5 ms·

Reminder that when you take in a phone to get repaired you should back up the phone and erase all of its data. I feel like this type of stuff is common in small

Reminder that when you take in a phone to get repaired you should back up the phone and erase all of its data. I feel like this type of stuff is common in smaller repair shops.

javierbyte 5y ago
If your phone is broken you don't always have the option to do that.
- nytesky 5y ago
  Won't iCloud lost mode and remote erase mostly accomplish that? Not sure how many photos are cached on the phone in off-line mode, but that would remove icloud photo access at least.
  - michaelt 5y ago
    Fine advice if you already had your phone entirely backed up before it broke. But if your phone's broken and you know you don't have complete backups, I can understand being hesitant to hit the remote wipe button.
    - kergonath 5y ago
      Yeah, regular backups is a must.
Someone1234 5y ago
- If your phone is broken that may not be an option. - The victim isn't responsible for the crime committed against them, as shown by this verdict. - It is common because it is under-prosecuted. Hopefully we can see changes there.
- beagle3 5y ago
  > The victim isn't responsible for the crime committed against them, as shown by this verdict. The victim isn't responsible, but often the damage really is irreparable, and you don't even know who is the criminal (your private photos are online. Now what?), so it's a good idea to make the crime less likely to happen. As always, it's an effort-benefit tradeoff.
- least 5y ago
  > If your phone is broken that may not be an option. Definitely true, this is something that companies responsible for handling private data need to be more vigilant at. Whether that be finding a means to restrict access to that data (which Apple should be doing), training and supervision, restricted access to internet, or whatever, there's definitely more preventative measures that should be taken to ensure that this doesn't happen. > The victim isn't responsible for the crime committed against them, as shown by this verdict. No one is claiming that a victim is responsible for the crime committed against them, just that there are strategies to mitigate risk. You should prepare yourself for how things are, not how they should be. > It is common because it is under-prosecuted. Hopefully we can see changes there. It's hard to say how common it is, but ultimately it's a crime of opportunity. Maybe they need to stick the workers in a faraday cage so they can't connect the phones to the cell network or wifi.
- rswail 5y ago
  It wasn't a crime. It was a civil action. There was no verdict because Apple paid. Apple should implement a "send for service" option that configures the device so that service can be done without exposing the customer's information. All Apple customers for iPhones have an Apple ID. When the phone is in service mode, all the data is backed up to iCloud (irrespective of whether the customer has paid for it) and the phone wiped. The fact that an iPhone doesn't include at least as much iCloud storage as it has local storage for backup is ridiculous. After repair, the data is loaded back into the device before being returned to the customer.
  - stevehawk 5y ago
    > Apple should implement a "send for service" option that configures the device so that service can be done without exposing the customer's information. except that doesn't solve the problem if your phone is broken and you can't enable that option.
    - swiley 5y ago
      Just pull the storage out Oh wait.
    - Wintereise 5y ago
      It can be implemented in the same way remote erase is, remotely.
beagle3 5y ago
When I had to repair my phone, they asked me to write down the code; I refused, and said I'll wait there and unlock it when they need. Modern iPhones (and I would guess that's also true of Androids) apparently can be accessed by law enforcement - but AFAIK that involves disabling the lock-up counters and some form of brute-forcing, which takes time. 99% of the people just give the phone password to the tech. If I was a foreign intelligence service, I'd set up attractive repair shops around army bases and government offices (quick turn around, competent service, reasonable prices) and just mirror every phone that comes through. Most of it will be useless, but I'm sure that one can occasionally find some gold (in the form of documents or compromising material).
- flavius29663 5y ago
  And you don't even need to find compromising materials. You can find passwords and other credentials that later on you can use to get access to some service, and then jump higher from there.
- avs733 5y ago
  > I'd set up attractive repair shops around army bases and government offices (quick turn around, competent service, reasonable prices) and just mirror every phone that comes through. Most of it will be useless, but I'm sure that one can occasionally find some gold (in the form of documents or compromising material). 1) I would be surprised if that isn't already happening. 2) NOTHING is useless in intelligence work like that. It doesn't have to be directly and immediately useful, but you can learn an enormous amount through so called patterns or life analysis. 3) Information leakage via devices like this is an enormous problem. C.f., leaking the location of military bases through Strava logging or nuclear weapons storage information via flash card study apps
- LorenPechtel 5y ago
  Yeah. The times I've needed to have a phone serviced I simply was available to unlock when needed. So long as the service time is reasonably short it's the simplest approach.
Qw3r7 5y ago
I try and remember to do this with my car too.
waschl 5y ago
I wonder if smartphone vendors couldn’t provide a test mode which doesn’t require the unlock code for the phone. E.g. if I get my phone display replaced nobody needs access to my full personal data to test of the basics are working. There could be a special mode accessible which allows testing of standard use cases.
- kevincox 5y ago
  Android already has a boot menu. It would be useful even for consumers to have an option "Self-Test" added to that list. I think the only real concern would be the storage space required if the test suite was large.
yoz-y 5y ago
Indeed. Especially since if you bring an iPhone for a screen replacement, you have to give them your pin and disable Find My for it. (At least in the 6S era). This is because they need to run a diagnostic/callibration tool and that can not run on a locked phone. Naturally I told them to wait a minute to erase my phone, but the technician told me that I shouldn't bother because the phones are kept in a safe anyways. Naturally I have still politely asked them to wait until I erase the phone, but this might not be everybody's reflex. Edit: clarification, this was in an official Apple Store
- firmnoodle 5y ago
  Apple stores require this for screen repair or even battery replacement. I won't get my aging iphone X battery replaced for exactly this reason. It's too much work to erase my phone and restore it.
  - yoz-y 5y ago
    > It's too much work to erase my phone and restore it. Hmm, care to elaborate? I found the process quite easy, and done it multiple times. One thing that comes to mind is that if you don't have the iCloud backup option on for any reason, and you don't have a mac. Then you need to go through Windows iTunes which is really subpar. (no idea what to do on linux except a VM) I don't really complain about the need to reset the phone, I'd like them to be more consistent with the messaging thouhg.
- jxy 5y ago
  When I went to a local Apple Store to replace the battery of my iPhone 6, they asked me to disable Find My iPhone and explicitly told me to do a factory reset. I thought that was a good standard procedure, as I already did a reset though didn't disable Find My iPhone. On the other hand, when I went to repair the keyboard for my MacBook Pro, they did ask for my password. I refused, and they just said they would have to wipe the hard drive and do a reset. I guess it really depends on how responsible the individual "Apple Genius" is.
ars 5y ago
The entire reason I repair a phone instead of buying a new one is because I want the data on it. Erasing all the data completely defeats the entire purpose of the repair.
- saurik 5y ago
  FWIW, I think most people repair their device because it would cost much less--in some cases, nothing, but in most cases at least 3 if not 5-10 times less--than it would cost to replace the phone.
  - ars 5y ago
    Under warranty I guess that true. But I've found that once not under warranty a repair costs the same as buying a working used one.
kevincox 5y ago
I broke the screen on my phone. I would rather not have to reset it if not required. (It isn't critical, I have fairly easy backups and restores, but would still prefer not to go through that). My threat model is low risk enough that I trust the full-disk encryption of my phone. So it makes sense for me to send my phone in with all of the data to avoid the reinstall.

