iOS 11 Security Concern

[Chazzle]

Do a full whipe. Download a copy of ios 11 to your pc/mac. Set your apple iphone/ipad in to recovery mode, and reinstall ios 11 via itunes.
Set up your device as new and Check if the issue is still there.
If the issue is not present, Than and only than reinstall a backup from icloud.

Already verified this with 3 other devices and looks like some folks on here are having the same issue.
No sense in going through all that, but thanks for the suggestion.

 

[Feenician]

As I recall, even prior to iOS 11, once you enter your password and authenticate yourself then it stays authenticated for a little while (not sure if it's something like 15 minutes or longer). That part of it isn't really new (and by design) as I recall.

I’m actually just waiting for a while before reporting anything, for that very reason. If it times out then I guess it’s fine.

Though it still doesn’t tell us why some are being asked for a password and some the passcode. I have a little hunch though (I’m seeing a surgeon about it). Can we all answer the following please?

iCloud 2Fa Enabled?:
Passcode Enabled?:
Type of passcode if enabled 4 digit pin/6 digit pin/complex pass:
TouchID Enabled (or FaceID)?:

 

[Chazzle]

I can replicate what you’re saying 100%. Lets get this reported to Apple.

Already did. Not good at all. A restart didn’t fix any of it.

 

[KGB7]

Already verified this with 3 other devices and looks like some folks on here are having the same issue.
No sense in going through all that, but thanks for the suggestion.

But some people including my self are not having this issue. You can either drive in circles or you can try an alternative solution. Its up to you.

 

[Feenician]

I’m actually just waiting for a while before reporting anything, for that very reason. If it times out then I guess it’s fine.

Though it still doesn’t tell us why some are being asked for a password and some the passcode. I have a little hunch though (I’m seeing a surgeon about it). Can we all answer the following please?

iCloud 2Fa Enabled?:
Passcode Enabled?:
Type of passcode if enabled 4 digit pin/6 digit pin/complex pass:
TouchID Enabled (or FaceID)?:

I’ll start then

iCloud 2Fa Enabled?: Yes. Prompted on other device
Passcode Enabled?: Yes
Type of passcode if enabled 4 digit pin/6 digit pin/complex pass: Complex pass
TouchID Enabled (or FaceID)?: Yes

 

[Chazzle]

But some people including my self are not having this issue. You can either drive in circles or you can try an alternative solution. Its up to you.

Sounds like your device is the odd one out.

 

[C DM]

iCloud 2Fa Enabled?: Yes. Prompted on other device
Passcode Enabled?: Yes
Type of passcode if enabled 4 digit pin/6 digit pin/complex pass: Complex pass
TouchID Enabled (or FaceID)?: Yes

iCloud 2Fa Enabled?: No
Passcode Enabled?: Yes
Type of passcode if enabled 4 digit pin/6 digit pin/complex pass: 4 digit PIN
TouchID Enabled (or FaceID)?: Yes

(Perhaps it has to do with 2FA/2SA?)

 

[JerseyDoug]

Same issue here. I was not asked for anything besides my passcode for my phone to change my Apple ID password.

Now here’s the icing on the cake.

I entered my passcode to see what the next screen showed, which is a screen to make a new password. However, after tapping cancel, locking my phone, and even fully closing the Settings app, I can get back to the password change screen without entering my passcode again. It skips that step and brings me straight to the password change screen.

Not good.

Same here. Exactly as you describe.

 

[Chazzle]

I’ll start then

iCloud 2Fa Enabled?: Yes. Prompted on other device
Passcode Enabled?: Yes
Type of passcode if enabled 4 digit pin/6 digit pin/complex pass: Complex pass
TouchID Enabled (or FaceID)?: Yes

2fa: Yes
6 digit passcode enabled
Touch ID enabled.

 

[Feenician]

(Perhaps it has to do with 2FA/2SA?)

I think it might well be. The password vs pin piece at least. If you have 2fa then you already went some way to proving you are you by that point by entering the one time code.

The “stays logged in for a while” part some of us just didn’t know about.

 

[jgelin]

I believe that this was added intentionally in beta 3 or 4, and was included in the release notes as a new way to reset the iCloud password. I thought this was a bit of an issue when I read it then, and still do now.

 

[JerseyDoug]

As I recall, even prior to iOS 11, once you enter your password and authenticate yourself then it stays authenticated for a little while (not sure if it's something like 15 minutes or longer). That part of it isn't really new (and by design) as I recall.

Not sure about the part of not being asked for the actual password and instead for just the passcode. I'm not only asked for the password but a lot of the time I'm even asked to answer a few of my security questions as well.

Just tried again and apparently enough time had passed that I was asked for my passcode (not password) to change my password. So, your recollection would be accurate from my experience.

 

[C DM]

Just tried again and apparently enough time had passed that I was asked for my passcode (not password) to change my password. So, your recollection would be accurate from my experience.

