iCloud Travel risks of tying your entire existence to your iCloud account

[cjsuk]

I thought it was time to ask a stupid question, so here goes:

So I'm travelling (solo) soon for a couple of weeks across 3 European countries. I do this on a regular basis and to considerably weirder places and have my iPhone with me. This is a principal device for dealing with flight bookings/tickets/emails/itinerary notes/payments/airbnb/travel documents backup etc. It usually gets an eSIM chucked in it which does data and I run off that and WiFi hop. When on WiFi I use it to push all my photos off my mirrorless up to iCloud as well.

However I started looking at tangible risks when travelling which come down to two things:

1. If it gets stolen.
2. If my iCloud account gets hosed.

So the stolen thing is pretty easy, but there's a couple of risks with this I can't seem to work around. Firstly, if it's stolen while it's unlocked or the PIN is observed by someone over my shoulder then it's game over even if I have stolen device protection on. The phone and the iCloud account are a write off. If it is merely stolen and they can't get into it, I thought hey I'll just buy another one and log in with that. Well I can't do that either because (a) my MFA devices (iPad, MacBook) are all at home and (b) the second factor is SMS and the SIM is in the phone that just got stolen. GAME OVER.

Now the second risk is if my account gets attacked remotely. This literally happened to a family member this morning and she still can't get into the account. Literally "someone tried to log in from Moscow" (no joke) and now her phone won't sync email and iMessage stopped working. If I'm in the middle of nowhere then I'm screwed. I can't MFA it again and I probably can't sign in at all if the account is compromised including resetting password. GAME OVER

Unless I have another exit plan, which I can't see, I can only conclude that relying on iCloud here is somewhat a mortal risk. Therefore I'm looking at ways out of this. Anyone got an exit strategy here?

Only thing I can see is to keep principal services isolated (email / password keychain) and put my keepass database into an encrypted zip file on my public web site (with essential travel documents/scans etc). If it's stolen, then that's it: I buy a crap android handset with physical cash/card, get it on wifi somewhere, sideload APKs for keepass, download the zip and decrypt it from password in my memory and set up email again and get an eSIM working.

Then I drift onto that being the default safe operating mode: no cloud, side loaded Android. And I can't really do that on iOS at all because you can't install anything off the store without an apple ID set up on it.

 

[MBAir2010]

There is no right or wrong or definite answer to this question,
we are at risk, but safe if we take the proper precautions.

my neighbor got hacked today as they locked her phone number
and they hosed several accounts while she was just sitting at home.
i think that was an android phone and a facebook hack.
therefore traveling or on the couch we can be vulnerable if we let out guard down

as a young traveler in the 1980's I was told never look vulnerable and always focus, as if you have been there beforepassport never outside, keep that in a safe or at the desk, money in sock, knive in a hidden but easy place to protect in case.
Spending time alone in 80's drug infested NYC helped going to Finland, Japan Argentina etc.without a problem....security wise, while within 6 miles from my house i was robbed in 1986.

Apple seems to have a better aspect on security than android but not 100%

i would the use the phone sparingly, never flaunt that and always be aware of your surroundings.
some wifi can be unsafe in some places while others stronger than the USA.

So be careful have fun and look stern n the middle of nowhere when someone approaches.

hope this helped somewhat

 

[chabig]

I thought hey I'll just buy another one and log in with that. Well I can't do that either because (a) my MFA devices (iPad, MacBook) are all at home and (b) the second factor is SMS and the SIM is in the phone that just got stolen. GAME OVER.

Not game over. Set up a trusted phone number.

Two-factor authentication for Apple Account - Apple Support

Two-factor authentication is designed to make sure that you're the only person who can access your account. Learn how it works and how to turn on two-factor authentication.

support.apple.com

 

[cjsuk]

Not game over. Set up a trusted phone number.

Two-factor authentication for Apple Account - Apple Support

Two-factor authentication is designed to make sure that you're the only person who can access your account. Learn how it works and how to turn on two-factor authentication.

support.apple.com

Yeah I have a trusted phone number configured. However that can be easily removed by an attacker if they have access to the device (no MFA on that)

 

[ATmahe]

Stolen Device Protection is already on, as you said.

Setup a secure phone password (code) with at least 10 characters, lower-/uppercase, digits, special characters.
Thanks to FaceID/TouchID you don't need that code that often anyway.

Add 2 FIDO keys to your AppleID.
One goes with you, one stays at home.

You could also get a cheap second iPhone as a backup.

This should basically nearly eliminate the risks you see.
That's how I usually travel.

 

[Arctic Moose]

Add 2 FIDO keys to your AppleID.
One goes with you, one stays at home.

This is the answer, but I’d get three, not two, and leave one with a friend or in a bank vault. (And of course the one that goes with you must not be easily stolen along with one of your devices.)

If you can leave it with someone you trust they can always use it to get into your account and do whatever you need them to do.

I’d recommend Yubikey 5C NFC which will work with practically all fairly recent Apple devices.

Use it for all your Google and Facebook accounts too.

 

[ATmahe]

This is the answer, but I’d get three, not two, and leave one with a friend or in a bank vault.

That's even better

 

[cjsuk]

I've got two NFC capable Yubikeys. Can distribute one in my bag / one on keychain. That might be an option. I got rather lazy and started using the iCloud keychain MFA which by definition is not an external factor. I should sort that.

Thanks all for the ideas / discussion so far. Eliminating these risks is my preferred option!

 

[chabig]

However that can be easily removed by an attacker if they have access to the device (no MFA on that)

I don't think that's correct. A thief can't sign in to myappleid.com.

 

[erihp]

I don't think that's correct. A thief can't sign in to myappleid.com.

they can do anything a legitimate user/owner can do if they shoulder surf (or otherwise obtain) your passcode before its stolen. then you are free to change the apple id password themselves.

this may be partly mitigated by stolen device protection, but with your passcode and access to information, they can cause a lot of other problems even without changing appleid. its a nightmare scenario really.

 

[Riovfo]

A cellular Apple watch might also be helpful for the stolen unlocked iPhone scenario. With the find my app on your watch you should be able to remotely lock and wipe your iPhone and you will be able to receive 2FA sms with it.
The yubikeys are probably the best choice since you already have those

 

[erihp]

A cellular Apple watch might also be helpful for the stolen unlocked iPhone scenario. With the find my app on your watch you should be able to remotely lock and wipe your iPhone and you will be able to receive 2FA sms with it.
The yubikeys are probably the best choice since you already have those

May work for a stolen physical device if you act quickly enough.

A clever/professional thief could revoke/remove devices from the stolen iCloud account to mitigate this means of account recovery or device wiping attempt.

This would also not mitigate against a sim swap, but there isn’t much that can. If you are targeted or in this position, it would be a nightmare.


Traveling with a backup phone prepped and ready to go with backup codes/bookmarked pages to manage accounts/important contacts… this is a very good idea generally, even outside of travel. You could turn on all of Apples Advanced data protection and lockdown modes until you needed to use it. That said, again an attacker can remove these devices from your account, and would render it useless for account recovery purposes.