I haven't "scoped it" that way, the parent poster of my answer did it so: "Someone would need my apple id, my password, access to one of my apple devices (I ha

I haven't "scoped it" that way, the parent poster of my answer did it so: "Someone would need my apple id, my password, access to one of my apple devices (I had to enter a code that appeared on one of my devices), and access to my email." Note: "someone would need my" -- as in "an attacker", not "me as the owner of the device." And the answer, supported by the Elcomsoft's article is, no, the attacker just needs the device and the passcode. Nothing more. Since iOS 11, everything else he can extract from that.