Reminder that when you take in a phone to get repaired you should back up the phone and erase all of its data. I feel like this type of stuff is common in smaller repair shops.

javierbyte 5y ago

If your phone is broken you don't always have the option to do that.

nytesky 5y ago
Won't iCloud lost mode and remote erase mostly accomplish that? Not sure how many photos are cached on the phone in off-line mode, but that would remove icloud photo access at least.
- michaelt 5y ago
  Fine advice if you already had your phone entirely backed up before it broke. But if your phone's broken and you know you don't have complete backups, I can understand being hesitant to hit the remote wipe button.
  - kergonath 5y ago
    Yeah, regular backups is a must.

Someone1234 5y ago

- If your phone is broken that may not be an option. - The victim isn't responsible for the crime committed against them, as shown by this verdict. - It is common because it is under-prosecuted. Hopefully we can see changes there.

beagle3 5y ago
> The victim isn't responsible for the crime committed against them, as shown by this verdict. The victim isn't responsible, but often the damage really is irreparable, and you don't even know who is the criminal (your private photos are online. Now what?), so it's a good idea to make the crime less likely to happen. As always, it's an effort-benefit tradeoff.
least 5y ago
> If your phone is broken that may not be an option. Definitely true, this is something that companies responsible for handling private data need to be more vigilant at. Whether that be finding a means to restrict access to that data (which Apple should be doing), training and supervision, restricted access to internet, or whatever, there's definitely more preventative measures that should be taken to ensure that this doesn't happen. > The victim isn't responsible for the crime committed against them, as shown by this verdict. No one is claiming that a victim is responsible for the crime committed against them, just that there are strategies to mitigate risk. You should prepare yourself for how things are, not how they should be. > It is common because it is under-prosecuted. Hopefully we can see changes there. It's hard to say how common it is, but ultimately it's a crime of opportunity. Maybe they need to stick the workers in a faraday cage so they can't connect the phones to the cell network or wifi.
rswail 5y ago
It wasn't a crime. It was a civil action. There was no verdict because Apple paid. Apple should implement a "send for service" option that configures the device so that service can be done without exposing the customer's information. All Apple customers for iPhones have an Apple ID. When the phone is in service mode, all the data is backed up to iCloud (irrespective of whether the customer has paid for it) and the phone wiped. The fact that an iPhone doesn't include at least as much iCloud storage as it has local storage for backup is ridiculous. After repair, the data is loaded back into the device before being returned to the customer.
- stevehawk 5y ago
  > Apple should implement a "send for service" option that configures the device so that service can be done without exposing the customer's information. except that doesn't solve the problem if your phone is broken and you can't enable that option.
  - swiley 5y ago
    Just pull the storage out Oh wait.
  - Wintereise 5y ago
    It can be implemented in the same way remote erase is, remotely.

