<story><title>Apple&apos;s new iPhone security setting keeps thieves out of your digital accounts</title><url>https://www.theverge.com/2023/12/12/23998665/apple-stolen-device-protection-face-touch-id-icloud-account-vulnerability-ios-17-3-beta</url></story><parent_chain><item><author>gojomo</author><text>After a iPhone theft in Europe earlier this year, I don&amp;#x27;t quite trust Apple&amp;#x27;s assurances with regard to stolen iPhones.&lt;p&gt;My phone was snatched from my hands in the street. I was able to wipe it via &amp;#x27;Find Devices&amp;#x27; within a few minutes; I was able to track its location for the rest of the day, until I requested that my carrier irrevocably disable its network service. There was no evidence of any accesses of my information or accounts linked on the phone, then or since.&lt;p&gt;In the following days, it was still visible in my Apple device lists as mine, with reference information like its model and serial number – as it should have remained, indefinitely, to prevent anyone else from associating it with their accounts. (Until recently, I still had an iPhone 4 listed there that hasn&amp;#x27;t been turned on for many years.)&lt;p&gt;But sometime since then, it was removed from my Apple account – without my permission, and with no notification to me. This step would also apparently allow someone else to use the device with Apple services.&lt;p&gt;Apple Support insists only a person who authenticated to them as me could have done that, and that they have no records of when&amp;#x2F;how that happened – a policy that seems designed to help criminals cover their tracks, with no help to customers other than: &amp;quot;you should change your password&amp;quot;.&lt;p&gt;Further, even if I provide the serial-number&amp;#x2F;IMEI with a police report, Apple says they &lt;i&gt;can&amp;#x27;t&lt;/i&gt; determine if they&amp;#x27;ve activated Apple services to that stolen property for someone else or provide me with any further help.&lt;p&gt;I thus suspect theft networks have figured a way around Apple&amp;#x27;s breezy assurances about locking-out stolen devices, perhaps similar to how they&amp;#x27;ve often deeply pierced major telecom providers in order to carry out SIM-swap attacks.&lt;p&gt;But: if anyone on HN knows more about how the smartphone theft&amp;#x2F;fencing (chop shop?) operations typically work, or how Apple&amp;#x27;s systems do or don&amp;#x27;t protect against post-theft hijacking of registered Apple devices, I&amp;#x27;d love to hear perspectives that either flesh-out, or refute, my impressions that Apple&amp;#x27;s related systems involve some false bluster &amp;amp; &amp;quot;security theater&amp;quot;.</text></item></parent_chain><comment><author>Zapped</author><text>Well I kind of did circumvent this hurdle.&lt;p&gt;I got an iPhone from a relative, the relative had forgotten the passcode and the Apple ID password.&lt;p&gt;I did a factory reset of it via iTunes and of course when it started up and I started with the setup it said it was locked to *&lt;i&gt;@*&lt;/i&gt;.com.&lt;p&gt;I contacted Apple support and they said I needed proof of purchase for them to unlock it.&lt;p&gt;I did not have any proof of purchase and neither did my relative.&lt;p&gt;But I refused to let that stop me. So I made a proof of purchase, printed it and went to an Apple store.&lt;p&gt;I told the Apple Genius about the iPhone and that it was locked but factory reset and presented the &amp;quot;proof of purchase&amp;quot;.&lt;p&gt;The Apple Genius went to get a manager or something and the manager checked the &amp;quot;proof of purchase&amp;quot; and then connected the iPhone to the store Wi-Fi and did some stuff on their iPad and rebooted the iPhone. The iPhone did a reset and then it was unlocked and ready to be setup without any hurdles.&lt;p&gt;So I am guessing some thieves have figured this out.</text></comment>
<story><title>Apple&apos;s new iPhone security setting keeps thieves out of your digital accounts</title><url>https://www.theverge.com/2023/12/12/23998665/apple-stolen-device-protection-face-touch-id-icloud-account-vulnerability-ios-17-3-beta</url></story><parent_chain><item><author>gojomo</author><text>After a iPhone theft in Europe earlier this year, I don&amp;#x27;t quite trust Apple&amp;#x27;s assurances with regard to stolen iPhones.&lt;p&gt;My phone was snatched from my hands in the street. I was able to wipe it via &amp;#x27;Find Devices&amp;#x27; within a few minutes; I was able to track its location for the rest of the day, until I requested that my carrier irrevocably disable its network service. There was no evidence of any accesses of my information or accounts linked on the phone, then or since.&lt;p&gt;In the following days, it was still visible in my Apple device lists as mine, with reference information like its model and serial number – as it should have remained, indefinitely, to prevent anyone else from associating it with their accounts. (Until recently, I still had an iPhone 4 listed there that hasn&amp;#x27;t been turned on for many years.)&lt;p&gt;But sometime since then, it was removed from my Apple account – without my permission, and with no notification to me. This step would also apparently allow someone else to use the device with Apple services.&lt;p&gt;Apple Support insists only a person who authenticated to them as me could have done that, and that they have no records of when&amp;#x2F;how that happened – a policy that seems designed to help criminals cover their tracks, with no help to customers other than: &amp;quot;you should change your password&amp;quot;.&lt;p&gt;Further, even if I provide the serial-number&amp;#x2F;IMEI with a police report, Apple says they &lt;i&gt;can&amp;#x27;t&lt;/i&gt; determine if they&amp;#x27;ve activated Apple services to that stolen property for someone else or provide me with any further help.&lt;p&gt;I thus suspect theft networks have figured a way around Apple&amp;#x27;s breezy assurances about locking-out stolen devices, perhaps similar to how they&amp;#x27;ve often deeply pierced major telecom providers in order to carry out SIM-swap attacks.&lt;p&gt;But: if anyone on HN knows more about how the smartphone theft&amp;#x2F;fencing (chop shop?) operations typically work, or how Apple&amp;#x27;s systems do or don&amp;#x27;t protect against post-theft hijacking of registered Apple devices, I&amp;#x27;d love to hear perspectives that either flesh-out, or refute, my impressions that Apple&amp;#x27;s related systems involve some false bluster &amp;amp; &amp;quot;security theater&amp;quot;.</text></item></parent_chain><comment><author>meindnoch</author><text>According to my friend at Apple, sometimes fairly low level employees have access to the internal system which can be used to dissociate devices from AppleIDs. I wouldn&amp;#x27;t be surprised if some of them were compromised, as the pay is not great.&lt;p&gt;What&amp;#x27;s more surprising is if they have no audit logs that would let them discover the compromised employee in these cases.</text></comment>