Hacker News Reader

Comment by larsnystrom | Hacker News Reader

IMHO, the crazy part is that it is possible to create a new Recovery Key with just the iPhone passcode (and the iPhone). So basically, the iPhone passcode is mightier than the Recovery Key. The only purpose of the Recovery Key is to protect against SIM swapping attacks. I didn't know this.

So an attacker with the iPhone passcode can lock you out of your Apple account on all devices, even if they don't have your Apple ID password or your Recovery Key. Basically, the iPhone passcode is your only defense if you lose your iPhone. I had always assumed the Apple account password would be needed, and that the passcode is not as important as it is so common for it to be only four or six digits.

I'm going to go setup a stronger passcode now.

View on HN

Under Screen Time, of all places, you can set an additional passcode, and under Screen Time privacy and content restrictions, at the very bottom, block changes to your passcode and to account changes for your apple id, which denies access to the whole icloud section in iOS settings.

Just don't forget you turned this in and then get confused why it's greyed out in settings when you go to change something in there.

For a non-techie like me this might as well be written in Urdu or Farsi. I'm so afraid of being locked out of my Apple account that I STILL refuse to use a password/passcode/FaceID/TouchID/2FA, much less a Recovery Key.

But you can just remove that restriction after you’ve unlocked the iphone? Granted, it’s quite hidden, so nobody might find it.

You can only remove it with the separate password used for Screen Time, you can't use the regular password to remove it.

You can simply reset the password with your Apple ID credentials

https://support.apple.com/en-us/HT211021

Yes, but crucially that's different from your iPhone passcode and the thieves don't have access to it, foiling the attack under discussion.

Except for the process listed here: https://old.reddit.com/r/1Password/comments/11hodde/is_1pass...

It suggests that one can use the unlocked stolen device to learn the appleID.

Then follow a series of steps on the device to turn off the screen time passcode by entering the appleID and the device passcode.

Namely "forgot passcode", "enter appleID", "forgot (appleID) password", "enter device passcode".

If correct, then the use of a screen time password can not defeat this attack.

No, as far as I know the screen time specific code is required to unlock any screen time restrictions.

Right, even if you have already set up a recovery key, it will still allow it to be overriden (deleted and replaced) with just the phone passcode. This is completely stupid. Also using a Yubikey is not an option the way it is with enhanced iCloud security.

Reply on news.ycombinator.com