Tell HN: Full macOS reinstall because Apple ID | Hacker News Reader

Tell HN: Full macOS reinstall because Apple ID

320 pointsadabaed269 comments

Hello! Just wanted to share what just happened to me, maybe some Apple SWE here can take a look at this. I recently changed my macbook and created a new Apple ID for the new machine. For work, I like to have a unique ID and not reuse old ones. The problem is that, today, after 2 days of "use" (the first time the laptop is charged is to reinstall everything), Apple decided without notification that my account should be blocked for "security reasons".

I tried to reset my password, but they blocked the whole account, it seems to me that they even deleted the account from the database as they could not locate the ID of other information (name, mail, etc.). Coming from another OS, one can imagine that you can swap two IDs and continue, but ... NO! Here you need to provide a password to log out, but since my account has been deleted, I don't have any password. Also, one can imagine that a +2000$ machine designed for "professional" users can actually recover from these types of errors using magic links or text messages. They wanted me to wait for an appointment with the service. Just to reset an account!!

Why did I reinstall all? Every 30 seconds, a message appears asking me to check the ID.

TL;DR: Adult human crying.

View on HN

PSA do not opt to login with your apple ID, it's an option when setting up the computer, you should never ever accept it. There's no reason to ever accept logging in with a non-local account (same for Windows but Microsoft is much more persistent in forcing this whereas at least it's relatively easy to not enable it on macs)

100% this. I've set up several new Macs lately. It's essential to skip any step that asks you to provide an AppleID unless you want a world of hurt.

If you want iCloud or Apple Music you can set those up with your AppleID later (I cannot imagine wanting iCloud but that's just me).

What kind of stupidly is this?

Did Apple hire the guy in charge of Windows 10 user accounts?

It could be the other way around: Microsoft hired the Apple guy and let them run wild.

To my knowledge, Apple has never tried to force a user to use it's cloud services. You just skip any step referencing a cloud account during setup.

This is not true of Microsoft.

>Windows 10 users are annoyed that Microsoft has hidden the local account option when setting up a new PC or reinstalling Windows 10. A user on a popular Reddit thread notes that the local account option is now invisible if the device is connected to the internet.

https://www.zdnet.com/article/windows-10-users-fume-microsof...

> Apple has never tried to force a user to use it's cloud services.

I would argue that making the use of cloud services be the default forces users who aren't aware that it's optional and especially when they don't know that there *are* real downsides to using it.

There is a huge difference between offering the option of a local account or a cloud account as Apple does, and removing the option of a local account altogether, as Microsoft has done.

The button to skip that step in Apple's setup wizard is even labeled "Set this up later" to make it clear that the user isn't giving up the ability to use a cloud account later by skipping the step during the setup wizard.

> The button to skip that step in Apple's setup wizard is even labeled "Set this up later" to make it clear that the user isn't giving up the ability to use a cloud account later by skipping the step during the setup wizard.

No, but on the other hand there are plenty of services where "later" means "nag me" and "stop functioning after a certain amount of time"

It would be better and clearer if Apple simply and clearly stated "iCloud account is optional and not required to use your Mac"

>on the other hand there are plenty of services where "later" means "nag me" and "stop functioning after a certain amount of time"

Offering an easily skippable option during setup is not the same thing as the intentional dark patterns common on other platforms.

>In this report, we analyze a sample of settings in Facebook, Google and Windows 10, and show how default settings and dark patterns, techniques and features of interface design meant to manipulate users, are used to nudge users towards privacy intrusive options.

The findings include privacy intrusive default settings, misleading wording, giving users an illusion of control, hiding away privacy-friendly choices, take-it-or-leave-it choices, and choice architectures where choosing the privacy friendly option requires more effort for the users.

https://www.forbrukerradet.no/undersokelse/no-undersokelseka...

I hate the fact that Apple kept asking me to accept the terms of service for Itunes. I have no intention of using Itunes. I would remove Itunes and many other Apple Crapware from my computer if I could.

Why did you install iTunes in the first place? It’s an optional download and doesn’t come pre-installed. To remove iTunes, drag it’s icon in the Applications folder to the recycling bin.

AFAIR, it's not an optional download. You can remove it, but it comes pre-installed. I even wouldn't be surprised if it comes back after upgrades.

In fact iTunes no longer exists in the last two macOS releases. It was split into the videos and music apps and the iOS recovery stuff was moved to finder. iTunes now only exists on Windows.

The iTunes store still exists though. Which is probably what the agreement stuff was for.

I haven’t tried it but I’d be surprised if you couldn’t delete any stock application. I’d try doing it through terminal and then as sudo or without SIP if that didn’t work. But this post describes a straightforward way:

https://apple.stackexchange.com/questions/47253/can-i-safely...

Install Little Snitch, and disable the built in allow rules for all of the Apple and iCloud stuff.

Each time an Apple process tries to connect, make a rule that says that app is never allowed to connect to any server, and set the rule lifetime to "forever". There are about 20-30 Apple processes in macOS that phone home even if you don't use iCloud, iMessage, or FaceTime, or the App Store. Once you block all of them your computer will be quiet on the network.

It could also be that cloud accounts on local computers are a bad idea and implementations will be bad no matter who does it.

Chromebook seems to work without constantly locking people out.

I had the same feeling about iCloud before I had a Mac and just a iPhone, but now that I have a Mac and that there are features such as “Sign-in with Apple” and “Hide My Email”, I can’t imagine living without. Apple Books is also a great eReader for PDFs and ePubs on macOS and iPad/iPhone which provides syncing across all devices. Not just the books themselves but also the chapters you’re at, bookmarks, notes, etc.

I suggest revisiting and if it’s not for you, that’s fine. But otherwise, yeah never sign-in with Apple.

At least they are not agressive about it, unlike Windows 10 or even 11 home which doesn’t even allow local accounts.

Apple Books also syncs position in your own epubs, unlike my new Kobo Sage which’ll only sync reading position in books you’ve bought from Kobo. I still love my Kobo Sage and feel like managing my library with Calibre is better than Apple Books. But the iCloud syncing experience with Apple Books is clearly superior. People give Apple a lot of shit for their built in apps not being great (which is a good argument against them having a monopoly on iOS) but at least they nailed Books syncing.

Some of their engineers must really love books, and others really hate podcasts.