And it's starting to sound like the whole passcode vs. password part of it might be related to 2FA/2SA.

 

[jgelin]

Just tried again and apparently enough time had passed that I was asked for my passcode (not password) to change my password. So, your recollection would be accurate from my experience.

Yeah the time out has to do with the Secure Enclave thing being authenticated already so until the timer runs down you are 'you' on the device. Once timed out you must re-authenticate.

 

[Feenician]

Alright, alright. Looks like we’ve collectively solved the Scooby Doo mysteries. They would’ve gotten away with it too if it wasn’t for us darn kids etc. etc.

I believe that this was added intentionally in beta 3 or 4, and was included in the release notes as a new way to reset the iCloud password. I thought this was a bit of an issue when I read it then, and still do now.

I’m not hugely concerned about it but it does seem a bit pointless.

 

[simonsi]

Do a full whipe. Download a copy of ios 11 to your pc/mac. Set your apple iphone/ipad in to recovery mode, and reinstall ios 11 via itunes.
Set up your device as new and Check if the issue is still there.
If the issue is not present, Than and only than reinstall a backup from icloud.

Unlikely to be a bug as a msg pops up explaining why it works that way. That is a designed feature and unlikely to be changed by a different update/install method.

Id check your AppleID settings on the web, Id suspect its controlled by a setting there, not on a single device, or it could be an interplay of 2FA and some other security feature.

It definitely isnt something that should be set like this by default...

 

[JerseyDoug]

I’ll start then

iCloud 2Fa Enabled?: Yes. Prompted on other device
Passcode Enabled?: Yes
Type of passcode if enabled 4 digit pin/6 digit pin/complex pass: Complex pass
TouchID Enabled (or FaceID)?: Yes

Mine is same as above.

 

[KGB7]

Unlikely to be a bug as a msg pops up explaining why it works that way. That is a designed feature and unlikely to be changed by a different update/install method.

Id check your AppleID settings on the web, Id suspect its controlled by a setting there, not on a single device, or it could be an interplay of 2FA and some other security feature.

It definitely isnt something that should be set like this by default...

But i dont have that issue on two devices.

What would you like me to do, to intentionally force the issue so i can replicate it?

And what is 2FA?

 

[JerseyDoug]

But i dont have that issue on two devices.

What would you like me to do, to intentionally force the issue so i can replicate it?

And what is 2FA?

two factor authorization

 

[Feenician]

But i dont have that issue on two devices.

What would you like me to do, to intentionally force the issue so i can replicate it?

And what is 2FA?

This is where when you sign in another device has a popup with the location of the request and asks if you want to approve it. If you say yes it gives you unique code to put in. This is the "something you have" component of security, then with your pass code being the "something I know".

I'm guessing you haven't enabled it, hence why you're asked for your iCloud password instead.

 

[KGB7]

This is where when you sign in another device has a popup with the location of the request and asks if you want to approve it. If you say yes it gives you unique code to put in. This is the "something you have" component of security, then with your pass code being the "something I know".

I'm guessing you haven't enabled it, hence why you're asked for your iCloud password instead.

Correct, I dont have two-factor authentication enabled.
Does it make a difference in this specific scenario? i had it enabled before, but it was a pain in the butt to deal with so i disabled it.

 

[NoBoMac]

(Perhaps it has to do with 2FA/2SA?)

That's my guess. I have 2FA on and can change the password without providing old password.

If anyone wants to try an experiment: go to appleid.apple.com and change the iDevice to not be a trusted device. Guessing then one will get a screen asking for current/old iCloud password.

 

[Feenician]

Correct, I dont have two-factor authentication enabled.
Does it make a difference in this specific scenario? i had it enabled before, but it was a pain in the butt to deal with so i disabled it.

I think because of the “something you have” pin code component those with 2fa enabled are only asked for their pin code in addition. Without it you get asked for the actual iCloud password. It’s not important in the sense they’re just alternative methods but 2FA is generally considered more secure. No big deal though.

 

[jgelin]

I think because of the “something you have” pin code component those with 2fa enabled are only asked for their pin code in addition. Without it you get asked for the actual iCloud password. It’s not important in the sense they’re just alternative methods but 2FA is generally considered more secure. No big deal though.

2FA will always be more secure since it’s a unique code one time use. The passcode is not uniquely generated, nor is it only good for one time.

 

[KGB7]

I think because of the “something you have” pin code component those with 2fa enabled are only asked for their pin code in addition. Without it you get asked for the actual iCloud password. It’s not important in the sense they’re just alternative methods but 2FA is generally considered more secure. No big deal though.

Just to be clear for my self.

There are two types of passcodes in the device. 6 pin and 4 pin. 6 pin is the same i see on the lock screen and in some settings. while 4 pin is only asked when i want to perform a major change to a device.
Are you being asked for 4 or 6 pin passcode?
Because that is where i always got confused with ios.