9 ms·
About Stolen Device Protection for iPhone
- baicunko 3y agoThis took quite a while to get ready but I do believe it prevents 99.9% of the theft cases mentioned. I am downloading it right now.
- dylan604 3y agoEven if it prevents reselling the phone, it doesn't prevent the phone from being stolen. It would be a dumb criminal to leave you your phone to allow you to immediately call the police if you've been mugged. Just take the phone, trash it literally placing it in a bin or destroying it or both. At the end of the day, you still don't have the phone whether the thief profits from it or not. All this will do is prevent criminals up to date with this info to not try to resell it. It does not prevent them from taking/destroying it.
- stirlo 3y agoThieves have been known to steal iPhones not just for the value of the parts but to compromise your entire digital existence. Most online banking transfers only require a 2nd factor from your phone (your saved passwords are already on there).
- ghostpepper 3y agoWhy would a criminal steal your phone if they knew they couldn't sell it?
- metadat 3y agoThey can still part it out, e.g. at least the screen and frame. With that said, this will definitely make it more difficult and less profitable per unit of effort. Edit: @google234123 +1 to that!
- google234123 3y agoSoon I hope apple with blacklist electronic parts from stolen devices based on their serial numbers
- dylan604 3y agoyou mean beside the specific examples of why i provided in the comment you replied to?
- bgentry 3y agoThis feature is not really about protecting your device from being stolen. It's about protecting your iCloud account and everything on your device from being compromised when somebody has stolen your device and also has your phone's passcode. It's an attempt to resolve the fairly widespread iPhone / iCloud social engineering takeover attacks that were documented in great detail by Joanna Stern last year: https://www.wsj.com/articles/apple-iphone-security-theft-passcode-data-privacya-basic-iphone-feature-helps-criminals-steal-your-digital-life-cbf14b1a https://www.wsj.com/articles/apple-iphone-security-theft-pas... https://www.wsj.com/video/series/joanna-stern-personal-technology/an-iphone-thief-explains-how-he-steals-your-passcode-and-bank-account/C37B4009-E548-4459-8D0A-22B7400C3FEA https://www.wsj.com/video/series/joanna-stern-personal-techn...
- hbn 3y ago> This feature is not really about protecting your device from being stolen. Once a thief has stolen his 10th iPhone that he can't do anything with, he'll probably be less likely to bother stealing iPhones. If anything it's a liability since it can be tracked as long as it still has some battery.
- someotherperson 3y ago> Once a thief has stolen his 10th iPhone that he can't do anything with, he'll probably be less likely to bother stealing iPhones. If anything it's a liability since it can be tracked as long as it still has some battery. Theft isn't just for the whole device, it's also for parts. By making the part market so difficult they essentially create a black market for it in third world countries where just the phone's battery could be worth a day's wages.
- akmarinov 3y agoThat’s why they require that you activate parts as well. Motherboard, screen and face id sensors are useless. The battery isn’t worth much, compared to newer Chinese knockoffs
- pixl97 3y agoBut it kind of does in a statistical measure. If you think in the systems of how criminals work, they tend to spend more time stealing things they think will pay off. Taking something that will cost them time and not gain them money will over time bias thieves to not taking iphones. For example it may prevent this a) iphone is left on a table in the open. but would not prevent b) iphone is in a bag, bag gets stolen.
- JoshTko 3y agoThis would discourage thieves from targeting iPhones long term so there is a definite network benefit.
- paxys 3y agoThe point of it is to protect your data, not the phone itself.
- whartung 3y agoAn interesting scenario I heard was a fellow in, I think, Colombia. He was visiting, and was looking at his phone on the sidewalk. As he was looking at it, a pair of people rode up on a motorcycle or scooter, grabbed it out of his hand, and drove off. They just got themselves an unlocked phone. I assume this protects, somewhat, against this by the fact that were the thieves to try and change anything, there's another step of verification necessary than there was before. And I think it was very clever of Apple to leverage the device location as an ad hoc "2FA". "Something you know, some place you are."