Apple Books sends what you're reading, and how often, and when (and approximately where, via client geoip) along with your unchangeable device hardware serial number to Apple.

Remember when librarians basically revolted because the patriot act let the feds get library borrowing records without a warrant? Apple's Books app is several times worse. It's nonconsensual spyware, even if you use only your own local files and never engage in trade with Apple for ebooks.

Don't use it.

iCloud enables the (effectively unencrypted) iCloud Backup automatically on iOS, which sends a complete effectively unencrypted copy of almost everything on your device to Apple every night when charging.

Apple can decrypt the entire thing without you, your password, or your device. They do this when they receive a warrant, and they do this 20,000+ times a year for warrantless requests (no probable cause) from the USG, too. This includes all your photos (effectively unencrypted) and all your iMessages and attachments. Nothing really important on your iPhone is private from Apple.

Also, if your cc fails for whatever reason, you will get locked out of your Apple ID, and won't be able to log in to or use any of the services you use Sign in with Apple on.

Bad, bad tradeoff.

Is there a reason having a local login + apple services is much better than the “default” Apple ID login account?

Obviously this issue of needing to change accounts is problematic and I can see resetting your account password through your Apple ID to be a pro/con depending on the person. Is there something else I’m missing?

I believe they changed this in the last 6 months or year, but if you have an older ISO if Windows 10, and you don't have it connected to the Internet when you install, you can create a local account during installation.

There has always been a tiny skip button as well.

I read somewhere on Win 11 you have to Alt+F4 out to get local account

I’m totally in agreement that they shouldn’t hide the option to create a local account, but I’m relatively sure this isn’t true.

It’s entirely possible that something like this did exist in some earlier installer version but I don’t know that from a vague statement like this. Feels kinda like throwing Windows under the bus unnecessarily.

> When setting up Windows 11, disconnect your Ethernet cable, and then cross your fingers that you see a "I don't have internet" option when prompted to connect to a network. If you do, that's great, go ahead and click it, and use a local account. However, there is a good chance you won't see the option, as shown in the screen grab above. If that is the case, the folks at Neowin discovered that you can bypass linking to a Microsoft ID by pressing Alt + F4.

https://hothardware.com/news/bypass-windows-11-internet-setu...

AFAICR, they've removed the skip button in newer versions of the installer. You have to avoid being connected to the internet to create a local account now.

I did a Win10 install last night, the local account button has been removed. You also can’t go back to the screen where you connect to the internet and undo it. Luckily this was on a laptop so I was able to use the Fn key to kill the wireless. Only then did the installer let me proceed with a local account. I hate the way computing is headed…

I believe there’s an option on the account sign in page (under sign-in options or something) to allow you to create a local account. I agree it should be more clear, but at least it exists.

There is not. There used to be. They removed it. The only way to create a local account during install is to refuse to connect to the internet.

i don’t agree. the conveniences afforded by using my apple id for text messages and phone calls while i’m on my work computer is invaluable. on the other hand the windows id doesn’t ever get me anything of value. caveat: my thumbs hate the tiny keyboard so maybe i am particularly sensitive to this annoyance

I think the implication is that it's Ok to sign in to iCloud after the installation (and enable all the iCloud sync services). But the login account should be local only.

To the best of my knowledge, it does not make a difference whether you sign in on initial setup or afterward. The difficulties OP was describing, I think, are tied to activating the "Find my Mac" option in iCloud. Once you activate that, you cannot simply log out from iCloud without providing your password. Being able to do so would rather defeat the purpose of "Find my Mac" as a theft prevention mechanism.

So if you don't want the issues described, don't opt into "Find my Mac" (Personally, I'm quite fond of the option, but YMMV).

>i don’t agree. the conveniences afforded by using my apple id for text messages and phone calls while i’m on my work computer is invaluable.

You don't need to login to the laptop with your Apple ID to do that, you just need to put your account into messenger.

Unless that is a work number that's a big mistake, don't ever expose your personal text messages and phone calls to your employer - its a huge legal problem.

Fully agree. I always create employer-specific IDs — Apple, GSuite, Github, and so on. It typically starts from a company email address and fans out.

It confounds me how many of my colleagues don't do this. But when I explain my reasoning, nobody has complained.

I understand that Apple requires its own employees to use personal IDs, which is really messed up. That organizational design flaw probably contributes to situations like the one we're discussing, since it might seem abnormal to an Apple person that someone would be associated with multiple IDs.

Apple does not require you to use your personal ID on your company laptop, but they do require you to use a non-@apple.com email for an iCloud account (only really needed for Find My Mac, but you’re allowed to use other iCloud features if desired). Many people for expediency just use their personal account, but after various high profile issues in the news many have realized it’s worth the hassle of creating a second account (e.g. myname.work@icloud.com).

I wonder what Apple’s explanation/justification for this is?

Operating by fiat? Because they can.

One of the account recovery methods is to request that Apple email you an "unlock my iCloud account" web link.

If they were to send that email to your locked iCloud account, you wouldn't be able to receive it.

My guess would be that iCloud UX is designed around a lifestyle with a single account per person, and they want their staff's UX patterns to mirror their customers' as closely as possible.

When you wake up in bed you don't grab two phones, you grab one.

Apple doesn’t make it clear, but you can still get this without using the AppleID to log into your device.

When setting up, create a local account first. You’ll have an opportunity to later log into your AppleID for use with messages, FaceTime, App Store, etc.

You can also switch to a local sign in account after the fact. This may have changed in recent versions, but try going to system preferences and selecting to reset your password. You should see an option to switch to a local account for sign in, which will only impact the log in process. You’ll still be able to keep your id associated for all of the other benefits.

What on Earth are you talking about?

I have set up several MBPs from factory over the past ten years and it hasn’t ever been apparent to me that you could use your AppleID to log in locally.

I’ve attached every single one of these devices to my AppleID for iCloud but none of them have used anything but local credentials to sign in. And it’s been far from hard to do. It was—as best as I can tell—the normal setup path.

Regardless of what the author of the post you’re replying to said, there’s no need to strike such a needlessly condescending tone.

People ought to be allowed to have a personality.

People ought to realize they're talking to other people, as well, not cardboard cutouts with names like "mynameisvlad".

It's not hard to have a personality without being condescending.

