4 ms·

Don't blame the user for poor product decisions.

gambiting 8y ago
I just don't see this as a poor product decision - the mechanism here is extremely simple - if you lock out your device completely, Apple will only ever unlock it for you if you can prove it's yours. How is it different to cars for example? If I lost both of my keys to my car, Mercedes would only produce a duplicate and re-program the ignition if I could prove that the car is indeed mine. I don't want someone to be able to just roll into the dealership and go "hey I just got this car, can you reprogram the ignition for me please thanks".
- toast0 8y ago
  For cars, in the US, each state (to my knowledge) runs an ownership database, issues certificates of title, and compels buyers, sellers, and users of vehicles to update the database when ownership changes. Apple devices don't have a similar ownership database.
  - Redoubts 8y ago
    Sure they do, it’s called Apple ID.
    - toast0 8y ago
      That's missing the step to compel usage. It sounds like apple doesn't even check periodically that your address is valid.
matthewmacleod 8y ago
I'm not sure it _is_ a poor product decision though. There are a large number of hurdles between "I have a functioning device" and "I can no longer use my device". Passcodes, password resets, account ownership claims, device ownership claims. There's an extensive path of steps to follow which allow a legitimate user to regain access. In this situation we have: - Someone who has disabled their access, probably through entering the wrong password a few times - No knowledge of the security details on the linked account - No access to the email address associated with the account - No proof of ownership of the device In other words, from Apple's perspective, the user in question could easily be using a stolen device. I'm curious though – what's the 'correct' product decision that should have been made here? Is it possible to build a system which is both secure and allows _any_ user to gain access to their device, no matter how many safeguards they have avoided?
- Gupie 8y ago
  Couldn't Apple make it be standard to provide a name and address when buying such a product? You could then for example take ti to your local apple store with some ID to get it unlocked.
  - matthewmacleod 8y ago
    And then you sell it to someone else (as happened in this case) and don't update the record, and suddenly you're locked out again. But it's possible that there are specific lessons to learn here, so it's always worth examining failure cases!
    - Gupie 8y ago
      That's true, the article was unreachable so I had only read these comments. But what I don't understand is why her iCloud account was locked.
- ghaff 8y ago
  Make it easy to regain access to a device under these sorts of circumstances and, instead of this story, you have one about how a thief was able to gain access to my stolen device even though they had almost none of the information they should have needed. The more forgiving you are the more exposed you are to social engineering and other attempts to work around security systems.

I just don't see this as a poor product decision - the mechanism here is extremely simple - if you lock out your device completely, Apple will only ever unlock it for you if you can prove it's yours. How is it different to cars for example? If I lost both of my keys to my car, Mercedes would only produce a duplicate and re-program the ignition if I could prove that the car is indeed mine. I don't want someone to be able to just roll into the dealership and go "hey I just got this car, can you reprogram the ignition for me please thanks".

toast0 8y ago
For cars, in the US, each state (to my knowledge) runs an ownership database, issues certificates of title, and compels buyers, sellers, and users of vehicles to update the database when ownership changes. Apple devices don't have a similar ownership database.
- Redoubts 8y ago
  Sure they do, it’s called Apple ID.
  - toast0 8y ago
    That's missing the step to compel usage. It sounds like apple doesn't even check periodically that your address is valid.

matthewmacleod 8y ago

I'm not sure it _is_ a poor product decision though. There are a large number of hurdles between "I have a functioning device" and "I can no longer use my device". Passcodes, password resets, account ownership claims, device ownership claims. There's an extensive path of steps to follow which allow a legitimate user to regain access. In this situation we have: - Someone who has disabled their access, probably through entering the wrong password a few times - No knowledge of the security details on the linked account - No access to the email address associated with the account - No proof of ownership of the device In other words, from Apple's perspective, the user in question could easily be using a stolen device. I'm curious though – what's the 'correct' product decision that should have been made here? Is it possible to build a system which is both secure and allows _any_ user to gain access to their device, no matter how many safeguards they have avoided?

Gupie 8y ago
Couldn't Apple make it be standard to provide a name and address when buying such a product? You could then for example take ti to your local apple store with some ID to get it unlocked.
- matthewmacleod 8y ago
  And then you sell it to someone else (as happened in this case) and don't update the record, and suddenly you're locked out again. But it's possible that there are specific lessons to learn here, so it's always worth examining failure cases!
  - Gupie 8y ago
    That's true, the article was unreachable so I had only read these comments. But what I don't understand is why her iCloud account was locked.
ghaff 8y ago
Make it easy to regain access to a device under these sorts of circumstances and, instead of this story, you have one about how a thief was able to gain access to my stolen device even though they had almost none of the information they should have needed. The more forgiving you are the more exposed you are to social engineering and other attempts to work around security systems.