- BizarreByte 3y ago> At the end of the day, you still don't have the phone whether the thief profits from it or not. I care a lot about some low life scumbag not profiting from it. Anything that discourages theft is great.
- jrockway 3y agoYou can't really prevent "I stole your phone just to cause chaos". What Apple did with Find My was to remove the financial incentive to steal phones. What Apple does with this is protecting your iCloud account from someone who knows your passcode. (I would imagine that most people in relationships know their partner's passcode. Sometimes relationships sour.) What prevents "I stole your phone just to cause chaos" is the risk/reward profile. Even though your phone is useless to someone that stole it, it's still theft, and you'll still have to face consequences if caught. If the incentive is "I'll be able to buy $1200 worth of shit", then people are probably going to take their chances with getting caught. If it's "I'll get nothing except the satisfaction of smashing someone else's electronics", then most people won't take their chances. With the whole "knowing your passcode doesn't help" situation, it makes the long tail crimes even more difficult. "Tell me your passcode or I'll shoot you" no longer works, for example. It makes the crime significantly more difficult to commit, and requires committing crimes that carry significantly longer sentences. (Armed robbery turns into kidnapping. You could be looking at the rest of your life in prison for $300 in someone's checking account. Not worth it to most people.) At the end of the day, there is only so much you can do. The rest is your insurance company's problem. The fewer viable attacks there are against you, and the less often they happen, the less your premiums are. (I actually don't know if there is insurance for this. I should check.)
- madeofpalk 3y ago> I do believe it prevents 99.9% of the theft cases mentioned I don't believe so, or at least where I am from. This 'only' provides additional protection against cases where thieves know your device passcode. I've had my phone stolen from me twice where they couldn't have known my passcode and couldn't remove it from Find My, and it was never seen again.
- Gigachad 3y agoThey probably stripped the phone down for parts. But there is another theft case where they hold a knife/gun to you and tell you to hand over the password/wipe the phone. Which this update solves. The other issue could probably be resolved with more aggressive part ID checking. iPhones should just refuse to function if they have a part from a stolen phone.
- e40 3y agoRequires updating to iOS 17.3. (Released today, I believe.)
- stirlo 3y agoThe update is showing available and downloading onto my devices right now.
- gnicholas 3y agoIs there a website that has a list of the steps you should take if your phone is stolen? My first instinct would be to use someone else's phone to google "what to do if your iPhone is stolen". But I wouldn't know how to determine if the instructions I was seeing were incomplete, or outdated. Is there a trusted, frequently-updated site that we can easily remember and plug into our friends' phone if and when this terrible thing happens to us?
- varenc 3y agoThis Apple support page has a section on "If your iPhone or iPad is lost permanently or was stolen" : https://support.apple.com/en-us/HT201472 https://support.apple.com/en-us/HT201472
- gnicholas 3y agoVery cool, thanks. I notice it doesn’t mention anything about changing bank passwords or the like. Might that be necessary, depending on how long it’s been out of your control? That is, if someone swipes your phone and was able to peak at your password (as a recent WSJ series focused on), you would probably need to take more dramatic steps if you didn’t realize it was gone immediately. Should I be making a list of the apps on my phone that have sensitive information and can be accessed without FaceID? I wish it were possible to designate an app to require FaceID or both my device password and my Apple ID password (or some other second authentication). Does this new updates fix this issue entirely? I feel like not because until I mark the phone stolen it doesn’t know to lock the holder of the phone out of my apps using just my device password.
- pc86 3y agoIf something like a phone is stolen it's probably safe just to change everything. The inconvenience of having to go through and change your important passwords manually (including your manager's master password of course) is relatively minor compared to your financial accounts getting breached.
- bertil 3y ago
- dhdhdudhsg 3y agoI’ll be using this but what a stupid exception imo. I work in a big building where anyone could walk in without id and simply defeat the protection. Hell, a disgruntled coworker contractor or customer could be in on it. > When your iPhone is in a familiar location, these additional steps are not required, and you can use your device passcode like usual. Familiar locations typically include your home, work, and certain other locations where you regularly use your iPhone.
