7 ms·
You're referencing the first section of this post. The other security relaxation allows you to change your Apple ID's password without knowing what the old one
by function_seven 9y ago
You're referencing the first section of this post.
The other security relaxation allows you to change your Apple ID's password without knowing what the old one was. To me, that's a much larger problem.
- eridius 9y ago"Forgot Password" flow, by definition, lets you reset the password without knowing the old password. That's how it works in every "Forgot Password" flow ever invented. So my question is (having never gone through that flow with Apple ID), what was the "Forgot Password" flow in iOS 10? If the answer is it sends you an email, how does that work for people that use icloud.com mail (because, if they don't know their password, they can't get their mail)?
- function_seven 9y agoI've also never gone through the Forgot Password flow, so I'm not sure. It could be that Apple insists on a non-Apple email address as a recovery option?
- annabellish 9y agoWhich, 99.9% of the time, would also be attached to the phone. The "always signed in" model of mobile computing means that once you have access to the device, you have the keys to the kingdom. Why are we concerned about a slightly smoother iCloud password reset flow when somebody with this level of access has enough information and capabilities to get into my bank account?
- rectang 9y agoI really wish I could set the Gmail iPhone app to require reauthentication on app start. The only way to sign out is to remove the account. https://www.wikihow.com/Log-Out-of-Gmail https://www.wikihow.com/Log-Out-of-Gmail
- graeme 9y agoThis is a good point. Certainly true for my main phone. I guess one difference is that now any secondary iDevice can also access icloud, even if no email accounts are connected.
- throwanem 9y ago> what was the "Forgot Password" flow in iOS 10? The same, apparently; I just tried it on this phone, which I haven't updated, and it didn't ask for anything but the passcode.
- graeme 9y agoYou reset your icloud password, or your phone password? The part that seems new is that you can reset your icloud password with phone access.
- throwanem 9y agoI didn't reset either, but it gave me the same prompt described in the article as an iOS-11-exclusive flow. Perhaps the behavior of a completed reset differs; I'm not about to mess with it just for kicks. But the fact that everything up to that point is identical makes me doubt that somewhat.
- nemothekid 9y agoI was reading the archive and I must have missed it among the broken links. How has this not been a bigger issue before? I’d imagine, iOS 11 or not, for those of us without iTunes, anyone with my iOS pass code has always been able to access my iCloud account.
- function_seven 9y agoThey may have had access, but they didn't have the means to change your trusted devices or perform other sensitive operations. I'm often asked to confirm my Apple ID password when making changes. If I can just make up a new one, this basically means the PIN is all I need now.