinjaRunningWild]

Prior to 2FA you would have to enter your existing password to be able to access account settings. Clearly they need to bring this back.

[@longshot766]

This!

[@L2002]

and what if you forgot that password and your are the owner, that's the problem. it's balanced.

[@itsrichev]

@@L2002 responsible user also require to remember and back up your password in the most secure way. so, first thing first, you're not even able to remember yours, then yeah...

[@itsrichev]

apple can easily let users to decide whether or not the 2fa + old password required is turned on. so, if somehow this kinda thing happens to them while having the 2fa off and it's a big deal for them to remember their own password, then it's their own fault. in the other hands, some users are still able to get the extra benefit of the extra verification step as they wanted.

[@alecco5295]

SUPER HELPFUL! THANK YOUUU SO MUCH.. 10/10 as always Ms. Joanna

[@phuongha3113]

So don't lose your phone and the passcode at the same time.

[@truthteller4442]

In Chicago, they were going around robbing people at gunpoint and also demanding that they give them their passcode as well. It’s more than just getting it passively/slyly stolen after someone was looking over your shoulder and memorized your passcode.

[@bhanuprakashrao1460]

​@@truthteller4442if it's at gun point then it's not Apple mistake. At gun point you can even just ask him tranfer all his money to your account. That's not a software security flaw.

[@tiagomaqz]

@@bhanuprakashrao1460 exactly.

[@truthteller4442]

@@bhanuprakashrao1460 Thats immaterial and does not matter. The main point is that one simple passcode should not have the power to lock you out of your entire online ecosystem.

[@boydseabiscuit2635]

leaving your digital property on the hands of third party is the price to pay here. there's a reason why some companies still insist on offline backup.

[@Freakazoid12345]

Yeah, am I supposed to feel bad for people who waste money on over-priced phones while stepping over the homeless? 1st world problems.

[@Freakazoid12345]

@Pablo of what? Spoiled people complaining about minor things/their lack of foresight to the world? Why would anybody be jealous of that? Are you a child?

[@lubenovac]

Really dangerous flaw, it's a bad mix of total convenience and over security.

[@darioarias2966]

Not aware if anyone mentioned, but for the potential solution; you can change the screen time pin with the apple id which would render that method useless.

[@FoxHatLeo]

But the attacker doesn't know your Apple ID password, and they cannot reset it in the account screen as the screen time pin stops them, so this method would stop them.

[@prometheus200]

Very important news. Thank u

[@Glenn.Cooper]

I appreciate the heads up on this issue, and I agree that Apple can probably do more to prevent this problem. But - as I understand it - I think the iCloud account's encryption makes it literally impossible for Apple to access the user's data without the local encryption key, effectively now in the control of the thieve. On this part Apple should NOT make a change - I love their security even if it can bite someone bad on rare occasions.

[@neil78b]

They already have measures in place for the incredibly paranoid that think they'll be in that .0002% of people that this happens to, it's called screen time. Lock Apple ID changes and passcode changes through Screen Time which you set a completely different secondary passcode...Settings>Screen Time>Content & Privacy Restrictions>Account changes> Don't Allow So even if the thief somehow gets your first passcode he/she can't do any changes without the second one.

[@smallqwaro]

The way they set it up is just so stupid imo

[@africa_everyday]

Apple can access ur icloud account very easily. Remember, they provide the encryption

[@nikkipoo337]

There are still breadcrumbs leading to the recovery key even if some of you do what is suggested to keep it safe as some of the comments have already pointed out. Unfortunately current and new thieves are also watching this video to see how they can improve on their thieving skills. I see this video as more of a wake up call for some to focus on extra security protection barriers within your phone as well as within the apps used on the phone making it difficult to steal information which is more valuable to thieves than the phone itself.. Remember, even backups need backups….

[@ropro9817]

Great story and Apple's army of lawyers will, of course, never admit any fault. Could you do a counterpoint story about how all this works on Android phones? 🙏

[@chillinJohnny]

does't it work the same? like with the samll diffrence that you cannont generate your password to a found phone? like if you know the password to someones phone you can do exactly this same

[@Danny...]

It doesn't work the same at all. You can log into your Gmail from another device or recover your Gmail from another device. They can steal your phone but not your whole life.

[@Freakazoid12345]

I've lost access to countless accounts for calling out child abusers online. Never trust your information to be stored online or on an over-priced portable device.

[@Elyasafmunk]

Google is much more apt to accepting other ways to login and access account

[@flyicestormpluto]

Thanks or a great follow-up vido! The front-door analyogy really worked for me

[@dcuoffendinghabits7949]

Have they added additional features so this can't happen to anyone else?

[@Isletfemme]

Did he ever get back his information? Is there a follow-up since this was aired?

[@j10001]

He’s never getting it back. It’s encrypted with the recovery key the thief created. 😢

[@mrki731]

THIS is REAL journalism!!! Unlike all the other Apple sheep KZbinrs 🏆🏆🏆🏆🏆

[@classickid324]

Just a heads up there is a way around the screen time… I’m not going to say it for obvious reasons… However it should slow them down (assuming they do not know the way around screen time).

