Hacker News Reader

Comment by ipython | Hacker News Reader

On a similar note, my daughter and I share an iTunes account so she can have access to apps and music I purchased. She has her own Apple ID for iCloud.

One day, I receive a password reset notification for my personal Apple ID. I freak out, as I now have lost access to my Apple ID and imagine any moment now the attacker will wipe my devices.

Turns out my daughter was unable to download an app, so she went through (successfully) the password reset flow for my Apple ID! It’s definitely not obvious, but apparently you can reset the credentials for someone else’s Apple ID if that id is used for iTunes and the App Store on another device.

View on HN

Your daughter has and uses your Apple account, and you're surprised that she can reset the password? I'm really confused by this story, much less how Apple is in any way to blame or this is at all surprising.

As an aside, what you described is serviced by Family Sharing now. I have my wife and my four kids in my Family -- literally and from an Apple account perspective -- and they all have access to my purchases (and each others, unless the product specifically forbids it which is rare), my Apple One Premiere, etc. It's a wonderful system.

Apple family sharing didn’t exist when I started using the ecosystem and last time I tried using family sharing exclusively it wouldn’t share the purchased music and apps from my account with the other family members.

The behavior is confusing because there are two accounts on the device - her personal iCloud account and the App Store/iTunes account. One would assume that the password reset would reset her iCloud account and not the App Store account. Or at least I would have received some sort of notification on my devices which are logged into the iCloud account that a password reset is attempted.

I’ll agree that the situation is not ideal, but Apple has made the whole experience a big mess.

It shares (and maybe always shared?) music and apps. Not just that, can also share among family members, not just head to others.

It doesn’t auto-share, they have to express an acquisition intent (click Buy) and it costs $0.

Apple has done an amazing job making family sharing seamless across most kinds of scenarios, and getting devs to support the licensing model.

Only your devices should be logged into both accounts (your iCloud account and your iTunes account). You can then use family sharing and purchase sharing to share from the iTunes account to all of the accounts in the family.

None of your family members should be logged into anything but their own iCloud accounts.

Reply on news.ycombinator.com