> make it so that the phone cannot be turned off by the power switch on the device itself.

I used to have the same idea [1], having been a victim of theft and robbery myself, but as others in that thread pointed out, it would be trivial for thieves to take out the SIM, or to wrap it up in something that blocks all signals.

I think a better way might be to introduce a PANIC MODE; a special state that could be activated with a predefined fingerprint or PIN, different from the ones you use for unlocking. Say your left pinky.

In Panic Mode, the device would present a "fake" environment, which allows most operations but:

* Keeps the device secretly powered on even after being powered off.

* Regularly connects to open networks AND also transmits an SOS to all nearby Apple devices, to use THEIR network and transmit its location to Find My Phone.

* If not powered off, defaults to an easy passcode, like 0000 or 1234, and disables lockout protection for invalid retries.

* When unlocked, presents a home screen that looks identical to a freshly installed OS, with empty or random Notes, Contacts, Calendar etc.

* Allows calls to any local number, but for a duration of one minute only, so the networks can aid law enforcement in tracking it as well.

----

TL;DR: Make the device appear unsecured to the thieves, so they don't have to force the owner to remove all protections, and entice them to keep using it normally for as long as possible while secretly and aggressively tracking them.

[1]: https://news.ycombinator.com/item?id=12058169

You're not fooling any thieves. They knew it was a legit stolen phone that was PIN-locked when they stole it. A faked "fresh install" isn't going to trick them into using the phone.

iPhone thefts will decrease when thieves know that the iPhone that they just stole is going to get them caught.

I understand that some don't like the privacy implications of a phone that can be forced into spy mode with Apple ID credentials. Fine. Give the user the option to disable this functionality on the device (and only on the physical device). Users that don't want it can disable it in their settings and the phone will act just like the phones do today when stolen, regardless of what happens on the iCloud side.

It would still make a big difference where I live, where most phones are taken at gunpoint, and later sold for their screen, battery and shell if nothing else, unless you were walking down a particularly deserted neighborhood, in which case the muggers will make you unlock the phone and remove the passcode/fingerprint.

However, many don't know about iCloud/Find My Phone yet, and it requires an internet connection to disable anyway, which most people don't have outdoors, here.

Some kind of "fake mode," filled with random data, would also help with government coercion in, ahem, the more civilized countries.

I don't see why people aren't coming to the logical conclusion: turning off an iOS device should always require the device passcode.

What if your phone hangs (input/touch ID stops responding too). You have to resort to a forced shutdown. If that requires a password, how would you reset the phone while you are travelling ?

A 'forced shutdown' (by holding the Power and Home button for 8+ seconds) does not simply shutdown the device. Rather, it forces a reboot, which would not effect the security implications of requiring a passcode to fully power off.

Why stop there? It could broadcast some (authenticated) "I'm a stolen iPhone" message to other iPhones nearby. Maybe a Bluetooth beacon that any iPhone with Bluetooth enabled could pick up and report to Apple servers. I'm not sure how technically feasible this is but at least in high-density urban areas this might work.

>> "It could broadcast some (authenticated) "I'm a stolen iPhone" message to other iPhones nearby."

Why not have Siri yell 'Im a stolen iPhone' full volume with the volume switch disabled.

You'd probably have to make sure that it only activates if the phone is actually stolen, not just lost. I found an iPad in the street once, took it home, found the owner's details and took them to come pick it up (turns out it was some sort of sale team, and one of their staff put it down and forgot to pick it back up).

I'd've been _extremely_ unimpressed if the device suddenly started proclaiming it was stolen.

To much power consumption when the phone would likely be already out of the public. But certainly an option

Could just phone the police, "Hello I'm an iphone, I am being stolen, my GPS coordinates are ..., and here's a photo of the face of the thief"

Or it could just shock the person holding it until they drop it and run away http://youtu.be/tMa-lwxXWjY

On a serious note, none of these options seem desirable if the Apple account is compromised.

Maybe a good Apple Watch use case. As soon as the phone is stolen from you you can activate the alarm using your watch and now the thief is running down the street with an iPhone screaming that it's stolen. I'm guessing they would dump it because they won't get far before a cop hears it if.

Good point.

OTOH: This opens up a whole new avenue of pranks to pull on iPhone users.