Being condescending is not nice, but some people have it hardwired as part of their personalities. For example, people who suffer from Narcissistic Personality Disorder.

It wasn't condescending. It was bewildered.

I have never even noticed the ability to log in with my AppleID (as opposed to local authentication), but GP is arguing that Apple actively makes it difficult to avoid doing so. Something about that is wildly incongruent with my own personal experience and I am truly, genuinely confused.

I will acknowledge my language was not as precise as it could have been, but I did not say that Apple is actively trying to be difficult or does this in a way that is unclear to all audiences. They definitely do a heck of a lot better than Microsoft, who I believe has removed the local login option from Windows 11 Home.

However, the commenter I responded to did not realize this. Likewise, most of the non-technical Apple users that I encounter in my work make the same incorrect assumptions. I probably overcorrect a bit here, but I’ve learned that it helps to to validate the experience of the person I’m trying to educate.

To be more precise in my initial statement, I don’t think Apple makes this part of their interface as clear as it could be (or should be), and I don’t think they provide the average user with the information to understand the implications of using Apple credentials to sign into their device. I don’t assume that this is malicious. I’m sure they are driven some by benefits to the company, but I also suspect they think that this makes life easier for their users. There may be some truth to that, but I think it’s a poor default.

I work with small business owners and employees in the health care field (and teach as a University adjunct). At least in the health care context, there are compliance implications associated with these features (something that Apple Support and Genius’s often fail to understand as well).

In terms of the interface, when I’m working with a developer or tech worker, I consider the first-time setup and system preferences UI to be good enough. But I don’t think that’s true when it comes to a therapist, office manager, non-profit director, or even the majority of my undergraduate informatics students.

On a separate note, I do have thick of enough skin not to be bothered by this response, but I hope you consider some of the replies regarding the tone. In this type of forum, reframing that bewilderment as curiosity will be much better received and help you avoid invalid assumptions about your intent!

It was only supported in mac OS Yosemite (2014) and removed in Sierra (2016).

On Windows you just don't connect to a network when installing, and it'll let you create a local account.

There shouldn't have to be a workaround. This should simply be the default.

There is, and it doesn't have to be the default, just easy enough to go "no thanks". Which thankfully it still is. For win11 you just click "sign in options" when prompted how to log in during install, and pick "offline account". Done. For win10, you click "continue with limited setup" during the account step. Of course, this does assume you're installing pro, because no one in their right mind should ever install the home version of windows by choice.

Having to reinstall W10 on two machines last week, I can assure you that once you connect to wi-fi, option for a local account disappears and can’t be brought back.

Having done the same three weeks ago: worked fine for me, but then, I did use my windows 10 dvd to install it, not whatever the latest .iso from microsoft is. Then I just ran through the standard "and now we wait for windows update to do its thing for the next few hours". Apparently only install images based on 21H2 won't give you the offline account option anymore.

It depends on the release, that's why. On home you need to disconnect the network. On Pro and business the option is always there but it does require a number of clicks.

ah. Yeah, I have no idea why anyone would use home, given how much it's intentionally gimped in terms of you being in control of your own OS.

> because no one in their right mind should ever install the home version of windows by choice.

With Home a workaround I've found is just creating a throwaway windows account, then after installation creating a local user/local login and removing that throwaway account.

However one has to be careful one's license does not become/is not associated with that account.

Exactly this. I never understood why I had to go online when reinstalling MacOS.

Unless you're on Windows 11. In which case you need to get into task manager and end the network login task before you can continue with a local account.

You can't enable FDE without a MS account on Windows Home.

As I understand they got rid of the option to log in with your Apple ID in the newest versions of mac OS.

And that goes for Windows, too. Only ever log into your physical, self contained, machine using a normal user account stored on that machine.

I have computers w/ local accounts and with Microsoft accounts and no issues whatsoever... why ya'll dragging Microsoft into a stupid Apple thing FFS.

> PSA do not opt to login with your apple ID, it's an option when setting up the computer, you should never ever accept it.

It makes me sad that we now have to treat a MacOS initial setup as a hostile experience, the same way as setting up Windows 10 for an offline user account and intentionally not creating a microsoft account. The number of steps and dark pattern UI things a Windows 10 Home or Pro user has to jump through in the initial install to create a local-only account is really quite amazing. I just did a fresh install of a win10 home VM recently and ran into this.

Two of the reasons I switched from a FreeBSD desktop environment to MacOS back in the 10.4 days (Tiger?) was because of the switch to the Intel CPUs with the first gen Macbook Pro, and that MacOS had become a fairly refined, polished desktop environment with a CLI, macports, and a decent selection of applications.

Not only is apple now hostile but it's actively dangerous and harmful to its users' data, as shown in the example linked in this post, because if you go with the "online" apple account you risk getting locked out of everything you were using on a regular day-to-day basis.

Now if we have to think of Apple as a hostile entity that is doing the same shit as microsoft, it makes me very disappointed.

Any company at that size should be thought as a hostile entity - if anything bad happens you're just a drop in the ocean and the company couldn't care less about your issues. Everything should be done in such a way that there's an exit door if things go wrong (Of course that's unfortunately not always possible - eg if you're banned from any app store, that's it for you).

Apple is literally the only tech company I can walk into a store and most of the time get a problem fixed. I can’t say that for any other piece of tech I own.

with the caveat that if the embedded on motherboard security chip/crypto key repository inside your apple device has decided to lock/freeze/brick your phone, laptop or tablet, it's basically become a hunk of garbage.

> if anything bad happens you're just a drop in the ocean and the company couldn't care less about your issues

This is certainly true for companies like Google that very famously refuse to provide customer support.

However, companies like Amazon, Netflix, and Apple provide robust, free customer support.

the amount of catastrophe that can be caused in a normal person's life by a failed netflix account/billing/getting locked out is markedly different than what would happen to a non-technical user that has gone "all in" on trusting amazon, apple, microsoft or google platform cloud storage of all their documents, photos, private data.

based on the amount of fake/fraudulent products sold on amazon's marketplace I really can't concur that they have robust customer support that is really empowered to do anything.

>a non-technical user that has gone "all in" on trusting amazon, apple, microsoft or google

Between Apple, Google and Microsoft, only Apple provides free customer support, in person, or over the phone.

Microsoft provides support, but you have to pay for it.