[@LLOCKDOWN]

Yes. And it’s very easy. It is not a solution. Apple have to fix this ASAP

[@smallqwaro]

You don't need to hide it lol, I'm sure anyone doing this knows about it already. Just find a way to keep your stuff safe.

[@LLOCKDOWN]

@@smallqwaro yes, but still… there are new scammers and thieves emerging everyday. And it’s better not to make a step-by-step tutorial for them. By the time they try to figure out how to reset screen time, the owner of the phone could find a way to access their iCloud and lock them out

[@reddbendd]

They provide you with an option to use physical security keys

[@susanberdan1626]

That beautiful little angel. This is one of the worst . Please deal with them in a similar matter .

[@yeetedandi]

I used to work at an Apple authorized Geek Squad and I probably had around 200 customers in the two years who unfortunately were locked out by because of the record key. The only other way was if they had a physical sim we could move to another phone and get the sms message code. 2/10 customers were frustrated, dissatisfied and confused at Apple.

[@kyle7574]

Great reporting

[@iLuseMy1v1s]

Just use biometrics especially in public. The only time i use my pin is when i restart my phone and it's required.

[@lightyagami3492]

The issue with biometrics is that the police can compel you to unlock your device without a warrant. Yes that would be a uncommon occurance for most but its something to consider.

[@iLuseMy1v1s]

@@lightyagami3492 Just restart your phone, it requires a passcode to unlock it at start up.

[@kapadiaresidence]

This screen time setting won’t work if you have the apple support app installed on your device. You can change the Apple ID password through the apple support app.

[@j10001]

Thanks! Great point!!

[@Praveen-or5ce]

Excellent job. Hope Apple will find solutions for this

[@Jibril_Abdulkadir]

There’s also recovery phone contact and that can be removed so it feels like they can get into everything let’s say you lock your notes app and have recovery key in it not only they can change recovery key but can you’d phone passcode to get into that note to remove everything

[@natashamartin194]

One thing that apple should include when changing the iCloud password is for users to type in the old password before making a new password. This won’t allow thieves to be able to change your iCloud password cuz they won’t know your old password. Also ensuring that it’s the owner of the phone itself that’s changing the password and not any one else.

[@gabor1991]

The point here is that Apple cannot give you access to your data. It is just not possible, because your data is encrypted with that recovery key or your password. So it doesn't matter if Apple takes other forms of verification. It is physically and practically impossible to unlock the account for you or for anyone else. That the recovery key and password can be so easily changed on device is what Apple needs to work on.

[@lightyagami3492]

Exactly. The recovery key is a great feature to encrypt your data so that only you have access to it. The issue is that recovery key can easily be changed and thats what apple needs to fix.

[@youtubeuser8426]

Imagine being held at gunpoint and having to decide between losing your entire digital life or your actual one. This is the nail in the coffin for iCloud for me, which was already perilous enough from a data integrity perspective.

[@ptbauro]

Quick question ( I'm not an iPhone user btw ) : How can the thief steal your phone AND your passcode?

[@MubashirAR]

Funny enough, one of my colleagues recently shared how as an Android person he learnt about iCloud locks on iphones and realised this couldn't be done on Android (you can just flash a custom rom) and later switched to iphone. This is even worse than losing a phone. As long as there is tech, there will be exploits

[@elmalleable]

you can turn disable lock and presently (but i have not flashed roms in so long) you will need the enable some settings before you can get into the menu to flash roms, may or may not be still accurate

[@mutchlouis9707]

How about switching from apple ?

[@TomoJSnapey]

Having a security key linked to your AppleID seems to resolve most of these issues.

[@22745]

It is possible to disable the screen time password with the iPhone password too

[@smallqwaro]

Turns out you can change that too with the phone number, smh

[@indianmedic]

Would you have to put a lock on find my phone as well then ? Like screen time ?

[@TheWorld4all]

Good Job, Apple. Keep it up~~

[@el4266]

This video is so helpful!! Thanks.

[@ECty68888]

I found a major bypass with this security tip of using different pin to block settings changes. The bypass is the Apple support app which lets you change passwords etc without having to enable changes (thereby entering new unique pin)

[@harrrambae]

should i provide my apple id on the screen time passcode?

[@crp5591]

This is an issue of education. And I have seen MANY posting on the solution (including myself) on the prior installments of this WSJ series. NONE of this would be an issue if people properly used Touch / Face ID. BUT they have to be educated on both USING it AND setting it up! And I know there will be those that say "Touch / Face ID does not work, I have to keep entering my passcode, etc. etc." Again... Non-issue. Set it up correctly and you will not have issues. It's all about doing it correctly. For touch ID, use multiple fingers the way iOS guides you through it. For Face ID, hold phone ahead of you and slowly rotate your head while looking at the phone. Save multiple "looks" with / without glasses, hats, hairstyles, etc. I can't tell you how many clients I've had to convince to USE touch/face ID and have had to dispel people's fears about using biometrics. These are complex devices that have access to our lives. Lots to educate people on, BUT ABOVE ALL, USE BIOMETRICS!!!!!!!!!!

[@kyshonjack5483]

We’ll said. Thank you.

