28 ms·

Apple authorized repair leaks customer's sex tape during iPhone repair

18 points by mclightning 5y ago

ThePowerOfFuet 5y ago
They don't ask for your passcode to effect a repair, as they don't need it. Did she have no passcode on the device at all?
- finger 5y ago
  The article only mentions the employees posted it from her Facebook account. Protocols have likely changed significantly since this happened in 2016.
  - ThePowerOfFuet 5y ago
    >The article only mentions the employees posted it from her Facebook account. Protocols have likely changed significantly since this happened in 2016. Right — presumably directly from her phone, which is also where the photos and video were stored. Hence, since they don't ask for the device passcode during service, I'm suggesting that the owner may well have not had a passcode on it at all, allowing the repair facility unfettered access to its content, including the ability to post as her from her Facebook account.
- zimpenfish 5y ago
  > Did she have no passcode on the device at all? It shouldn't matter if she did or not, surely. You have an (entirely reasonable) expectation that sending your device in to an official repair place does not involve technicians going through your content.
  - ThePowerOfFuet 5y ago
    You should hope that they don't, but that argument is a straw man; what if the phone was lost or stolen?
    - vimacs2 5y ago
      I don't see how that's a straw man argument when your prior comment was clearly implying that she should not just assume that a hired technician won't sift through her personal data. You're also assuming that she did not just disable her lock code prior to giving the phone for repair. For a non-tech person, it's a reasonable assumption that somebody might have trouble fixing a device that they're locked out of.
      - ThePowerOfFuet 5y ago
        >I don't see how that's a straw man argument when your prior comment was clearly implying that she should not just assume that a hired technician won't sift through her personal data. I maintain that, while what happened is terrible and indefensible, that's not a safe assumption to make. >You're also assuming that she did not just disable her lock code prior to giving the phone for repair. For a non-tech person, it's a reasonable assumption that somebody might have trouble fixing a device that they're locked out of. Apple instructs you during the service booking process to back up the device and erase it before sending it in for service, which is also documented elsewhere [0]. [0] https://support.apple.com/en-us/HT201557 https://support.apple.com/en-us/HT201557
        vimacs2 5y ago
        Ok, so it was not a straw man argument, then. I feel like you're veering dangerously close to victim blaming here. Them asking the customer to erase their devices to "protect their data" seems like a thinly veiled attempt to cover their asses if one of their apparently not well vetted technicians decide to violate somebody's privacy illegally. It also sounds like a major pain in the ass especially for people who don't own a computer to backup that data to. I have no sympathy for Apple here especially considering the level of FUD they spread about the Right to Repair movement exposing your Apple device to allegedly dangerous third party technicians.
        ThePowerOfFuet 5y ago
        It has nothing to do with people owning a PC; that's absolutely irrelevant. I also never even implied either Apple or the subcontractor should be held in sympathy. The default on iOS is a 6-digit PIN for which you get ten attempts, with an increasing penalty after the first few. iOS really really pushes you to set a passcode. If you bypass that, then that's on you, even more so when your device contains anything you wouldn't like others to see, be it lost or stolen or submitted for service.
- MikeDelta 5y ago
  I do see that they can ask for a passcode or have you turn it off, especially for 'screen calibration' [0]. I see similar discussions on the Apple forum. The official guidelines don't mention it explicitly. [0] https://discussions.apple.com/thread/6762585 https://discussions.apple.com/thread/6762585
  - ThePowerOfFuet 5y ago
    From your own link: >I refused to provide mine just now. Genius consulted with someone else and was advised the password is not necessary after iOS 10.3. Weird. Apple also doesn't mention the need for the passcode at all, only that you'll need your Apple ID's password to disable Find My iPhone (to prove the device is yours). In fact, Apple specifically instructs you to back up your device and wipe it before sending it in for service [0]. [0] https://support.apple.com/en-us/HT201557 https://support.apple.com/en-us/HT201557
    - MikeDelta 5y ago
      Indeed, so it seems you can do without giving your password but apparently with a bit of pushing back. I saw the instruction of Apple to wipe your phone. It is solid advice, but not sure what conclusion to draw from this. On one hand this is something you always want to do, no matter the security you have on your machine, in order to reduce potential attack vectors. This advice you will give even if your repair people have no access to the device. But I can also interpret is as advice because they will have access to your phone so better clean it before handing it in. Good to know we can refuse.
- matt-attack 5y ago
  I had the keyboard replaced on a MacBook under warranty at an authorized repair facility. I had to continually decline to give them my FDE password. They fist wanted it written down on a sticky when I dropped it off. Then they asked for it several other times to “verify” it was working. I kept telling them that you can test a keyboard just fine at the login prompt. The whole experience was pretty shocking.
  - ThePowerOfFuet 5y ago
    Please report this to Apple; the AASP was not following the rules.
    - nsajko 5y ago
      > Please report this to Apple; the AASP was not following the rules. Which rules exactly? I wouldn't be surprised if a rule like you imply indeed exists, but it seems that it's inconsequential if it exists, judging by the experiences of many customers.
infopedia 5y ago
Apple use to say "what happens on your iPhone, stays on your iPhone."
sschueller 5y ago
If Apple's legal team would not have tried to recover the money from the authorized repair place this would still be under NDA and no one would have known. Of course the authorized resellers' insurance will try to avoid paying anything. I wonder if Apple legal now thinks the 5 million would have been worth eating to avoid this PR disaster.