Google is the only one of the big three computing platforms that literally couldn't couldn't care less about your issues.

> However, companies like Amazon, Netflix, and Apple provide robust, free customer support.

Its not free, you paid for that as part of your purchase cost.

You also paid for it when you bought an Android device and/or used Google services and Google relentlessly spied on your personal information.

You just didn't get it.

> Now if we have to think of Apple as a hostile entity that is doing the same shit as microsoft, it makes me very disappointed.

It's sad and disappointing but not surprising in any way. The immutable truth is we simply can't trust these companies. We need to cut them out of our lives as much as humanly possible.

Linux is flawed but it's ours. I hope we continue to have unlocked computers to run it on forever.

Linux belongs to those who maintain it. Become a maintainer. :)

I totally want to become a Linux contributor one day. I made drivers for some USB stuff on my laptop but I got the impression the kernel developers prefer keeping that stuff in user space if at all possible and in my case it was.

That's awesome. Don't discount your contribution just because it didn't make its way into the kernel. Published FOSS is great too. If you want to reach more users by default, you could ask Ubuntu or Red Hat to include it in their distros. Thanks for the work!

You can relax, the option to log in with your iCloud account was removed from Sierra onwards.

One thing that you should also be aware of: on the later Macs (T2 Intel and M1) there is activation lock protection too. This ties the Mac to your Apple ID and it can't be reinstalled without it. Just like an iPhone.

It's meant for theft protection but it causes us headaches at work when employees have left and used their personal Apple ID. Apple will disable it but only if you can prove ownership.

It's amazing that when companies grow beyond a scale, They can even forego basic support channels for even paid customers.

At least OP was able to contact Apple support,

1. I couldn't delete my Facebook account because my startup FB page backup isn't getting generated and there's no way to reach the support[1].

2. LinkedIn has fingerprinted my account login from a particular browser/OS that I'm unable to login via any other browser/OS(In the same network).

[1] https://abishekmuthian.com/meta-is-holding-my-facebook-page-...

Oh, that's nothing new. In 2017 one of my colleagues got his account banned afterehe moved to a different country, he tried to talk with Apple over phone and ask why, they told him "you know why". He didn't know though.

edit: Just to clarify, I'm sure that it was a false-positive and Apple mishandled the situation in the worst manner possible. Don't trust Apple your money and data.

I wonder what they saw on their screen. Maybe it was nothing and the tech just enjoyed being unhelpful and was maybe rewarded for it. Maybe it was flagged by NSA heuristics and there was an "untrustworthy" message.

Nope, the guy said that "yes, the appleid is banned, you know why, you breached our T&Cs, no you can't restore it". He rejected to specify what rule exactly was breached.

"HIPAA legally bars me from specifying which rule was broken."

That seems like a strange analogy, since as far as I know HIPAA is designed to prevent sharing private data with outsiders and should not prevent you from accessing your own data.

I've heard plenty about how HIPAA gets in the way of legitimate sharing with outsiders (e.g. making a common format for medical profile transfer impractical), but I don't recall having heard about it preventing the principal individual from getting answers from their own provider.

OP is making a joke. HIPAA only applies to healthcare providers (so far as I understand from our lawyers).

Edit: Why in the hell is my iPhone erroneously autocorrecting HIPAA to HIPPA?

> Edit: Why in the hell is my iPhone erroneously autocorrecting HIPAA to HIPPA?

Crowd-sourced autocorrect dictionary on display. :\

HIPAA is one of the more absurd excuses people use to refuse to give information.

Realistically corporations are more likely to use less blatantly stupid excuses ("our insurance policy forbids...").

NSA heuristics? :D Do they put the Max in the M1 Max

Next the M1 SuperMax for the more serious offenders!

And macOS 13 Guantanamo :)

What country? Are we taking Iran or Canada?

From Poland to Ireland.

Ireland... that's quite similar to "Iranland". That must be the problem.

Not funny when you lose your music and software worth several hundred euros.

That will teach people not to "buy" stuff you don't really own. Piracy o streaming are better solution. DRM is ethically and technologically bankrupt.

With Apple you have since many years now (10 years or so?) been able to download an unencrypted DRM-free copy of every audio track you ever bought in the iTunes Store. It's clearly to no consolation for OP, but it's worth pointing this fact out nevertheless.

To balance out your balance, with Apple, they recently chose to put government spyware on your devices (until public outcry caused them to delay/reconsider).

>when you lose your

It was never yours. Buy music from Bandcamp and save it on your hard drive. That is yours.

>Buy music from Bandcamp and save it on your hard drive. That is yours

but itunes music is DRM-free as well?

You would only lose access to music not saved in an accessible location (and purchased after DRM was removed unless you took the steps to get drm free tracks[1]) and also software bought on the App Store.

[1]funny story: I have one (or more) tracks in my music library that a friend shared with me almost 20 years ago when we were in college and he added me as one of the 5 computers that could play the tracks. Every time I’ve moved my library to a new computer it asks me to log into that account to approve that track, but it won’t give me a list of the tracks so I can delete it/them. It isn’t enough of an annoyance that I’ve tried too hard to find them.

You can download a DRM-free copy of any audio track you bought in the iTunes Store. It's been like that for around 10 years.

Are you sure? Legally speaking you might be required to delete it then.

https://xkcd.com/488/

> Not funny when you lose your music and software worth several hundred euros.

Indeed. I never spent much money on Apple media or applications, but in the last few years I've spent nothing.

It's part of the walled garden's feature set. Let's hope more of this happens and people start asking for their digital rights(i.e drm free media,hardware etc)

What's wrong with Iran? Last I checked it's a beautiful country with nice and educated people.

Apple is forbidden from doing business in Iran.

https://en.wikipedia.org/wiki/Sanctions_against_Iran

But its devices can still be used anywhere in the world, even if the company doesn't do business in certain places.

And with a theocratic government, that wants to wipe out another country and whose former president denied the holocaust ever happened.

All the iranians I met in person, were lovely people, though .

As an American, I think it unwise to label an entire country and people on the basis of how theocratic their government is, their military ambitions, or the personal views of former presidents. Please.

America has a lot of religious nuts who influence politics, but it is not a theocracy. We do not have a “supreme leader” who is both head of the Government (if not formally, but practically) and head of the official state religion. Our Constitution provides for religious freedom but otherwise says nothing about religion.

