Hacker News Reader

Comment by kristofferR | Hacker News Reader

I hope he sues Apple for this and wins, behavior like this shouldn't be allowed without consequences.

From iCloud's ToS, it looks like it'd depend on whether a court finds this to be either "failure to use reasonable skill and due care" or "gross negligence":

APPLE SHALL USE REASONABLE SKILL AND DUE CARE IN PROVIDING THE SERVICE. THE FOLLOWING LIMITATIONS DO NOT APPLY IN RESPECT OF LOSS RESULTING FROM (A) APPLE'S FAILURE TO USE REASONABLE SKILL AND DUE CARE; (B) APPLE'S GROSS NEGLIGENCE, WILFUL MISCONDUCT OR FRAUD; OR (C) DEATH OR PERSONAL INJURY. [Blanket disclaimer of liability in all other cases follows.]

I'd be curious if there is any good precedent on product liability for cloud services.

Just because a clause is in a contract, doesn't mean it has any effect.

A lot of terms are flat out bluffing to scare off folk like you.

This is why it is always a good investment to ask your lawyer.

This is really, really important advice, and if more people understood it, corporations would have a lot less power over people than they currently do. You can open up just about any ToS and find a handful of unenforceable clauses they're hoping you won't realize are unenforceable.

I suspect the vast majority of people never read the TOS and decide to sue, or not, for completely independent reasons.

In general, I'd say that if you are getting a lawyer involved, you need to have fairly solid evidence of real loss of a value more than about $20,000, otherwise the fees are going to eat up any award you might eventually get (don't forget even if you get a favorable judgement the other side can appeal, and will if they have staff lawyers who are getting a salary either way).

I don't think I would label this horrible behavior on the part of Apple. When you provide customer service for something like iCloud things like these are bound to happen. This is a case of social engineering not some tech rep downloading plaintext passwords to a laptop and losing it. With a really targeted attack they are bound to be successful with some rep. Its a matter of when not if. Having said that they will improve their support with this. And the guy could end up suing Apple as well.

The techrep shouldnt be allowed to reset your password. For all you know, that guy is your wife's ex.

This reminds me of facebook and how all its employees were stalking people using the god password.

They can and should follow bank protocol. Require an ID, make every action reversable ( like being able to undo a wipe ) and have both employee and requester on tape, with id's.

> This reminds me of facebook and how all its employees were stalking people using the god password.

Wait what? Sorry to get off topic but when did this happen?

Possibly referring to this story. http://online.wsj.com/article/SB1000142405270230489870457747... If so, the quote only says they could stalk people with the master password, not that they were.

This is the internet, we don't distinguish between could do and did do.

Facebook employees were able to login to any acount using the password "chucknorris".

Including being able to read private messages of their friends, families, ex-girlfriends, etc

This wasnt just true when facebook was a university startup, but even when they were already the largest social network in the US.

Honestly, the bank protocol is overkill for 90% of users. Most people using iCloud are using it to sync photos of their cat. The number who are keeping "their life" in the cloud is basically confined to techno-geeks.

Your average iCloud user is not necessarily going to want to a) prove their identity initially or b) do so again to get support.

I think you are better off taking the approach of "don't put something in the cloud if you can't afford to lose/expose it." Yeah, that pretty much limits its usefulness, at least or now. So it is.

If you dont put anything of value in iCloud, you dont care enough about a reset: you could just setup a new account.

Having every underpaid store clerk being able to reset the account of every customer, is just dangerously stupid.

Just not having a reset feature is even better.

I hope he sues Apple too. Not because I want any harm to come to Apple, but because I want Apple to have a significant financial incentive to push authorities to track down the villain.

And more important, a significant financial incentive to correct their own obviously inadequate procedures.

Reply on news.ycombinator.com