Reminder that when you take in a phone to get repaired you should back up the phone and erase all of its data. I feel like this type of stuff is common in smaller repair shops.
99% of the people just give the phone password to the tech. If I was a foreign intelligence service, I'd set up attractive repair shops around army bases and government offices (quick turn around, competent service, reasonable prices) and just mirror every phone that comes through. Most of it will be useless, but I'm sure that one can occasionally find some gold (in the form of documents or compromising material).
1) I would be surprised if that isn't already happening.
2) NOTHING is useless in intelligence work like that. It doesn't have to be directly and immediately useful, but you can learn an enormous amount through so called patterns or life analysis.
3) Information leakage via devices like this is an enormous problem. C.f., leaking the location of military bases through Strava logging or nuclear weapons storage information via flash card study apps
But if your phone's broken and you know you don't have complete backups, I can understand being hesitant to hit the remote wipe button.
- The victim isn't responsible for the crime committed against them, as shown by this verdict.
- It is common because it is under-prosecuted. Hopefully we can see changes there.
The victim isn't responsible, but often the damage really is irreparable, and you don't even know who is the criminal (your private photos are online. Now what?), so it's a good idea to make the crime less likely to happen. As always, it's an effort-benefit tradeoff.
Definitely true, this is something that companies responsible for handling private data need to be more vigilant at. Whether that be finding a means to restrict access to that data (which Apple should be doing), training and supervision, restricted access to internet, or whatever, there's definitely more preventative measures that should be taken to ensure that this doesn't happen.
> The victim isn't responsible for the crime committed against them, as shown by this verdict.
No one is claiming that a victim is responsible for the crime committed against them, just that there are strategies to mitigate risk. You should prepare yourself for how things are, not how they should be.
> It is common because it is under-prosecuted. Hopefully we can see changes there.
It's hard to say how common it is, but ultimately it's a crime of opportunity. Maybe they need to stick the workers in a faraday cage so they can't connect the phones to the cell network or wifi.
Apple should implement a "send for service" option that configures the device so that service can be done without exposing the customer's information.
All Apple customers for iPhones have an Apple ID. When the phone is in service mode, all the data is backed up to iCloud (irrespective of whether the customer has paid for it) and the phone wiped. The fact that an iPhone doesn't include at least as much iCloud storage as it has local storage for backup is ridiculous.
After repair, the data is loaded back into the device before being returned to the customer.
except that doesn't solve the problem if your phone is broken and you can't enable that option.
Oh wait.
There could be a special mode accessible which allows testing of standard use cases.
Naturally I told them to wait a minute to erase my phone, but the technician told me that I shouldn't bother because the phones are kept in a safe anyways. Naturally I have still politely asked them to wait until I erase the phone, but this might not be everybody's reflex.
Edit: clarification, this was in an official Apple Store
On the other hand, when I went to repair the keyboard for my MacBook Pro, they did ask for my password. I refused, and they just said they would have to wipe the hard drive and do a reset.
I guess it really depends on how responsible the individual "Apple Genius" is.
Hmm, care to elaborate? I found the process quite easy, and done it multiple times. One thing that comes to mind is that if you don't have the iCloud backup option on for any reason, and you don't have a mac. Then you need to go through Windows iTunes which is really subpar. (no idea what to do on linux except a VM)
I don't really complain about the need to reset the phone, I'd like them to be more consistent with the messaging thouhg.
My threat model is low risk enough that I trust the full-disk encryption of my phone. So it makes sense for me to send my phone in with all of the data to avoid the reinstall.