How my brother's iCloud account was stolen

Re:How my brother's iCloud account was stolen by limitedsupply on Monday January 16, 2023 @07:26PM (#34407517)

Not going to try to justify Apple but feel like a piece of info is missing from the post. How did they unlock the phone? Maybe the phone had no auth set up?

In general, it's expected that you should be able to update your own phone number in your iCloud account.

[ Parent | on HN ]

Re:How my brother's iCloud account was stolen by schiffern on Monday January 16, 2023 @07:30PM (#34407546)

That's all fine! The bug is that criminals can use it to lock you out of Find My, etc.

[ Parent | on HN ]

Re:How my brother's iCloud account was stolen by limitedsupply on Monday January 16, 2023 @08:03PM (#34407853)

Would you prefer not being able to remove your own old phone from Find My?

There is a lot of disappointment expressed in the comments here but we need level-headed solutions, not just rage against things that are actually useful in 99.9999……% situations.

[ Parent | on HN ]

Re:How my brother's iCloud account was stolen by b3morales on Monday January 16, 2023 @08:24PM (#34408010)

Having a "re-enter your password to confirm" step is bog standard for critical actions like that. It would be no serious burden for a legitimate user, and an extra hurdle for a thief.

[ Parent | on HN ]

Re:How my brother's iCloud account was stolen by Gigachad on Monday January 16, 2023 @08:17PM (#34407955)

Seems like there are vanishingly few security measures which prevent the held at gunpoint scenario but still allow the user to do things.

[ Parent | on HN ]

Re:How my brother's iCloud account was stolen by limitedsupply on Monday January 16, 2023 @08:25PM (#34408021)

One fix that was mentioned in the comments that would have been easy to implement (and, frankly, bizarre it’s not implemented yet) is confirming password when performing such critical actions as removing or adding devices/telephone numbers.

[ Parent | on HN ]

Re:How my brother's iCloud account was stolen by Gigachad on Monday January 16, 2023 @08:40PM (#34408139)

I just tested this on my iphone and it absolutely asks you for a password before you can touch the icloud phone number. I suspect the victim was compelled to complete to either enter or hand over this password when the phone was stolen. It's not out of the question that the brother forgot this happening consider how stressful the situation would have been.

[ Parent | on HN ]

Re:How my brother's iCloud account was stolen by limitedsupply on Monday January 16, 2023 @08:47PM (#34408184)

Thanks for testing this, Gigachad!

At this point I will just stop commenting on this post as it seems like either Apple already fixed this or some of the most critical information has been omitted by the author. So we are just guessing and raging for no reason.

[ Parent | on HN ]

Re:How my brother's iCloud account was stolen by probably_wrong on Monday January 16, 2023 @10:15PM (#34408732)

Author here.

Unfortunately I don't have an iPhone to check, but another comment [1] suggests that this may happen if you physically change SIMs. My brother said they didn't ask for his iCloud password, which makes sense: if they had the password then they wouldn't have needed the phishing step afterwards.

[1] https://news.ycombinator.com/item?id=34407683

[ Parent | on HN ]

Re:How my brother's iCloud account was stolen by nraynaud on Monday January 16, 2023 @07:47PM (#34407713)

Buy pointing a gun at the owner?

[ Parent | on HN ]

Re:How my brother's iCloud account was stolen by limitedsupply on Monday January 16, 2023 @08:10PM (#34407902)

It would have been helpful to explain that instead of leaving everyone guessing. Being able to unlock the phone is one of if not the most important detail here.

[ Parent | on HN ]

Re:How my brother's iCloud account was stolen by nraynaud on Monday January 16, 2023 @09:17PM (#34408377)

It’s the first sentence.

[ Parent | on HN ]

Re:How my brother's iCloud account was stolen by limitedsupply on Monday January 16, 2023 @09:32PM (#34408486)

Are you sure? Want to re-read it one more time? The phone was _stolen_ at gun point, not unlocked. It looks like the password was later phished when author's brother clicked the fake Apple support link. So at that point they had access to both the password and the phone. But I am guessing, it's not clear how/what they did.

[ Parent | on HN ]

Re:How my brother's iCloud account was stolen by nraynaud on Monday January 16, 2023 @09:50PM (#34408593)

I’m not sure, it’s just the most logical and simple explanation.

To add some context, Argentina has a history of robbers asking people to do complex tasks at gun point, like withdrawing money, and other things during “secuestro express”.

[ Parent | on HN ]

Re:How my brother's iCloud account was stolen by sitkack on Monday January 16, 2023 @08:32PM (#34408078)

https://xkcd.com/538/

Lots of people keep talking about password codes, etc. You should be able to hand over your phone to an attacker and walk away knowing you and your data is safe.

At least don't use biometrics, they will cut off your thumb AND steal your iphone.

[ Parent | on HN ]

Re:How my brother's iCloud account was stolen by probably_wrong on Monday January 16, 2023 @10:11PM (#34408715)

Author here. We do not know for sure how they unlocked it, but the phone was locked with a numerical pin. My guess is that those numbers must have been easy to see on the screen based on the smudges alone. I wanted to ask for more details, but I decided against further traumatizing him with my (as far as he's concerned) pointless geeky questions.

Also, trivia for iPhone users: my brother used to have Face ID set up, but he disabled it because he couldn't figure out how to set up a second face and it was annoying when he needed to share the phone with his wife. So don't do that!

[ Parent | on HN ]