Hacker News Reader

Comment by jfan001 | Hacker News Reader

I had my bag stolen with clothes + work laptop out of my rental car in San Francisco, from the trunk, while parked in an underground garage with security on patrol.

SF has an especially bad problem with shoplifting and robberies, but it's happening in a lot of other places too.

A friend who worked in a senior position at a FAANG had his phone stolen while it was unlocked, and within minutes they had disabled Find My. They had full access to his work accounts + private data + identity documents for several hours, so he has to get everything replaced. Crazy that for most folks the most valuable assets isn't the device itself but the information on it, and criminals have started to realize that.

View on HN

I’m more concerned about how you’d go about disabling Find My on a locked device that doesn’t have an user replaceable battery either.

(I’m not disputing your experience, I just want to know because I can’t find any info on how to disable it on a locked device.)

They said the device was unlocked when they stole it.

Unless there was an edit, the GP says the phone was unlocked. I'm guessing the recent iOS changes about not allowing Find My disabled when it is away from known locations was made specifically for this situation.

Find My always requires the Apple ID and password. Almost every recent phone I’ve owned has been traded in at the end and I have to put my password in to disable Find My.

Apple also requires it if you need them to work on your phone/computer at the store. I did it last month.

It was unlocked. Still, you typically need the iCloud password to disable Find My.

Mug person, preferably while intoxicated. Use face I'd to get access to phone.

The amount of times as a tech fixing some crap on folks devices I just pick their crapples up and face Id myself into their phones for a auth pass before they even realize what has happened is too many. Face ID is a hella big security hole. People are slow to react. You can be in and auth'd before they even ask "hey what are doing?"

Yeah it was unlocked. My friend said what they did initially was to completely disconnect it from all cellular networks so Find My couldn't remotely disable it. This also meant they couldn't connect to cloud services but there was enough data/documents stored on the device that they still were able to get his SSN, Passport, cached messages, etc.

You cannot turn off Find My without entering your Apple ID password. The option to turn off Find My is disabled if stolen device protection is enabled.

If you can get the PIN (shoulder surfing, social engineering) you can reset/change the Apple ID password.

Reportedly then you can add a second face to Face ID with Set Up Alternate Appearance and get access to everything, but I have not seen that confirmed.

I deleted by bank app from my cell phone for this reason alone.

Don't bank apps require logging even explicitly even if the phone is unlocked?

Apparently not all cash apps do. My bank apps require some form of login but things like Venmo do not.

Yeah almost all finance apps do. Used to work at Robinhood and this was actually my feature, otherwise we'd just see ridiculous levels of fraud and have to end up eating the cost of it.

Reply on news.ycombinator.com