Armed robber asks for iPhone password and uses it to recover iCloud account

discussions.apple.com

16 points·lokedan··7 comments

Is it possible to protect your sensible iPhone data from the hands of a coercive robber?

Apparently not. All you need is to get the victim to give you the device password and you can then reset the iCloud password and remove the device from the account.

Yes. You do the following:

1. Set a "Screen time" passcode (different from your device passcode!)

2. Go into "Content and Privacy Restrictions" and set "Passcode Changes" and "Account Changes" both to "Don't Allow"

Now you will need to go back and enter your screen time passcode every time you try to change the settings of your Apple/iCloud account, which is sort of annoying. But it'll probably save your account if someone does get your phone passcode.

I believe this one can be overridden by clicking the "Forgot Passcode?" button under screen time and going through an iCloud password reset instead of logging in, assuming that your iCloud email is logged in on your iPhone. I believe this can be solved by having a recovery key on the phone, but someone would have to check me on that one.

The most brutal of social engineering. Social engineering hammer

Best to say "it is my friend's iPhone, only got the PIN".

Now brace yourself for a harsh rubber-hose treatment.

If someone sticks a gun in my face and wants my phone, I would say, "oh, it's a Pixel, so just let me factory reset it". And then go buy a new phone and pair of pants.

Ticket closed. Works as designed.

Reply on news.ycombinator.com