- shuckles 3y agoI don’t think iPhone thieves are smart enough to connect a snatched phone’s owner’s identity to a location nor are they stupid enough to regularly go to a frequent location to unlock a stolen device. In practice, a change like this will help a lot. Most stolen phones get put into the Shenzhen parts supply chain, and it’s probably not economical for the middlemen to do bespoke work to unlock the device.
- dhdhdudhsg 3y agoOh how very wrong you are. This feature came in response to WSJ reporting about iPhone thieves, targeting affluent iPhone users so they could steal their iPhones and rapidly lock the owner out. All while accessing their bank accounts, credit cards etc.
- shuckles 3y agoWhat does that have to do with my comment which was about whether those thieves are willing to locate the owner’s frequently visited addresses, visit them, and then repeat this process at scale.
- deleted 3y ago[deleted]
- kemayo 3y agoThis is a pretty direct response to the WSJ's iPhone theft story from last year[1], which was focused on people managing to shoulder-surf your passcode while you're in a public place, steal your phone, then use your passcode to reset your Apple ID password (thus locking you out of being able to report the phone as stolen). It apparently relied on multiple people and a certain amount of social engineering -- one party managing to get the phone into a passcode-required state, another to see it entered, and a third to actually lift the phone. The hope would thus be that although someone could walk into your workplace and steal your phone off your desk, they would be much less likely to have been able to watch you enter your passcode first. [1]: https://www.wsj.com/articles/apple-iphone-security-theft-passcode-data-privacya-basic-iphone-feature-helps-criminals-steal-your-digital-life-cbf14b1a https://www.wsj.com/articles/apple-iphone-security-theft-pas...
- natch 3y agoSo the next step for the criminals (the ones who steal both the passcode and phone) is to find your address (often stored in Contacts, or available in your Amazon account) then physically go there and lurk nearby while finishing their pwning steps. I may be missing something. But if not it seems like Apple is now incentivizing a scenario where thieves will physically go to the location of their victims homes in order to circumvent some of these measures.
- landr0id 3y agoI know somebody who was recently drugged and had their iPhone stolen (amongst other things) while on a trip in New Orleans. While he has no recollection of the night, this may have mitigated the damage they were able to cause and the trouble he had to go through to recover his Apple ID. I doubt the thieves would physically travel to his home for the phone, but I suspect that this will lead to blackmailing scenarios where the thieves exfil risqué or compromising content and threaten to send it to sensitive contacts if you don't unlock the phone the next day.
- dakial1 3y agoThis is time sensitive. The criminals would lose too much time doing that. At least for the “criminal use case “ in Brazil, where they want to quickly access your bank app, this wouldn’t work.
- gnicholas 3y agoYes, as long as you know your phone was taken, and you immediately use someone else's phone to mark your as lost (or wipe it), you can probably beat them to it. But if your phone was stolen while you were at a movie theater, for example, you might not notice until it was too late. At least there's a 1 hour delay + biometric requirement for certain changes.
- stirlo 3y agoThis also solves a somewhat unique problem I experienced recently with iCloud keychain where all your passwords are only as secure as your passcode (and anyone that knows it). I had to hand my phone over to a third party repairer. This would mean they needed to know my passcode so I wanted to lock down the phone to allow them to perform whatever diagnostic steps they might need but to restrict access to the wallet and iCloud keychain. The first part was actually quite simple using a separate screen time passcode to restrict all apps bar the camera and any that they needed. The frustrating part was that the settings app itself cannot be blocked by screentime (I guess as thats where you configure the restrictions) and as iCloud keychain passwords are accessed from settings there was no way to block access to them. With this update I could (somewhat) safely supply my passcode while being relatively confident that my keychain passwords were not viewed.
- PlunderBunny 3y agoI think some (all?) Android phones allow you to put the phone into 'repair mode', which allows the repairer to access critical features without unlocking the entire phone. I'd like to see a feature like that for iPhones too.
- r00fus 3y agoAt least the passcode section of settings can indeed be restricted by ScreenTime. I've done this as my aging parents often want change the passcode then forget their new passwords (and sometimes get paranoid).
