6 ms·
That isn't exactly fair. While shoulder surfing has been around forever, Apple has made it possible to reset everything -- including changing account recovery c
by timr 4y ago
That isn't exactly fair. While shoulder surfing has been around forever, Apple has made it possible to reset everything -- including changing account recovery codes, thus locking you out of your account forever -- by learning a short PIN.
Also, some comments on the article indicate that this only happens if you enable 2FA. If you don't enable 2FA, iOS demands your account password before making changes. That's a big deal, and something people should know.
- dijit 4y agoWhat? how can you change anything with the pin? Mine forces me to enter my password if I touch anything under iCloud. The pin can be used to disable ”Find My” though.
- timr 4y agoThe entire article is about how you can change literally everything with the PIN if someone steals it. > Mine forces me to enter my password if I touch anything under iCloud. Do you have 2FA enabled? Like I said, I've seen suggestions that your iCloud pw is required when you don't enable 2FA, but not required if you do. If this is true, it does seem like a vulnerability.
- cassianoleal 4y agoI have 2FA enabled and just confirmed I can change my iCloud password with only the PIN. This is surprising and worrying.