I meeeaan, "wants to wipe out another country" and "former president denied the Holocaust ever happened" can apply to a surprising number of places.

We were talking about governments, not individuals or radical groups. And in that group, the iranian leadership stands out a bit. I am not aware of any other country who makes such open statements.

No no. A land of ire. Seems apt here.

Funny story, I once knew a guy who had a very common Irish name (both first and last). He was from California though (born and raised). When it came time to renew his passport, the government mistook him for someone involved in the IRA. He actually had to ship thirty pounds of documentation including as mundane of items as report cards, school id’s, all job paystubs, etc. — basically document his entire life as a US citizen before he finally received approval.

Gerry Adams?

Ah, you wrote about someone involved with the IRA, so probably some other name.

It sounds like your friend might be the notorious serial traffic offender known as Prawo Jazdy! https://en.m.wikipedia.org/wiki/Prawo_Jazdy_(alleged_crimina...

> Are we taking Iran or Canada?

What is this? Some kind of Axis of Sanity?

I think the question is relevant, certain countries are under sanctions and could make a lot of things complex for those operating services.

um, I live in Seattle and I can tell you that even from here there’s constant new news of organized crime, cartels, and terrorist organizations operating out of Canada.

Organized crime, sure. But what terrorist organizations are you referring to? I live in Vancouver and have not heard of anything notable in this regard.

Yeah I agree that’s definitely less frequent. You can check here for listed terrorist entities with active presence in Canada: https://www.publicsafety.gc.ca/cnt/ntnl-scrt/cntr-trrrsm/lst...

Wait, the claim you made was "constant" news of terrorist organizations operating out of Canada. The list you cited was the Canadian governments' list of global entities that are designated as terrorist organizations and NOT those with an "active presence". (Tip: The US list is almost, if not entirely, identical).

Can you cite any "news" you've heard in Seattle about terrorist organizations operating out of Canada?

by that token, don’t trust any business. i don’t but i feel there’s a balance of ideal security/cost and ideal convenience. apple is not bad for that balance. compared to a lot of companies.

not a fanboy though i may sound like one. don’t get me wrong. i have my fair share of gripes with apple, but the way apple id makes my life better is not a bad trade off.

Related AppleID nightmare. FIL forgot his password & recovery questions and when migrating his iPhone to a new one I did an encryped backup/restore and it resulted in the new iPhone also getting that broken AppleID. Unfortunately find my iPhone was active on the old one and now the new was was unusable and also could not be reset. Panic...

Finally recovered on some old backup his password but without the second factor it was impossible to get full control of the account. So I disabled FindMyIPhone, wiped the phone and set up a new AppleId and restored from a not encrypted backup.

Everything worked for a while until the old apps needed updating (Whatsapp...) and the iPhone asked for the password for the Apple Store. Now the new password did not work. Took us ages to figure out that it was asking for the old appleid password - iOS remembers with which account an app was bought but it does not tell you what AppleID it asks the password for when trying to update.

I had a Ship of Theseus moment after getting my laptop repaired by Apple. They pretty much had to replace everything except for the bottom case, so when I went to sign in with my apple id I got a message saying "we have sent a message to your other device". But there was no other device. Took over a month to resolve and I also kept getting the annoying pop up message asking me to check the ID.

How did you resolve it?

Another problem Apple engineers can be blind to -- only having one Apple device.

Update: Finally I reinstalled everything without the ID and is working just fine, I'll use my personal Apple ID to download Xcode and I'm never going to create a new one again.. Thank you so much for your comments!

Wait, you need an apple ID to download xcode ?

I thought there was a quick, scriptable command-line method of downloading xcode:

  xcode-select --install

It used to be that you could download Xcode outside of the App Store, or without an Apple ID, but it seems that they have changed this.

xcode-select only installs the command-line tools, not the full IDE.

Maybe consider not buying Apple again since their products refuse to allow you to live your lifestyle of separating work and personal life.

They do. I have an Apple ID for work and one for non-work.

Final update: I feel like a complete idiot. As @tobiasbischoff said, a simple user swap could resolve all of this.. I hope tomorrow I can recover my lost IQ from today! ahhahaha.

PD: Apple, fix this anyway please.

Login with the original Apple ID you had on the device on iCloud.com and check if the device is still associated with that Apple ID. If so, leave it for now. Then setup a support contact session with that same Apple ID with Apple at support.apple.com, and tell them to help with your secondary account issue. Once support says it’s okay, remove the device from the original Apple ID; it’ll automatically get added to your second work one when you login during OOBE.

After support clears up any issues with the second account, reinstall macOS on the device with Internet Recovery.[0]

[0] https://support.apple.com/en-us/HT204904

The computer is brand new. No previus ID used.

Then you have fewer steps to complete. I must have misread your OP; I apologize.

Having a working personal Apple ID should help facilitate reaching Apple Support quicker, but you don’t need a working Apple ID to use the support site, or to receive support over the phone or in person at an Apple Store.

Even quicker still may be using the iOS Apple Support app if you have an iOS device handy. Doesn’t even have to be yours, you could borrow a friend’s. In my experience, setting an appointment on the support site is very quick and easy with callbacks under a minute being normal for me.

https://apps.apple.com/us/app/apple-support/id1130498044

The question is why I need to spent my time going to apple support for resetting a simple account. This is 2022. Authenticator apps, sms, magic links. Why I need to call them, or even ask for an appointment. They just blocked my account for no reason. If this seems reasonable to any of you... I feel I stole my own computer!

Yeah, I know. I feel for you. This sucks! So what is going on here?!

Someone may have owned or used the computer before you, even if you bought it “new.” It might have been purchased and returned and resold as new without your knowledge, and not properly removed from a prior associated Apple ID, perhaps. It might have been purchased fraudulently by this hypothetical prior owner. Or your purchase may have been flagged as fraud post-sale by the vendor for unknown or no reason, and reported to Apple as stolen by said vendor.

Apple will be able to help you with any of these concerns, if you are the legitimate owner. I don’t mean to offend, or to imply or to suggest you are not. All Apple needs to prove ownership is a picture of your receipt or a screenshot of the invoice if purchased online, whether from Apple or a third party.