- rollcat 3y agoYou took unnecessary risk. Wipe your device before handing it over, and restore it from a backup after the repair. Also consider evil maid, or other kinds of backdoors (like jailbreaks).
- stirlo 3y agoIt’s a risk. But it also takes a few hours to restore from backup and there’s a bunch of things that (sensibly) don’t restore and require manual setup. I know Apple will never ask for your passcode but in the case of a repair shop that promises 15 minute service it’s kinda necessary unless you want it to take far longer and annoy them. Ultimately with it locked down with screentime the only personal data I had an issue with was iCloud Keychain. Honestly I don’t know why Apple lets children access the full settings anyway. It would be trivial to add a screen time restriction for all features of settings except the screentime pane.
- lokar 3y agoA one hour delay? Really? I don’t get it, how does that really help?
- metalcrow 3y agoIf you're robbed at gunpoint, and they demand you unlock your phone for them, this protection means they would have to kidnap you for at least an hour to then unlock it again. The former happened pretty regularly, but upgrading to kidnapping is a lot riskier, more dangerous, and invites a serious police response.
- lokar 3y agoAnd if it takes more then an hour to get to a computer I can use? What if I’m wait to report it to the police? Seems like it should be a day.
- stouset 3y ago> Security Delay: Some security actions such as changing your Apple ID password also require you to wait an hour and then perform a second Face ID or Touch ID authentication. Emphasis mine. It seems like you have a lot of reasonable questions and concerns about the efficacy of this measure, but Apple have done a pretty good job of addressing them and explaining their rationale in the first few paragraphs of the documentation.
- stouset 3y ago> In the event that your iPhone is stolen, the security delay is designed to prevent a thief from performing critical operations so that you can mark your device as lost and make sure your Apple account is secure. Learn what to do if your iPhone is lost or stolen.
- artdigital 3y agoWay overdue feature IMHO. A reason why I didn’t want to use passcodes or keychain for passwords was that once someone knew my passcode to unlock my phone, they could access all my accounts 1Password at least uses a different password and isn’t unlockable with passcode alone
- TheNewsIsHere 3y agoNitpicking here. Older 1Password versions do allow unlocking using the iOS passcode if biometry fails, but I’m not sure it was ever intended as a feature. It isn’t a UI that is built into 1Password though, it’s the iOS fallback UI for that scenario (which looks very similar to the SIM PIN unlock screen). A _lot_ of apps did and still do fall back to iOS passcode authentication when biometry fails. It does seem like more developers are disabling this, however.
- aetherspawn 3y agoAvailable from iOS 17.3 for anyone wondering. I went to settings and could not find the option to enable this, but it turns out I was still on 17.2
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- paxys 3y agoNeat feature I guess, but how long before thieves realize that they can just look up your home or work address from the Maps or Contacts app and go stand near it to get around these restrictions?
- TheNewsIsHere 3y agoOr for high value targets, just outright hold you hostage for an hour.
- dakial1 3y agoI don’t know if Brazil was one of the places that convince Apple to do that, but we have a huge problem of mobile phones robbery with that aim to access the bank apps to drain accounts dry. In a quite resourceful way (social engineering, process and system exploits) these criminal organizations will jump all the hoops (2FA, Face Recognition) and manage to access most of those apps.
- deeth_starr_v 3y agoIt’s a big problem is the USA also. It’s been in the news in prime time for about a year. They’ve been really slow to address it
- PlunderBunny 3y agoRegarding the actions that required FaceID/TouchID once the protections are enabled, what happens if the biometric authentication fails? Sometimes I can't unlock my phone with FaceID, and I have to resort to using my passcode after three attempts. Will it now allow unlimited attempts in the specific scenario covered by the new feature? (I realise this means I can still get into my phone, just that I might not be able to access certain features - e.g. change passwords - if I'm not at one of my usual locations).
- gnicholas 3y agoMy experience with biometrics in general is that it gives you X tries, and then asks for a password. But IIRC if you close the app, and then re-open it, it will give you another X tries with biometric. It isn't like failed password attempts, where it will rate-limit you after a few misses.
- fori1to10 3y agoThis is also something I don’t understand. Would like to know the answer