beagle3 5y ago

When I had to repair my phone, they asked me to write down the code; I refused, and said I'll wait there and unlock it when they need. Modern iPhones (and I would guess that's also true of Androids) apparently can be accessed by law enforcement - but AFAIK that involves disabling the lock-up counters and some form of brute-forcing, which takes time. 99% of the people just give the phone password to the tech. If I was a foreign intelligence service, I'd set up attractive repair shops around army bases and government offices (quick turn around, competent service, reasonable prices) and just mirror every phone that comes through. Most of it will be useless, but I'm sure that one can occasionally find some gold (in the form of documents or compromising material).

flavius29663 5y ago
And you don't even need to find compromising materials. You can find passwords and other credentials that later on you can use to get access to some service, and then jump higher from there.
avs733 5y ago
> I'd set up attractive repair shops around army bases and government offices (quick turn around, competent service, reasonable prices) and just mirror every phone that comes through. Most of it will be useless, but I'm sure that one can occasionally find some gold (in the form of documents or compromising material). 1) I would be surprised if that isn't already happening. 2) NOTHING is useless in intelligence work like that. It doesn't have to be directly and immediately useful, but you can learn an enormous amount through so called patterns or life analysis. 3) Information leakage via devices like this is an enormous problem. C.f., leaking the location of military bases through Strava logging or nuclear weapons storage information via flash card study apps
LorenPechtel 5y ago
Yeah. The times I've needed to have a phone serviced I simply was available to unlock when needed. So long as the service time is reasonably short it's the simplest approach.

Qw3r7 5y ago

I try and remember to do this with my car too.

waschl 5y ago

I wonder if smartphone vendors couldn’t provide a test mode which doesn’t require the unlock code for the phone. E.g. if I get my phone display replaced nobody needs access to my full personal data to test of the basics are working. There could be a special mode accessible which allows testing of standard use cases.

kevincox 5y ago
Android already has a boot menu. It would be useful even for consumers to have an option "Self-Test" added to that list. I think the only real concern would be the storage space required if the test suite was large.

yoz-y 5y ago

Indeed. Especially since if you bring an iPhone for a screen replacement, you have to give them your pin and disable Find My for it. (At least in the 6S era). This is because they need to run a diagnostic/callibration tool and that can not run on a locked phone. Naturally I told them to wait a minute to erase my phone, but the technician told me that I shouldn't bother because the phones are kept in a safe anyways. Naturally I have still politely asked them to wait until I erase the phone, but this might not be everybody's reflex. Edit: clarification, this was in an official Apple Store

firmnoodle 5y ago
Apple stores require this for screen repair or even battery replacement. I won't get my aging iphone X battery replaced for exactly this reason. It's too much work to erase my phone and restore it.
- yoz-y 5y ago
  > It's too much work to erase my phone and restore it. Hmm, care to elaborate? I found the process quite easy, and done it multiple times. One thing that comes to mind is that if you don't have the iCloud backup option on for any reason, and you don't have a mac. Then you need to go through Windows iTunes which is really subpar. (no idea what to do on linux except a VM) I don't really complain about the need to reset the phone, I'd like them to be more consistent with the messaging thouhg.
jxy 5y ago
When I went to a local Apple Store to replace the battery of my iPhone 6, they asked me to disable Find My iPhone and explicitly told me to do a factory reset. I thought that was a good standard procedure, as I already did a reset though didn't disable Find My iPhone. On the other hand, when I went to repair the keyboard for my MacBook Pro, they did ask for my password. I refused, and they just said they would have to wipe the hard drive and do a reset. I guess it really depends on how responsible the individual "Apple Genius" is.

ars 5y ago

The entire reason I repair a phone instead of buying a new one is because I want the data on it. Erasing all the data completely defeats the entire purpose of the repair.

saurik 5y ago
FWIW, I think most people repair their device because it would cost much less--in some cases, nothing, but in most cases at least 3 if not 5-10 times less--than it would cost to replace the phone.
- ars 5y ago
  Under warranty I guess that true. But I've found that once not under warranty a repair costs the same as buying a working used one.

kevincox 5y ago

I broke the screen on my phone. I would rather not have to reset it if not required. (It isn't critical, I have fairly easy backups and restores, but would still prefer not to go through that). My threat model is low risk enough that I trust the full-disk encryption of my phone. So it makes sense for me to send my phone in with all of the data to avoid the reinstall.