> All Apple needs to prove ownership is a picture of your receipt or a screenshot of the invoice if purchased online, whether from Apple or a third party.

If that's true, couldn't someone just print out a fake invoice, with no way for them to verify it either way?

I’ve never seen invoices or receipts without some kind of unique identifier on them that could then be verified. My receipts from Chipotle are even uniquely identified by the store number, register number, date, and incrementing order number for the day.

I wonder what happens if the third party retailer you bought it from goes out of business and can no longer be verified. Must be relatively rare. I'm curious if they just give the consumer the benefit of the doubt in those cases.

As Apple is the first company to ever reach a $3 trillion dollar market cap, I’m not sure they find this to be a high priority, as they have the means to both track and remotely disable stolen devices. I believe the first time they deployed this capability en masse was after protests and looting a year or so ago.

https://arstechnica.com/gadgets/2020/06/local-authorities-wi...

You right. And one of the possible Apple’s reason is that this MacBook may be stolen(from the store or reseller). In this case Apple ask for proofs of purchase.

This is 2022. Authenticator apps, sms, magic links. Why I need to call them, or even ask for an appointment.

It's inconvenient, but life is inconvenient. Such is the way of the world.

While it's true that this sort of thing shouldn't happen, your comments here seem to indicate that your big blocking point is that you don't want to talk to a human being. You want 2FA or magic links or some tech-focused hands-off method of resolving your problem.

Real life isn't like that. Sometimes you actually HAVE to go down to the DMV, or the post office, or the county clerk, or the returns counter at the store. The world is not the ideal tech utopia that the SV bubble has sold us. It's still run by wetware. Sometimes you have to just go through the motions instead of having a hissy fit on social media.

Isn't owning a Premium Apple Product supposed to be convenient and not like going to the DMV?

You don’t even need to own an Apple product to create an AppleID.

It's a new machine, and it doesn't work. What do you do when you buy something and it breaks? Return it and ask for another one.

Nah. Your work data is on the laptop, clock the hours it is locked, and calculate the maximum potential damage. Sue via your consumer association.

Apple can lock you out of your laptop, but if that causes damages to your well-being, your business, etc. you can sue.

They can write whatever they want on their T&C, that doesn't make it enforceable.

Apple can also make it absolute hell to use any of their products. I wouldn't pick a fight with a 3 trillion dollar corporation.

Are there examples of this?

Can someone explain for those of us less familiar with Apple - can a Macbook not be used without a valid Apple ID, that Apple can revoke at any time?

You don’t need an Apple ID to use a Mac. However downloading apps from the App Store requires one.

You can also log into the OS with an Apple ID but also not required.

You can also use a local non-Apple ID account to login, and selectively login to only the Apple services and apps you need or want, including App Store.

You can set it up without an Apple ID.

i doubt it.

i recently walked a friend through setting up a their MacBook Air M1. and, like you said, i told them to skip setting an Apple ID. that it was not necessary.

but the first setup doesn't allow you to skip. or didn't make it obvious how to do so. (dark pattern?)

i suppose one could use keyboard shortcuts, or install in safe mode, etc... but for the regular users won't be able to skip that step.

You can definitely still do it but like windows now the button is like off to the bottom left somewhere and hard to find.

It does allow you to skip, but you're right that it's a dark pattern. Apple really wants you to be on board with their network services, because Apple 3.0 wants recurring services revenue like a crackhead wants crack.

> Apple 3.0 wants recurring services revenue like a crackhead wants crack

While this is true (to my increasing chagrin), having an Apple ID in and of itself doesn't cost you anything. It does create an account that you can then tie charges to.

I don't, however, recall this quite rising to the level of what I'd call a "dark pattern"; IIRC when I set up my M1 MacBook Air not that long ago, the "Enter your Apple ID" had a "Skip this step" link that was pretty easy to find.

On Macbook the "Set Up Later" is lower left of the dialog box, so it does require swiveling your eyeballs in their sockets until your attention lands 2 inches from center. Kind of an off-white pattern, maybe?

I kind of love that description. "We don't want a dark pattern, but maybe it could be, you know, beige?"

It’s not a dark pattern at all. The step that appears immediately before this one is the one where you can choose to set up accessibility features. The skip option is in the bottom left on that step as well. The skip option on that screen is the option most people will choose, so a) everybody will already be primed to know there’s a skip option in the bottom left by the time they reach the Apple ID step, and b) it seems clear that this is just the design language for the setup wizard and not Apple attempting to hide the skip option. Unless you think Apple wants to intentionally trick people into setting up accessibility features as well?

It's a wizard pattern UI. Forward is on the bottom right.

> While this is true (to my increasing chagrin), having an Apple ID in and of itself doesn't cost you anything.

Privacy.

You can't get an Apple ID without an email and a phone number.

When you enter it during the machine setup, it ties that identity to that hardware serial, which maintains a persistent TLS hardware-serial-linked connection to Apple at all times, letting them know in what cities and at what times that phone number's owner is using their computer.

I did set up my M1 Max without an apple id. I logged into the app store later, but I didn't log into the system itself and double checked that all cloud services were disabled.

I've set up two new M1 machines in my household in the last two months without Apple ID. Everything is fine. No dark patterns. No unskippable prompts.

> but the first setup doesn't allow you to skip. or didn't make it obvious how to do so. (dark pattern?)

It does allow you to skip, and it is obvious.

There’s a screen asking you to log in to your Apple ID. There’s a button that says “Set up later”. When you click it, it asks you if you are sure. You confirm. That’s all.

Here are the screenshots:

https://i.imgur.com/2s3sA2L.png

https://i.imgur.com/wU0GU5l.png

It can, you just have to reject the pushy signup screens on startup.

Can it be kept updated with system updates? Don't know any more.

Automatic updates or manual updates to macOS do not require login with Apple ID. You don’t even need original Mac hardware, as is the case with hackintoshes and virtual machines, although full backups before installing a macOS version upgrade is advised in the case of non-genuine hardware.

It's a bit like an Android phone: you can use it perfectly fine, but the Play Store requires you to log into a Google account before letting you install apps.

At least, on Android you can use the Aurora store, or install .apk files manually... but that's another story.

You can install apps fine on a Mac without an Apple ID; just not from Apple’s own App Store.

