4 ms·
Yesterday I tried to help out my motorcycle instructor (and owner of the entire motorcycle school) whose business Facebook page had disappeared (the business ac
by rcarr 4y ago
Yesterday I tried to help out my motorcycle instructor (and owner of the entire motorcycle school) whose business Facebook page had disappeared (the business account was still there). I downloaded the logs for the account and they were blank too, it was like the page never existed. I have no idea if:
- He or an employee deleted it accidentally
- Facebook deleted it.
- His account was hacked and it was deleted
He had no form of 2FA switched on so I tried to help him set it up in case it was the latter in order to prevent it happening again. My first port of call was to try and use the built in Apple passwords in the iPhone settings that now allows you to scan QR codes and set keys. To my surprise, the setting was not there. Why? Because he was using an iPhone that cannot update past iOS 12.
It got worse. Rather than dotting out the passwords and requiring you to click on them to reveal them, the passwords were just sitting there in plain sight for all to see. If I had been a black hat I would have been having a field day.
After failing with the built in Apple option I tried to download a third party authenticator app but there were no applications in the App Store that supported iOS 12. In the end I had to settle for SMS authentication.
I asked him why he was still using such an old iPhone (he could clearly afford to update to a newer model) and explained the security risks of using such an old device. His response was that he didn’t like phones and didn’t want to spend any money on another one.
I get the scepticism around Apple doing this but I’m not entirely sure it’s a bad thing.
- prepend 4y ago> It got worse. Rather than dotting out the passwords and requiring you to click on them to reveal them, the passwords were just sitting there in plain sight for all to see. Isn’t this only once you authenticate with password or biometrics? The passwords are shown in clear text so they can be cut and pasted for use. I don’t think this is a risk as it means someone gave you access to the device password in the first place.
- rcarr 4y agoI believe so yes. But it is still better practice to have them dotted out until clicked on to minimise the chances of other people seeing them.