18 points by mclightning 5y ago

They don't ask for your passcode to effect a repair, as they don't need it. Did she have no passcode on the device at all?

finger 5y ago
The article only mentions the employees posted it from her Facebook account. Protocols have likely changed significantly since this happened in 2016.
- ThePowerOfFuet 5y ago
  >The article only mentions the employees posted it from her Facebook account. Protocols have likely changed significantly since this happened in 2016. Right — presumably directly from her phone, which is also where the photos and video were stored. Hence, since they don't ask for the device passcode during service, I'm suggesting that the owner may well have not had a passcode on it at all, allowing the repair facility unfettered access to its content, including the ability to post as her from her Facebook account.
zimpenfish 5y ago
> Did she have no passcode on the device at all? It shouldn't matter if she did or not, surely. You have an (entirely reasonable) expectation that sending your device in to an official repair place does not involve technicians going through your content.
- ThePowerOfFuet 5y ago
  You should hope that they don't, but that argument is a straw man; what if the phone was lost or stolen?
  - vimacs2 5y ago
    I don't see how that's a straw man argument when your prior comment was clearly implying that she should not just assume that a hired technician won't sift through her personal data. You're also assuming that she did not just disable her lock code prior to giving the phone for repair. For a non-tech person, it's a reasonable assumption that somebody might have trouble fixing a device that they're locked out of.
    - ThePowerOfFuet 5y ago
      >I don't see how that's a straw man argument when your prior comment was clearly implying that she should not just assume that a hired technician won't sift through her personal data. I maintain that, while what happened is terrible and indefensible, that's not a safe assumption to make. >You're also assuming that she did not just disable her lock code prior to giving the phone for repair. For a non-tech person, it's a reasonable assumption that somebody might have trouble fixing a device that they're locked out of. Apple instructs you during the service booking process to back up the device and erase it before sending it in for service, which is also documented elsewhere [0]. [0] https://support.apple.com/en-us/HT201557 https://support.apple.com/en-us/HT201557
      - vimacs2 5y ago
        Ok, so it was not a straw man argument, then. I feel like you're veering dangerously close to victim blaming here. Them asking the customer to erase their devices to "protect their data" seems like a thinly veiled attempt to cover their asses if one of their apparently not well vetted technicians decide to violate somebody's privacy illegally. It also sounds like a major pain in the ass especially for people who don't own a computer to backup that data to. I have no sympathy for Apple here especially considering the level of FUD they spread about the Right to Repair movement exposing your Apple device to allegedly dangerous third party technicians.
        ThePowerOfFuet 5y ago
        It has nothing to do with people owning a PC; that's absolutely irrelevant. I also never even implied either Apple or the subcontractor should be held in sympathy. The default on iOS is a 6-digit PIN for which you get ten attempts, with an increasing penalty after the first few. iOS really really pushes you to set a passcode. If you bypass that, then that's on you, even more so when your device contains anything you wouldn't like others to see, be it lost or stolen or submitted for service.
MikeDelta 5y ago
I do see that they can ask for a passcode or have you turn it off, especially for 'screen calibration' [0]. I see similar discussions on the Apple forum. The official guidelines don't mention it explicitly. [0] https://discussions.apple.com/thread/6762585 https://discussions.apple.com/thread/6762585
- ThePowerOfFuet 5y ago
  From your own link: >I refused to provide mine just now. Genius consulted with someone else and was advised the password is not necessary after iOS 10.3. Weird. Apple also doesn't mention the need for the passcode at all, only that you'll need your Apple ID's password to disable Find My iPhone (to prove the device is yours). In fact, Apple specifically instructs you to back up your device and wipe it before sending it in for service [0]. [0] https://support.apple.com/en-us/HT201557 https://support.apple.com/en-us/HT201557
  - MikeDelta 5y ago
    Indeed, so it seems you can do without giving your password but apparently with a bit of pushing back. I saw the instruction of Apple to wipe your phone. It is solid advice, but not sure what conclusion to draw from this. On one hand this is something you always want to do, no matter the security you have on your machine, in order to reduce potential attack vectors. This advice you will give even if your repair people have no access to the device. But I can also interpret is as advice because they will have access to your phone so better clean it before handing it in. Good to know we can refuse.
matt-attack 5y ago
I had the keyboard replaced on a MacBook under warranty at an authorized repair facility. I had to continually decline to give them my FDE password. They fist wanted it written down on a sticky when I dropped it off. Then they asked for it several other times to “verify” it was working. I kept telling them that you can test a keyboard just fine at the login prompt. The whole experience was pretty shocking.
- ThePowerOfFuet 5y ago
  Please report this to Apple; the AASP was not following the rules.
  - nsajko 5y ago
    > Please report this to Apple; the AASP was not following the rules. Which rules exactly? I wouldn't be surprised if a rule like you imply indeed exists, but it seems that it's inconsequential if it exists, judging by the experiences of many customers.

infopedia 5y ago

Apple use to say "what happens on your iPhone, stays on your iPhone."

sschueller 5y ago

If Apple's legal team would not have tried to recover the money from the authorized repair place this would still be under NDA and no one would have known. Of course the authorized resellers' insurance will try to avoid paying anything. I wonder if Apple legal now thinks the 5 million would have been worth eating to avoid this PR disaster.