You can use it fine without an Apple ID and you also get security updates for the installed OS (they do not require to be signed in)

The AppleID you use is used for the AppStore and iCloud (you can use different ones and to some extend multiple ones). Usually you create an additional AppleID for just buying/downloading sofware from the AppStore, just like you would do on Android or the Microsoft store. Same deal here. And use a different iCloud account, if you want to use any of it's offerings.

If an account is locked or disasbled you usually just reset the password as one of both is usually done on suspicious login attempts.

Never heard of what the OP descibes, unless it is a pre-owned device still associated with a different account or some enterprise management profile in installed. Both should not be the case if he just bought it from Apple directly.

In any case sounds more like an issue with the device itself than the AppleID. But I can just speculate here, which is ofc not helpful for the OP.

You're speculating a bit too much. The problem is with Allow Apple ID to reset your password. If this is enabled, Apple basically gets the ability to lock you out of your computer.

For this reason, I always leave it off, and recommend everybody does the same.

In another light, automatic security updates also gives Apple the ability to lock you out of your computer.

Yeah, absolutely. But those can’t be gamed by a third-party to lock me out of my stuff.

You can use it just fine, you just can't access icloud, and app store. But it's possible OP had his account tied to icloud and possibly his macbook encrypted to that, so that he couldn't log in or something.

I haven't used an Apple ID with my MacBook for several years now. Never had an issue. Life is just fine without the Apple cloud.

Unfortunately some software (e.g. WireGuard) can only be installed through the app store, which requires an Apple ID.

From the wireguard install page:

  $ brew install wireguard-tools

  $ port install wireguard-tools

You could also just compile it yourself.

That installs the CLI, the WireGuard GUI app is only available on the app store. Same for Outline (another VPN).

If that's the case then the GUI app isn't open source and is a completely different product from the CLI version, and differently licensed. If the CLI version can't do everything the GUI version can, I'd be keen to move to a more open and honest platform, especially for something as personal as a VPN.

They are not the same things. The App Store Wireguard does not support certain directives that are included in the CLI version (see my comment further up the thread).

Note that the command line interface for Wireguard is not optional on the server, the Wireguard App on the App Store is not sufficient for managing a Wireguard server due to macOS’s sandbox restrictions. (Specifically, the PostUp and PostDown directives are not supported in the App Store’s Wireguard App).

If you change your Apple password, the system goes insane with the reauthentication prompts and the only way to fix is to enter a password (or create a new user account). I don't know which optional service it is exactly - could be iCloud sync, iTunes, App Store, Find My, etc. The same happens on iPhones/iPads when you change your Apple password from another computer.

However, the Mac is still usable and they can reboot into Recovery mode to download and re-install the OS. Not sure about Find My (for iPad/iPhone), as it's an anti-theft feature it can't be disabled or factory reset.

> If you change your Apple password, the system goes insane with the reauthentication prompts and the only way to fix is to enter a password (or create a new user account).

Weird. I rotate my password on a regular basis and I’ve never had this happen. I wonder what service triggers it for you.

While using your appleid as your system login?

I'd check using these steps (https://support.apple.com/en-us/HT202860) to see if you can reset your password using your Apple ID. If you can, then I'd recommend turning it off.

There's no connection to an Apple ID unless you want it. You don't need to connect it to any Apple ID to use it. You can change the Apple ID at any time.

You can use one without an Apple ID. I think the issue here is that once OP logged in, the computer recognized that an Apple ID was associated with the computer, but there was no way to remove it without the password, which was impossible because the account had been deleted

It's probably not deleted, just marked as blocked. I didn't heard too many horror stories about Apple, so you many be lucky. With other big companies "deleted" and "blocked forever" means "blocked untill you make a big enough mess". Try posting in tweeter.

Do you have an screenshot and a photo of the bricked macbook? It adds a lot of realism to the complain.

Anecdote time: My wife bought a new Android phone and gave me her older phone. After a factory reset, the old phone asked for her gmail account before I could add my gmail account. It's a nice anti thief feature, but it surprised me a lot!!! (What happens if you want to sell a used phone?)

There is no issue to sell a used phone as long as the original owner removes ALL Google account BEFORE doing the factory reset. In that case you won't be asked to log in.

Yet this is still safe as you need your unlock code to remove an account, even if the phone is already unlocked

The problem stems from users just pressing the "reset" button without removing their accounts first. I think that Microsoft's approach here (Refresh your PC without affecting your files, Remove everything and reinstall Windows) is better, because it tells you what exactly will happen. On "Remove everything and reinstall Windows", it'll ask you if you're simply resetting it for yourself or if you're selling or disposing that computer (the difference here for almost all computers is a zeroing disk wipe).

Blame the designer not the user.

This is resolved on iOS by turning off Find My before doing factory reset. On macOS devices, you need to remove it from your device list on iCloud.com after factory reset, as well as turning off Find My, if applicable.

> Yet this is still safe as you need your unlock code to remove an account, even if the phone is already unlocked

The word “unlocked” in the context of phones usually implies the lack of a carrier lock on the device as originally manufactured and sold. It is not precisely correct to refer to phones originally locked to a carrier as unlocked when offering them for sale without disclosing any original carrier lock, as there are differences in supported frequency bands depending on the jurisdiction the phone was sold in that may make it incompatible with some carriers, whereas “factory unlocked” phones of the same model are usually world band phones and support all common carrier frequencies.

To recap: it’s fine to refer to phones which have had an unlock code applied to them as unlocked. To differentiate phones which came unlocked when originally manufactured, this second group of phones is referred to as “factory unlocked.”

Sorry to be pendantic, and this isn’t directed at OP. Most of this is inside baseball and is only important when buying or selling phones secondhand, in order to make sure the new owner is able to use their phone on a different carrier than the prior owner.

All of the above is separate to anti-theft locks which are supported by Android and iOS devices, which must be removed before sale in order for the new owner to associate the device with their own personal Google or Apple account, respectively.

My bad! This is indeed what I meant, not native english speaker, in french we use the same term for both meanings

We do too in native English, but “factory unlocked” has a more precise meaning, in that it reflects a potential change in the hardware. SIM locks and/or carrier locks refer to this property.

