How iPhone Thieves Lock You Out Of Your Apple Account | WSJ

iPhone thieves around the country enable the recovery key to make sure the owners can’t get back into their Apple accounts—permanently.

WSJ’s Joanna Stern digs into why victims are forever unable to access their photos, videos, and more in their iCloud account. How can you prevent this from happening?

0:00 How stolen iPhone victims cannot regain access to their Apple accounts
1:01 How the recovery key works
3:20 Can you get back into your Apple account if you don’t have the recovery key?
4:12 How to prevent thieves from changing your recovery key

Tech Things With Joanna Stern
Everything is now a tech thing. In creative and humorous videos, WSJ senior personal tech columnist Joanna Stern explains and reviews the products, services and trends that are changing our world.

#Apple #iPhone #WSJ

[rinforthewin-ksvk]

Excellent follow-up, Joanna and the WSJ team!

[juan]

I have over 20, 000 photos on my iPhone that I have taken over the past few years. I feel for this man. I hope he gets his memories back :(

[harveybolton]

Props to the WSJ for shining the spotlight on this, hopefully it forces Apple to add some preventative measures in a software update and to create a process people affected by this can use to prove their identity and get the iCloud account back.

[InventorZahran]

So basically, Apple's big fail here was the idea of relying on the iPhone's passcode for anything other than unlocking the iPhone itself. Resetting the Apple ID passcode or regenerating a recovery key should require at least two factors of authentication, neither of which is the iPhone's passcode.

Also, when using Touch ID/Face ID to unlock apps within the iPhone, it should fallback to the app's log-in credentials if biometric authentication is not successful (instead of prompting to enter the iPhone's passcode).

[GamingWeekends]

Hi, you should also add the “Passcode Changes” to the list from screen time. If they have your passcode, they can also change your passcode. Without it, they can’t change it

[bluekeybo]

Apple should require the Apple ID password when: Changing the pin, changing the password. Apple should require both Apple ID password and phone pin if: changing your recovery key. In my opinion though, once you create a recovery key, the only way to remove it or change it should be by providing the existing recovery key. If you forget it, then that's it, you'll never get it back. So it's not a feature for everyone.

[Dfgbuiiyyyybb]

Your passcode can be a…
- 4 digit pin
- 6 digit pin for even more security
- An alphanumeric pass phrase for even more security.

There are even more enhanced security features such as hardware UBI KEY if you want but would you as the average consumer sacrifice the convenience?

[itsalltakenup]

The suggested fix also introduces other exploitable loopholes unfortunately

[seth]

lol why do they let you create a new recovery key without the old one?! They would be on firm footing if they said once you *choose* to create a recovery key it cannot be replaced. But letting people just erase and create a new one is ridiculous!

[priultimus]

I have a physical security key linked to my Apple ID. This would circumvent that. The whole point is for it to be the most secure option, incredibly frustrating you can bypass all this security with a 6 digit number. I wish I could disable changing apple ID passwords with your phone.

[scapella]

Big issue, glad you guys are bringing the spotlight on it, changing my settings now

[lachlanhunt]

That screen time settings can be trivially bypassed by going through the forgotten screen time passcode flow. Eventually, an attacker can get to a password reset screen, and there’s nothing you can do to prevent that. It is absolutely flawed and Apple needs to fix it.

[JeremyDeBose]

I dunno. Feels like these issues aren’t so much Apple or general tech “loopholes.”We can’t sit back and rely on a device to protect our devices and memories; we have to be smart and proactive and protect them ourselves, too.

[andersonsystem]

Great video thanks. Apple needs to protect their customers.

[mutunekk]

The big issue here is really the ability to make such significant changes to your security without any stronger safeguards than the PIN. My 5 year old is able to remember PINs just after 2 demonstrations - its really not that hard finding someone's PIN. I can understand why Apple did this... but for people who live in the Apple ecosystem this is really quite worrying. Luckly for the android users, Google OS is just not polished enough for this to be a problem.

[dominicrincker]

Wait!! Can we use screen time to limit any sensitive apps too!!?

[andresate]

So basically, a thief can only do this if they actually have ur first passcode and are able to use the phone

[ruzzelladrian]

Thanks, Joanna! The Screen Time lock tip has given me peace of mind.

[micahwilgus]

I’ve seen a comment on a previous YouTube video on how to make it harder for thieves to do this. You have to set a screen time passcode and then from there turn on the setting to prevent account changes so they can’t get into your iCloud account on your iPhone. You’ll also have to turn off of your email being accessed on the phone as well, because if you don’t and your email address on your phone is linked to your Apple ID they can just reset your Apple ID password. If they have the technical knowledge

[TheStrategyWargamer]

Joanna Stern is amazing. I love everything she does. A few years ago I got to meet other legends in the Technology industry like Nilay Patel, Dieter Bohn, and even the legendary Walt Mossberg. Was hoping Joanna would be at The event (it was the last CNTL WALT DLT podcast episode ) Hopefully I can meet Joanna one day and meet another huge legend.