[@crp5591]

@@cidercreekranch You're not wrong but again, it's a matter of education. SOLUTION: Use the emergency lock function on the phone that disables biometrics in a law enforcement situation. Two ways to do that. ONE: Enable emergency mode by quickly pushing sleep / wake button 5 times. This triggers emergency mode and DISABLES biometrics. TWO: Say "Hey Siri, who's phone is this?" (if law enforcement grabs it from you before you can use method one) It will answer with owner's name and DISABLES biometrics ("Hey Siri" has to be configured in settings for this second method to work). If you are not rushed, simply powering off the phone will achieve the same result as next time it is powered up, biometrics are disabled until unlocked with your lock code.

[@GreenStorm01]

You clearly haven't understood the issue. Also: FaceID does also require a passcode. And using physical attributes you leave by the hundreds all day on things you touch is really... just a bad idea. It all comes down to the threat vector one is trying to defend against.

[@crp5591]

@@GreenStorm01 Touch / Face ID ONLY requires a passcode on reboot OR if it fails because someone else has tried to unlock it with their face a few times and locks out the phone. Face ID does NOT require one to enter a passcode for each unlock during normal daily use. And that is the point here. Touch / Face ID, when used properly, does not require one to enter the passcode each time you pick the phone. It becomes the secondary backup unlock method.

[@GreenStorm01]

@@crp5591 Having FaceID set up already requires a passcode.

[@ast3r0idb612]

These loopholes need urgent action. How about considering the "Picture Password" as additional/optional security feature BlackBerry had before? 6-digit code is not secure enough.

[@housepianist]

I’ve now taken the extra precaution of protecting my iphone and ipad. One thing that a user could do, and admittedly it would involve some work, is to backup all your photos and other important documents to an external HD or SSD and then delete those things from your Apple devices. You can keep essential ones on your devices but as long as they are backups externally, and not on your devices or in an icloud account, they should be protected. You could also store your photos on a non-Apple cloud service that you can access via the web and not an app. That way, if your phone gets stolen, a thief won’t know if you have another cloud service if you don’t have an app downloaded for it.

[@Clark-Mills]

Retina scan... is that where you sit on the photocopier?

[@salhotra28]

Thanks 👍🏻 👏🏻

[@wlonsdale1]

Build a NAS or use a usb stick for backup

[@AndersonChan]

So basically the underlying flaw is with traditional pins and passwords. It's slightly concerning to have account data protected by just the passcode to the device.

[@Nextburjalarab]

But this is all reliant on the thief having your passcode… how do they get this if you use Touch ID or Face ID?

[@crp5591]

It's because people either don't use touch/face ID OR they did not set them up correctly and thus touch / face ID repeatedly fails and prompts for pin.

[@ericrobinson2042]

This just happened to me and I lost over 20,000 photos 2,000 videos. The last pictures of my dog before he passed away, the last voice messages from my grandparents before they passed, all my photos from my travels around the world just gone. Apple was able to verify that I was who I said I was on the phone but would not revert my Apple ID back to the original email and allow me to change the password. It's heartbreaking. I'm at such a loss.

[@krystalzzz9415]

This just Happened to me on may 22! It boggles my mind that Apple does not do anything in cases where theft is evident. I just want my pictures back 😢

[@7billza]

The problem with her "screen time passcode" solution is that now if the thief knows your iPhone passcode, they can go to change screen time passcode, choose 'Forgot passcode' which will require you to login Apple ID, choose forget password, input the Apple ID (which can be found relatively easy if you have access to the phone already), choose to verify using iPhone's passcode (which they obviously have) and voila, you can turn off the screen time passcode and continue the steps in this video.

[@lightningblender]

You can simply click abort when it asks you for creating the recovery option. But then you should never forget your screen time PW.

[@blazealoy7041]

any solution to this then?

[@7billza]

@@lightningblender I have tried that as well but it will ask for the Apple ID and you can click around to eventually remove the passcode with the phone's passcode. Try it

[@PSy84]

@@7billza that’s why apple id should never be seen like dont allow account changes, passcode changes…and use esim so it can be notified as lost item. Trusted phone number should never be the iPhone itself! Always use a phone number that’s always at home

[@7billza]

​@@blazealoy7041 Nope. Screen time was never supposed to be used for this purpose. It's meant for parental control, which is stupid considering even if you use another Apple ID to lock the screen time, you could still find a way to use just the device's own Apple ID to turn it off. I guess for controlling your kids' screen time it's not that big a deal if they found this loophole, but for securing your digital life from thieves, not so useful. The only real solution is for Apple itself to implement a more secure method of account recovery. What you can do though is to use FaceID as much as possible, be very careful when inputting your passcode in public, and don't set stupid passcodes like 1234.

[@briantdaniel9280]

Can Apple improve on this? Of course! Can the average iPhone user be more proactive in protecting themselves? Absolutely! If you have to enter your passcode for ANY reason, make sure 100% that you are trying your best to cover and hide your hand. The first defense in protection from thieves is yourself!

[@ThomasRose-mu9vg]

Lot of work for a phone glad I old school no thank you Apple 🍎🍏