3 ms·

I'm in a similar situation with Apple. I can't access my 10 years old account even though I know the password and control the email attached to it because I don

I'm in a similar situation with Apple. I can't access my 10 years old account even though I know the password and control the email attached to it because I don't remember my security questions and I don't have my recovery email anymore. I probably put rubbish data in the security questions as they weaken the security of the account. Funnily enough that password leaked and someone managed to take over my account (I wonder how they manage to bypass the security questions, sounds like a security vulnerability on Apple) and they're using it to register (I assume) stolen devices and install software. I get email notifications every time these people do something. I reached Apple support but they're unwilling to help, they even refuse to nuke the account as a last resort.

davidmurdoch 6y ago
I actually have the same issue with my Apple account I used back in the ipod days; they are now requiring that I answer my security question during log in. But I actually don't remember the answer to the security question, as I used to always put gibberish instead of a real answer. Back in those days these questions would only be used to reset your password, and I was confident I wouldn't forget the password. I've given up on getting that account sorted.
- ghaff 6y ago
  Furthermore, the answers to security questions aren't always stable. "What was your first pet?" Well, I know how I answer this question because one dog in particular I sort of consider my first pet. But I can remember dogs we had before that one so my answer is a somewhat arbitrary one.
  - heavyset_go 6y ago
    By answering honestly, you also run the risk of having anyone that knows basic facts about your life being able to really make your life difficult. It isn't just people you cross paths with that could get into those accounts, it's scammers that want to social engineer you or have access to the numerous database leaks that are accessible to anyone with the Tor Browser installed. The answers to security questions are essentially passwords themselves, and they should be treated as such.
  - thinkloop 6y ago
    It's none of anyone's business! I generate one password for the password and a second password to break into 4 char random chunks for the security questions which I record in "notes" of the password manager.
    - ghaff 6y ago
      Meanwhile, in practice, when I had to do a brokerage transfer a couple months back virtually, the brokerage had a long list of security questions that they had apparently assembled from various credit reporting and other sources that I had to answer to make the transfer. The identity of my first pet or my city of birth is simply not a big concern of mine compared to the information widely available on me from all sorts of sources that I have no control over.
StanislavPetrov 6y ago
>I probably put rubbish data in the security questions as they weaken the security of the account. I had a similar problem, where I had created an account so long ago there were no security questions. They later added the security question requirement, but since I had never filled them out and they refused to accept a blank answer and I was forever locked out.
heavyset_go 6y ago
> I'm in a similar situation with Apple. I can't access my 10 years old account even though I know the password and control the email attached to it because I don't remember my security questions and I don't have my recovery email anymore I have an iPad that I let sit on a shelf for a while. During that time, Apple deleted the Apple account it was signed into. As a result, I cannot unlock the iPad or use it at all. I even made a new Apple account using the same username and password in an attempt to unlock it. No dice. Apple support won't help.
- randycupertino 6y ago
  These sort of problems are so aggravating and seem to take a disproportionate amount of mental and emotional energy to the problem. I'm not exactly sure why, either. Perhaps it's because trying to explain the issue to anyone else (support, spouse, etc) and catch them up on where you are, what the issue is and what's been tried already takes so long and then in the end that person is powerless to help. And to make any progress forward you have to be relentlessly tenacious and still the problem will fall on deaf ears. It's like the system is built against you to just force people to ultimately run out of steam trying to get it resolved and give up.
ttt0 6y ago
> I reached Apple support but they're unwilling to help, they even refuse to nuke the account as a last resort. I wonder, aren't they required to nuke the account under GDPR? It's probably tied to your real identity.
appsecthrowaway 6y ago
I was in a similar situation 3-4 years ago. The app store kept asking for answers to my security questions which I did not remember to have set up, ever. I went various rounds with their phone support trying answers on the phone (there are only so many reasonable answers for "Who was your first manager?") to no avail. Then I just enabled 2FA and the security questions requirement went away immediately. Back then, the whole thing smelled like a bug on their side to be honest.
- randycupertino 6y ago
  I had one recently where I was locked out of my medidata/Rave account for not knowing the answer for "Who was your best friend in 4th grade?" I seem to recall that I had a lot of different friends in 4th grade, and it was also blurring with crossover to 3rd and 5th grade etc. After spending hours on hold and escalating through the support, they finally unencrypted my answer and told me what it was and I had put our cat! Totally did not remember that. Since then I've started paying attention to the questions I select when I set up the passwords and trying to idiot-proof myself to something I will actually remember in 7 years, not trying to be clever in the response. As a bonus stick you in the ribs "revenge," when I finally was able to get it reset up and log in, I was gobsmacked to see that the customer support reps had assigned me mandatory extra remedial rave training to be completed before I could access the functional areas of the software! Lol. Touche.
yojo 6y ago
Not useful for your current case, but I recommend using a password manager to fill random phrases for security questions. That way they’re easy to read out over the phone to CS reps, but are more secure than literal answers, which can often be derived from publicly available info.
- randycupertino 6y ago
  Is there a password manager you recommend? I've never used one. Ty!
  - MaKey 6y ago
    Have a look at bitwarden [0], it's open source and has a free tier. [0] https://bitwarden.com/ https://bitwarden.com/

davidmurdoch 6y ago

I actually have the same issue with my Apple account I used back in the ipod days; they are now requiring that I answer my security question during log in. But I actually don't remember the answer to the security question, as I used to always put gibberish instead of a real answer. Back in those days these questions would only be used to reset your password, and I was confident I wouldn't forget the password. I've given up on getting that account sorted.

