Hacker News Reader

Comment by ig0r0 | Hacker News Reader

There is one very easy thing you can do to break the first step of the attack

- enable Screen Time

- set a Screen Time password, make it different than the iPhone password

- use Screen Time to disable making changes to your account

With this the attacker would not be able to go to the step of changing the account password without entering the different Screen Time password.

I wonder why this is not mentioned or recommended, seems kind of obvious. Sure it is a bit inconvenient but you probably very rarely make changes to your account.

View on HN

The screen time feature is actually listed in the linked article, at the bottom of this one:

https://www.wsj.com/articles/stolen-iphone-passcode-security...

> • Enable additional protection. Some apps, such as Venmo, PayPal and Cash App, let you add a passcode. Just don’t use the same one as your iPhone.

> You can also set up a Screen Time passcode for yourself, then enable account restrictions to prevent an Apple ID password change, the way parents do with their kids’ devices. In Settings, go to Screen Time > Content & Privacy Restrictions, then toggle Content & Privacy Restrictions on. If you haven’t already set up Screen Time, you’ll need to choose a passcode. (Again, make it different from your iPhone’s.)

> Scroll down to the Allow Changes section, and where it says Account Changes, select Don’t Allow. Whenever you need to access your iCloud account settings, you’ll have to go to Screen Time and re-enable this.

What do you mean by this: "use Screen Time to disable making changes to your account"?

You can enable restrictions in Screen Time, and not just restricting screentime. You can completely block Siri and dictation for example, or block account changes like the parent comment said.

https://support.apple.com/en-us/HT201304

Here are some features and settings that you can allow changes for:

Passcode Changes: Prevent changes to your passcode

Account Changes: Prevent account changes in Accounts & Passwords

With Screen Time you can enable Content and Privacy Restriction which allow you to disable a lot of things, like Account Changes or Passcode Changes.

Wow! Used it only for kids so far, didn't figure out that it is actually a hidden security jewel :) Thank you!

Reply on news.ycombinator.com