Hacker News Reader

Comment by Canada | Hacker News Reader

The other day my friend lost his iPhone. He tried to use my Android to find it, but Apple's site just says it's unsupported. Really thoughtful of Apple to make that feature unavailable right when users need it the most.

View on HN

Let's put an emphasis on the fact that this cannot be a technical limitation, as everyone else in the world manages to build websites that work on most devices, including android.

The appleid is a security nightmare anyway. I used to use an account, associated to an email I own, with a password I know, and still I can not log in, because it keeps asking the insecure "personal questions" that I never answer, because [generic privacy statement] and because I use a cryptagraphically secure password manager. As I did not save the personal questions I answered when signing up (tbh I probably just put garbage, as those are usually never asked when you know the password), and now I just cannot access it.

That's right, I own the email address and I know the password, and yet I cannot access my account. However, knowing who was my best friend when I was a teenager, or what was the name of my first pet are questions, in spite of being known by dozens of friends or acquaintances, that Apple requests as security measures needed to trust me as the owner of the acount. Having them on the phone provides zero help, 1 year later, I still cannot access it. It's definitively lost, and I feel happy I do not have any important information stored on the apple cloud.

Minor side note: do not put garbage into the answer boxes, use a completely random but plausible answer. One attack vector that is enabled by using random strings as response to "security" questions is telephone support: "I definitely did not answer that question, I just put garbage in!" Sadly, sometimes that works.

Very much this. I have made a point to give somewhat legitimate answers to these questions out of fear that a phone agent would ask them someday and that I could fall victim to exactly what you describe.

Phone agents don't always have to actually enter the security questions to access your account. sometimes they can simply see the answers on their screen and are able to make a judgement call. Don't trust humans, especially not humans who are incentivized to help you as quickly as possible.

Also its easier to say a word over the phone than it is to say a random string of letters numbers and symbols.

Just use a password generator to generate a space-separated phrase.

Had the same thing, actually knew the security question answers as I had logged them. But according to the fine website they were wrong. Called apple. First time they told me "too bad" (took me about an hour to get that answer)

Called them again and another apple employee pointed out that as long as you can login, you can enable 2FA via iCloud (something I'm not using either). Once 2FA is enabled the security questions can be bypassed. Not sure if that required them to change a setting, but from then on you _should_ be able to change anything else, including the security questions or assign another email address or add an extra one or..

Thanks for the tip!

After reading this, I tried it and it didn't work. Even jumped on a call with support and they told me there is no way to turn on 2FA without the security questions (at least for my account, maybe other accounts can).

The shitty thing is you also delete your account or create a new one with the same email without knowing the security questions.

Oh well :/

Still, thanks for the hope (short-lived as it was).

Strange as I can assure you that this is how I recovered the account. This was on macOS Sierra which might be part of it then System Preferences -> iCloud

The first apple support person I talked to did not know how-to recover the account this way. So it does not seem to be in the scripts.

Just a general warning, if you leave two factor on for a set number of days (I can't recall the exact amount), it is impossible to turn off again.

Apple's backend systems are a shit show. They work in a specific set of requirements but outside of their specific situations or via tech support are effectively useless.

It's inexcusable how bad the iCloud system is, especially regarding authentication, however, I will note that if you enable 2FA you don't get an any of that security question nonsense anymore. (Yes, I know that you can't enable 2FA, but perhaps it is useful to someone else reading this).

Damn, it seems I really dodged a bullet here. I was recently asked for security questions logging into a company account (iOS management account). Whoever created the account only jotted down the answers to two of the questions. It asked for precisely these two, and I was able to change the other without answering the third..

I've given up and just started giving the same answer for all security questions.

I'm sure your password manager can save Security Questions? In mine I can add as many field as I want, so for every login that require security questions I answer them with 50 characters gibberish, and save them for later use.

Then when someone calls and they ask for the security question, the attacker just says it’s jibberish and they let them through. Choose 4 random words, not 50 random characters

If you saw my comment below, this is exactly the same issue I have. It's stupid, and I don't think I ever added security questions to begin with when I signed up to iTunes over 10 years ago.

I have the same issue with my TD Ameritrade account. I have the correct email and password, but then it asks for a security question that I have no idea about. I can’t get in.

if you're talking about the iCloud website, switch to "Desktop Mode" on your phone and it will work for the "Find my iPhone" application on there.

source: lost my phone and went full panic mode when it said "unsupported" and fiddled around with it for 30 minutes on an android phone

Oh boy, scrolling through that page in mobile is a nightmare.

Exactly, not sure why the parent commenter couldn't do this.

It’s kind of insane that they do that considering the majority of phones are androids. It means many people are almost certainly going to need your laptop which really limits how it can be used.

> considering the majority of phones are androids.

This is one of the ways they are trying to change that.

It doesn't make sense that making it harder to use a feature of an iPhone would make more people want to use an iPhone. It seems unlikely that someone sees someone struggle to find their lost iPhone via an Android device and think "This makes me want an iPhone more"

"I'm glad I have an iphone, this android is rubbish"

I doubt it. Apple don't care about having a high percent of the market. They're happy so long as they have the high end in their pocket. That's where the big margins are.

They're happy to leave the high volume lower end to the likes of Samsung.

I just found out all new iCloud accounts require your mobile number for 2FA.