Better idea: make it so iPhones always broadcast an "I'm an iPhone" message to all nearby phones.

Isn't that feature already implemented in the owners?

In 2008

"I'm an iPhone Sent from my iPhone"

Why stop there?

Why not make the iPhone blow in the face of the stealer?

/s

Thief

What a great idea - make an iPhone as adversarial towards thieves as possible, so stealing one becomes a huge personal risk. Maybe even add a stealth version of Lost Mode, so the phone works in a sort of guest mode (without access to your data) but is furiously spying on the user in the background.

My worry about something like this is it's essentially opening it up to be a remote access tool for anyone that can figure out how to trigger it while not being Apple.

I would personally prefer to just lose my phone and have robust measures to stop thieves from accessing my data than increase the possibility of bad actors/govt using it as yet another surveillance tool (or at least more than it already is).

Agreed. I don't care about my phone, I can get a new one. I care about my data. Apple has great online storage and syncing so I can lose my device and be back up and running again on a new device. I'd rather see something that basically allows me to say "This device is stolen, make it worthless." Where Apple waits for it to phone home once and then they brick it so that it has to be taken to Apple to be reversed, notifying Apple that it was a stolen device.

> Maybe even add a stealth version of Lost Mode, so the phone is furiously spying on the user in the background.

Prey (preyproject.com) does this. It'll take pics and screenshots and send them to you along with GPS coordinates at regular intervals.

With enough political will (and slightly better security against tampering and spoofing), the "huge personal risk" part could have been done already, since for a phone to be useful it has to broadcast a unique IMEI number along with its location.

Throw it into low power mode, but with loud alarm noises at random intervals... Annoy the thieves into giving it back...

I mean, if I steal a thing and am annoyed about it being impossible to do anything with - I'm probably going to hit it with rocks and then throw it in a canal. I might just lob it in the bin. The one thing you can guarantee - I'm not giving it back

Edit: Uhh, repetition it seems. God damn I need to not leave HN windows open for a couple hours then replying without refresh.

Yes, but I would probably not bother stealing one again.

or more likely annoy the thieves until they launch it into a river.

That's still a net benefit. If theives learn that stolen iPhones are both annoying and unprofitable then they'll stop stealing them. Especially if they know the iPhones are being tracked and that they are at risk of being caught.

And that's the last iPhone they try to steal.

Why would it be a risk though? Police don't care about stolen phones.

Depends where you live and what kind of PD you have. There are plenty of places with a low enough crime rate that going after a pickpocket / thief for an $800 iPhone would be a good use of officer time.

Even in places with average crime rates, solving crimes looks good and if you've got the means to arrest someone for theft that makes you look good as a result.

Obviously if your day-to-day as a police officer involves the cartels or something you won't care about an iPhone. But if you live someplace where a murder would make the news regardless of the circumstances, someone will probably look into it if you can prove you know where the thief is (or that the phone was in a given house/apartment).

Yup, not only does it 'look good', but it gets a low level criminal off the street, sends a message to other people in similar circumstances, and (contrary to some beliefs) most cops actually like arresting criminals and returning stolen property.

We have that already, no need to implement that. The reason Apple is not providing this "stolen" service is it would reveal all the backdoors implemented to spy at us.

The latest version of iOS does turn on low power mode as part of lost mode. I agree, though, that making it super adversarial would be both fun and useful against theft.

The problem with those kinds of ideas is thieves will know ahead of time, and they'll be prepared. They'll pull the battery, or isolate it, take the sim. They'll take it to "this guy I know" who has figured a way around the security feature.

The people who are really going to be in a bind are the totally unprepared legitimate owners who've been hacked.

Nice thought. The problem is that turning your iPhone off is the easiest way to secure it quickly and completely. Whether it's an overbearing TSA agent or police pullover -- if you want your data to be secure (password protected vs fingerprint protected) you can always just turn off.

Anything iCloud-initiated does not benefit from the protection of the secure enclave on the device--so with your idea, you'd be opening a denial-of-privacy attack vector

What about self-ransomware? "All the data on this is encrypted and there is absolutely no way to flash it without the secret key that is stored in the apple cloud."

It already has that with FileVault

Is that technically possible when facing a sufficiently determined adversary?

