If someone has access to the device, it is a much more dangerous situation. But that doesn't change the fact that if someone gets access to your iPhone and they know your passcode, they can pretty much lock you out of your entire existence with that passcode. There needs to be a second layer of security for situations like this. Period. The iPhone pin shouldn't have the far-reaching capabilities that it does.
Sorry this happened to you hope you had the phone blacklisted as it will prevent it being used by the gang responsible
But, this is essentially a solution for “I gave someone my phone and access credentials.”. I know it’s not being “given” in intent, but the end result is still the same. The process proposed could work, but if one takes care when entering their PIN, the “I gave someone my phone and access credentials” doesn’t exist anymore.
So, the first layer of security is FaceID. The second layer of security is the PIN (which should be entered in such a way that no one can see it being entered). So, a THIRD layer of security is needed for those that can’t handle the requirements for using the second layer.
In theory, yes. In practice, not necessarily. Phones are different in the sense that we carry them with us everywhere and use them in many public spaces, unlike, say, laptops. It is much more likely for someone to catch us entering our passcode because the nature of the OS is such that we are unlocking it every single time we pick up the device. Which is a lot. Maybe an even better solution is not to use our phones in public unless absolutely necessary, or not at all. But good luck getting people to do that.
Face ID is not a layer of security. It's just for convenience. The only thing anyone needs is the passcode to the phone. Then they can do whatever they want. This is a problem.
If violent attack is the course of action someone has decided to take, there’s NO SECURITY IN THE WORLD that can prevent that person from getting whatever they want from the target (especially if that target is adverse to pain). With a well wielded pipe wrench, even FaceID can be quite effectively defeated. And any 2 or 3 factor authentication can also be defeated as long as the pipe wrench is still in the vicinity and prepared to swing again. In that case, the attacker isn’t “stealing” anything so much as the user “giving” the credentials in an effort to avoid harm.
And this is PRECISELY what people are learning about through stories like these. That people are actively LOOKING to see what their passcode is. They don’t have to be an “important” person to be targeted… and that’s what most likely assumed.
With FaceID or TouchID most of the time. And, those folks are ignored by attackers because they’re looking for the easier target that JUST entered their PIN. And actually, now that I think of it, I would imagine that anyone LOOKING for folks entering their PINs can spot them easily, because everyone else is just picking up the phone and putting it back down (having unlocked it biometrically).
More like “Don’t use your PIN in public unless absolutely necessary” and “IF you do, take precautions to avoid it being seen”. And, I’m betting that one won’t need luck to get folks to do that, especially as stories like these are being reported more and more frequently.
Understood. Just another level of security is required for those that provide their both their device and their passcode to others, either intentionally or unintentionally.
Look, I agree with what you are saying, but that doesn't mean Apple shouldn't offer a better solution for these situations. Even if it is imperfect it is still better than what is there now, which is "passcode unlocks everything and there is nothing else that can be done except hide your passcode from everyone else."More like “Don’t use your PIN in public unless absolutely necessary” and “IF you do, take precautions to avoid it being seen”. And, I’m betting that one won’t need luck to get folks to do that, especially as stories like these are being reported more and more frequently.
what if some one urgently needs to reset a password. I don’t think time limit is the right way to it, coz some one can’t keep their passcode and device safe. I think they should have ability from second device to authenticate the password changes.
Agreed. It's not realistic for people to never enter their passcode in public where a camera or another person can see the way things work right now.
Perhaps they could implement a 24 hour wait period to changing the Apple ID password that can be bypassed within 5 minutes or so with Touch ID or Face ID when enabled.
Time limit forces a fixed duration wait, which isn’t best solution. May be they cam make opt-in for folks who want to wait extra time to reset passwords. Authenticating with two devices or needing both Pass code and iCloud password from single device is a good compromise.
First off,
And this is PRECISELY what people are learning about through stories like these. That people are actively LOOKING to see what their passcode is. They don’t have to be an “important” person to be targeted… and that’s what most likely assumed.
Some may not want to make a “big dramatic deal” of putting their phone under their jacket or a tablecloth to ensure no one is looking at their code fearful of what the folks they are out with would think. Stories like this should remove that particular bit of social anxiety. And the same for those that like to keep their phone handy next to them so they can see notifications as they happen. It means one can keep eye contact with the folks you’re with while also keeping tabs on those they’re not with. But NOW they can tell their friends that are not there that they kept their phone secured on their person while they were out, so they couldn’t respond as quickly.
With FaceID or TouchID most of the time. And, those folks are ignored by attackers because they’re looking for the easier target that JUST entered their PIN. And actually, now that I think of it, I would imagine that anyone LOOKING for folks entering their PINs can spot them easily, because everyone else is just picking up the phone and putting it back down (having unlocked it biometrically).
More like “Don’t use your PIN in public unless absolutely necessary” and “IF you do, take precautions to avoid it being seen”. And, I’m betting that one won’t need luck to get folks to do that, especially as stories like these are being reported more and more frequently.