The Android and Google locks are independent of the above types of locks, and are account bound like the above locks, but instead of being linked to your phone service account, they are linked to your Google or Apple accounts. You could have one and not the other, or neither, or both. However, no end user benefits from a carrier or SIM locked phone. Mobile device OS-level blocks are important for security, however, and are under the control of the legitimate user and may be turned off anytime. To disable the SIM or carrier locks, you need the unlock code you originally mentioned.

what? I did factory resets on multiple android phones and EVERYTHING gets wiped even Google accounts, does not ask for anything just setup like new.

This used to be the case, I'm not sure since when nor if that's how it works on every android phone as every manufacturer customize its own OS. I'm pretty sure this has happened to me on my OnePlus 3T and it definitly happened on my OnePlus 6. This is a bit problematic as my Google account has a generated password in my password manager, if I forget to remove it before doing a factory reset, I usually change my password for a simpler one until I have bitwarden installed back on the phone after the reset

A regular reminder about the gradual but steady shift from open computing to devices that you think you own but in fact it feels closer to renting, and the manufacturer has more and more tight control over it.

This reads like a machine that has DEP enabled and getting locked remotely ;)

On a more serious note, I ran macs on multiple occasions without an AppleID - it presents maybe one nag a month, usually when you accidentally open “Messages”.

Microsoft, sadly, has also been increasingly more annoying with pushing online accounts on people’s machines lately.

Apple is doing the same now :/ the wizard tries hard for you not to

My experience is that the popup appears every time I unlock the computer, but it's not modal / blocking, so can be ignored but really annoying.

American who moved to Australia for work... Apple account was frozen, just totally bricked my $5k MBP. It only started working again once I got back to the US. For 3 weeks I had to use a pen and paper notebook and a borrowed shitty plastic-y Dell junk-book. Fucking Apple, they won't help in these situations. They have some sort of security flag that gets tripped... and when you are one of the false positives they won't do anything to help you.

Atleast your junkbook won't lock you out and leave you dry :-)

But it's plastic!!

It took two weeks for my Apple ID email reset email to arrive. Since then I've learned to never use it for anything. I'm sorry for your loss.

Apple on one hand does sell iCloud (and all that sync between devices that goes with it) along with its hardware.

And on the other hand, only manages to handle accounts issues like we were still in the 90's.

That is, brutally locking people out of their own systems (sometimes for explainable reasons, which should still be resolvable) without any possible discussion or recourse.

The only thing you can do is go at an Apple Store or call Apple support on the phone, only to spend hours and hours with them carefully following their scripts, sometimes escalating the issue to a more senior one, all of them sorry in the end that they can't fix it, and asking you to still note them well, because the issue is not on their side but on Apple's procedure wall.

Which makes the first selling point ("all my life sync'd across my devices") moot at best, adversary at worst.

The senior population is especially vulnerable to account hijacking and loss of their account, and then, their data, and then their devices (at least, they can recover their devices with the help of someone else, but most of their data is lost).

And/or something is definitely rotten in the account reset/recovery procedures.

@OP Since the machine is new, I wonder if you talked to Apple support on the phone? Did they tell you to visit the service in person? Also, out of curiosity, how can you have multiple personal/professional Apple IDs? AFAIK you need to provide a separate phone number for each. It is not very easy to create multiple ones.

Let's suppose they banned the account cause the information is already in use. No problem with that, but don't let me create the account in first place! And of course don't allow a user use it as main ID on a device if you know you ask a password for logging out. And as I said, calling for resetting a password? 2022 and a trillion dollar company.

Well….. it should be clear by now that this is not just about “resetting a password”. The instructions at https://support.apple.com/en-us/HT204106 provide quite a lot of options to follow, with the support call being last resort. Bugs happen, so why not tell them and let them help you first?

The issue here is you keep creating AppleIDs. You should have only one or two and use them on your respective personal and work devices. With 2FA you really need to have more than one trusted device or you can easily lose access and have to go through the account recovery process which can take a while.

Had to deal with the bug where macOS does not login even with the correct password even on reinstall last year on several M1 macs. Frustrating to say the least!

Apple should not be able to control logon/pw of local system at all, especially if they can’t get it right!

Lol, WTF. "Full macOS reinstall because of dude has no idea how to use a computer"

You can always just boot into single user and create a new local admin account, a matter of minutes.

True.. I feel like a complete idiot now, thanks hahahaha. WTF I was thinking holy sh*t

I somehow lost access to an AppleID. I dont even know how. I have the password, it's saved in a Password Manager, and an old Mac is still logged in. But the new Mac would not accept my authentication (I do not recall the specific error message).

I gave up and created a new one, but lost all my old purchases.

And you're paying good money in hardware, developer fees and app store fees for this.

I just can't understand how people actively choose to endure into this situation.

Market economy.

You're right! We need to get rid of this "market economy" and have an official Government laptop assigned to us.

Don't get me wrong, I'm a big fan of capitalism in general.

Because apart from this, MacOS is an excellent operating system that "just works" for most people, and Apple's hardware is excellent.

I'm confused by this. You don't use your Apple ID to log into your computer. There is no Apple ID used to log into your computer.

No, you can opt to login with your AppleID instead of a machine specific password. I never would, but that is an option.

Oh really, they must have added that recently. But I didn't even see it as an option when I bought this M1 mac. It must have been buried somewhere.

Yeah, I don't remember when it was added and I think the interface to that option has changed over time. There is also an option (SysPref->Users) to authenticate a Mac password change with your AppleID. Different option but the net effect is the same.

Leave them an invoice for reimbursing them for your time wasted etc..

We need to normalize this.

Every time they pull some shenanigan on you - invoice them.

Don't ever put an Apple ID into a Mac. The only thing you lose is iCloud (mostly not e2e encrypted, so a privacy nightmare) and the App Store. Macs can still install non-App Store software, though, so you don't actually need an Apple ID on them.

You're just asking for paternalistic, Apple-knows-best trouble. Apple's cloud services are mostly garbage, anyway.

I've learned that today!

You’re confusing two separate things:

The OP used an Apple account to log into the Mac itself.

That’s different than using your Apple ID to login to iCloud or the App Store.

New machine in what way? You bought from a retailer or apple? Was it perhaps a re-sold but brand new stolen device?

New from Apple store.

This is why I absolutely refuse to have anything but a local account on my primary desktop. My computer belongs to me, not some sociopathic megacorp in California.

…. or Redmond.

Reply on news.ycombinator.com