A friend is in a study abroad program and broke his iPhone. He bought a new one but can’t access his account because he no longer has a “trusted device” (his broken iPhone) to verify his login and since he’s overseas, can’t get the fallback SMS.

He basically has to wait until he returns.

So he set up 2 factor authentication, does not have access to one of the factors and now he can’t login? How is that Apples fault?

Note that you can also set it up to call you instead of sending texts; I presume he can take calls otherwise I don’t understand why he even took a phone with him.

He did not set up 2FA willingly. It is now required for all new Apple accounts.

He tried to find a way to disable it, but it is no longer possible.

If Apple had a 2FA method where he could use another email, that would have solved the problem. Or even using an app like Authy or Google Authenticator.

He is overseas, with no global roaming, and so is unable to receive calls or texts.

He took his phone because he planned on getting a local SIM card.

You can actually add more than one number so he could have added a family members or friends number. He might also be able to use the recovery procedure from this link to regain access after a waiting period:

https://support.apple.com/en-us/HT204921

Yes, if he had known this would happen, he could have done all those things.

Or if Apple did not force 2FA on new accounts, then this also wouldn’t have happened.

But they do and for very good reasons. Too bad your friend got caught in the cracks but it’s his own fault.

> since he’s overseas, can’t get the fallback SMS

This is one of the reasons I purchased a mobile/cell number from Twilio to use as a backup for all of the websites that only support 2FA via SMS (Apple, PayPal etc.).

The 2FA code gets sent to a channel on my own private Slack workspace via a webhook [1]. If I lose my phone I can always log into the Slack website on another device to access the code.

[1] https://www.twilio.com/docs/studio/tutorials/how-to-post-sms...

Have you tested that it works?

According to this other recent HN comment, Twilio numbers cannot be used for SMS verification. Banks and Gmail are mentioned:

https://news.ycombinator.com/item?id=19219150

"I have this problem because my main, personal number is actually a twilio number (as I built my own personal telco within twilio) and this means I cannot receive validation messages from shortcodes (like a bank)."

> Have you tested that it works?

Yes. I wouldn't have mentioned it if it didn't work.

Here's a screenshot showing the Apple and PayPal 2FA codes I have received through Slack via Twilio...

https://i.imgur.com/bQYSbPZ.png

I also don't have any accounts with banks that are stupid enough to use SMS for 2FA [1] so I haven't needed to use my Twilio number for that purpose.

Using SMS for Gmail 2FA doesn't make any sense when Google supports U2F.

[1] https://motherboard.vice.com/en_us/article/mbzvxv/criminals-...

paypal also supports TOTP through an old trick. Look it up.

I tried to find the "old trick" but only end up on 404s or forum threads that end with "they must have closed that trick now".

Would you mind sharing a working source?

Perhaps they have close it now then. This was the source: https://medium.com/@dubistkomisch/set-up-2fa-two-factor-auth...

It's not shortcodes per se, those work fine for the most part.

Twilio/Google Voice (more generally, VOIP numbers) are explicitly being blocked (because it's possible to find out what type of number it is) at a number of services, likely to combat fraud.

I've found MSFT (Azure) and AWS to be recent examples of such services. Google itself does the same.

As further proof that I am not lying here's a screenshot from my Twilio messaging log...

https://i.imgur.com/6b3cg5L.png

62226 = PayPal and 51472 = Apple.

Apple's 2FA makes things much simpler for users who own multiple Apple devices (very easy to authorize a new iPhone from your iMac or iPad) but if you only have one, it's next to impossible to use reliably. You can't make a backup or use a third-party 2FA client, or a non-Apple device. They don't provide "traditional" TOTP two-factor authentication that you could use in many different TOTP-based authenticator programs.

edit: Mercifully, they at least allow you to enter the 'find my iPhone' section without needing the 2FA code.

It happened to me when I changed country and phone number, I couldn't identified my iCloud account.

I just follow the instructions on the login page that I did not have my device with me, and just entered my Recovery Key that was given to me when I setup 2FA.

It's as simple as that.

Mind you I use a password manager and keep all my login information in it.

Note that the “recovery key” is for the older “2 step verification.”

The newer “2 factor verification” does not have a recovery key.

I lost my Uber account since it got re-associated with a temporary prepaid SIM I used when traveling once, so now I'm cut off from 2FA. 2FA is a nightmare for users, but all the alternatives are worse.

> since he’s overseas, can’t get the fallback SMS

Why?

Many service providers silently fail to deliver SMS when one is roaming internationally, especially if not on a post-paid account

I think this must be a US thing, never heard of it in Europe.

Probably opted to buy a local SIM instead of using the one from his home country

Many service providers don't support roaming at all - especially on pre-paid accounts.

He doesn’t have international roaming.

I'm not sure that there is a subscription in Europe that doesn't include international roaming. At least I can't remember seeing one here in Norway. I suppose Europeans travel from country to country a lot more on average.

I've been using an Android app called XFi locator for the last couple of years whenever my wife loses her iPhone. Really simple and works perfectly.

I don't find this all that surprising, sadly - inside the Apple reality distortion field there are only Apple devices.

>> reality distortion field

Don’t attribute a seeming idiocy to something which is a clear sign of malice.

Reply on news.ycombinator.com