ghaff 6y ago
Furthermore, the answers to security questions aren't always stable. "What was your first pet?" Well, I know how I answer this question because one dog in particular I sort of consider my first pet. But I can remember dogs we had before that one so my answer is a somewhat arbitrary one.
- heavyset_go 6y ago
  By answering honestly, you also run the risk of having anyone that knows basic facts about your life being able to really make your life difficult. It isn't just people you cross paths with that could get into those accounts, it's scammers that want to social engineer you or have access to the numerous database leaks that are accessible to anyone with the Tor Browser installed. The answers to security questions are essentially passwords themselves, and they should be treated as such.
- thinkloop 6y ago
  It's none of anyone's business! I generate one password for the password and a second password to break into 4 char random chunks for the security questions which I record in "notes" of the password manager.
  - ghaff 6y ago
    Meanwhile, in practice, when I had to do a brokerage transfer a couple months back virtually, the brokerage had a long list of security questions that they had apparently assembled from various credit reporting and other sources that I had to answer to make the transfer. The identity of my first pet or my city of birth is simply not a big concern of mine compared to the information widely available on me from all sorts of sources that I have no control over.

StanislavPetrov 6y ago

>I probably put rubbish data in the security questions as they weaken the security of the account. I had a similar problem, where I had created an account so long ago there were no security questions. They later added the security question requirement, but since I had never filled them out and they refused to accept a blank answer and I was forever locked out.

heavyset_go 6y ago

> I'm in a similar situation with Apple. I can't access my 10 years old account even though I know the password and control the email attached to it because I don't remember my security questions and I don't have my recovery email anymore I have an iPad that I let sit on a shelf for a while. During that time, Apple deleted the Apple account it was signed into. As a result, I cannot unlock the iPad or use it at all. I even made a new Apple account using the same username and password in an attempt to unlock it. No dice. Apple support won't help.

randycupertino 6y ago
These sort of problems are so aggravating and seem to take a disproportionate amount of mental and emotional energy to the problem. I'm not exactly sure why, either. Perhaps it's because trying to explain the issue to anyone else (support, spouse, etc) and catch them up on where you are, what the issue is and what's been tried already takes so long and then in the end that person is powerless to help. And to make any progress forward you have to be relentlessly tenacious and still the problem will fall on deaf ears. It's like the system is built against you to just force people to ultimately run out of steam trying to get it resolved and give up.

ttt0 6y ago

> I reached Apple support but they're unwilling to help, they even refuse to nuke the account as a last resort. I wonder, aren't they required to nuke the account under GDPR? It's probably tied to your real identity.

appsecthrowaway 6y ago

I was in a similar situation 3-4 years ago. The app store kept asking for answers to my security questions which I did not remember to have set up, ever. I went various rounds with their phone support trying answers on the phone (there are only so many reasonable answers for "Who was your first manager?") to no avail. Then I just enabled 2FA and the security questions requirement went away immediately. Back then, the whole thing smelled like a bug on their side to be honest.

randycupertino 6y ago
I had one recently where I was locked out of my medidata/Rave account for not knowing the answer for "Who was your best friend in 4th grade?" I seem to recall that I had a lot of different friends in 4th grade, and it was also blurring with crossover to 3rd and 5th grade etc. After spending hours on hold and escalating through the support, they finally unencrypted my answer and told me what it was and I had put our cat! Totally did not remember that. Since then I've started paying attention to the questions I select when I set up the passwords and trying to idiot-proof myself to something I will actually remember in 7 years, not trying to be clever in the response. As a bonus stick you in the ribs "revenge," when I finally was able to get it reset up and log in, I was gobsmacked to see that the customer support reps had assigned me mandatory extra remedial rave training to be completed before I could access the functional areas of the software! Lol. Touche.

yojo 6y ago

Not useful for your current case, but I recommend using a password manager to fill random phrases for security questions. That way they’re easy to read out over the phone to CS reps, but are more secure than literal answers, which can often be derived from publicly available info.

randycupertino 6y ago
Is there a password manager you recommend? I've never used one. Ty!
- MaKey 6y ago
  Have a look at bitwarden [0], it's open source and has a free tier. [0] https://bitwarden.com/ https://bitwarden.com/