I don't understand your question. Do you mean is it possible to prevent flashing of iPhones that Apple have ransomwared?

Yes. Is it possible in principle to prevent flashing without bricking the device? How would one do that on a deep level? I don't think it can be done on computers, but am happy to be corrected.

not without boobytrapping your phone by adding capacitors etc that would shortcircuit it in case flashing hardware was connected to it

Honestly, I won't ever buy a phone which I can't reliably turn off under any circumstances. And I'll think twice before buying a phone whose battery I can't take out with little effort.

Thats you, I'm me. My phone is my life and if someone is not deincentivised against stealing it then I'm not going to be thrilled.

Personally I've never had issues with iPhones for the battery, I've had three- but then I also spring for AppleCare.

In my individual experience, solving Executive Function problems is much harder to do with medication than with technology.

There's probably an app for that ;-)

  aggressively look for open access points and attempt to associate with them and phone home [...] location info

  put the phone into a power conservation mode to keep it alive and phoning home as long as possible.

Isn't there an inherent conflict here? I doubt that you can aggressively scan and phone home, and conserve battery life.

the best option would be to ask for your pin before the phone shuts down, maybe even at the firmware level to make sure it gets around possibly crashed software.

They should add a way to remotely short out the battery and make the phone explode.

The problem is that a thief would just turn the phone off immediately, when it is stolen, long before you ever report it as a stolen phone or even realize it was stolen.

I don't understand why Apple has not added a passcode requirement option to turn off the phone.

Probably because iphones(like any other phones on the market) do crash sometimes, and the only way to bring them back to life is to do a hard reset(usually hold the power button until the device shuts off) - it's a necessary engineering feature.

Holding the power button on my device (not iPhone) restarts the device, not shutdown. I think that would work too.

Perhaps the phone could turn itself on again intermittently?

Not being able to remove the battery could be an advantage in this case :)

There could of course be downsides to that.

1) in situations where phones are not meant to be switched on (e.g. some flights)

2) from a privacy perspective not being able to ensure your phone is actually off is not great.

You can't be sure that your phone is off already. Phones can be remotely activated and used as eavesdropping devices.

Is this really true or your speculation? Really curious about that but yeah, I am also suspecting that while the phones seem quiet they are actually listening ... sometimes.

In 2014 Snowden said NSA can do so (but not how).

It was quite discussed at that time. for example: http://www.tomsguide.com/us/nsa-remotely-turn-on-phones,news...

That's not even close - you linked to an article from 2006 (before the first iPhone was introduced) about microphone activation on phones like Motorola RAZRs which are already powered on. Oh, and this was legal and in the open.

Nice try, but that's a long way from a (long running, secret, and still hidden) vast government/corporate conspiracy to remotely power on any smartphone to spy on the owner.

Anyway, I guess a thief could just wrap the phone in tinfoil :)

There's a cydia tweak that claims to do something similar, I have no idea how well it works: http://repo.ziph0n.com/index.php?method=view&pid=54

You can also accomplish it with the Activator tweak. On Lockscreen, set Hold Power Button to Do Nothing. Of course you can still perform a hard reset but it's better than nothing.

Yeah 100%.

This would be ideal, even if it doesn't really contribute to returning stolen phones. It makes the whole idea of stealing an iPhone so much more difficult for thieves.

A strong deterrent in my opinion is much better than a solution which returns your phone. I'd rather have it not stolen in the first place.

Easily defeated with Faraday bags, no?

Works for thieves of opportunity, not necessarily others.

How do you protect against lead boxes or freezers drainig power? it seems trivial to prevent it from phoning home.

The practical approach is to make things hard enough to discourage theft in the first place or make life harder for the thief afterwards. You cannot usually cover all possible scenarios for a trained insistent attacker.

The same way having a secure password protects you from Brute force attacks - https://xkcd.com/538/

Is this standard iPhone thief operating procedure?

Pickpockets usually don't carry freezers or lead boxes on their person. By the time they are home and can drain the phone, their closest WiFi access points would have pinpointed them.

(Though a sophisticated thief might have a lightweight faraday cage on them - sleeve lined with aluminium foil might sufficiently dampen Wifi/GPS/cell signals.)