3 ms·

I don't agree with much of what you're saying. Physical access is not game over, there should be additional layers of security (i.e. a passcode) to actually unl

I don't agree with much of what you're saying. Physical access is not game over, there should be additional layers of security (i.e. a passcode) to actually unlock the device. And even if you have unlocked one device, there should be additional barriers to escalate that privilege to other devices (i.e. by requiring the Apple ID password). There's also a big difference in the passcode and Apple ID password. The passcode is required several times a day. Failing a FaceID unlock is very common. Having an alpha-numeric passcode is, honestly, a huge pain in the behind. The Apple ID password on the other hand is not required very often, and can easily be stored in a password manager. Storing the passcode in a password manager doesn't make much sense, as you'd then need to unlock a second device to open your password manager to read the passcode to unlock the first device.

traceroute66 3y ago
> Physical access is not game over, there should be additional layers of security (i.e. a passcode) Please re-read what I said. In particular I point you to the "AND" in capital letters. ;-) As I said. Apple gives you the tools. Use them.
- larsnystrom 3y ago
  I skipped that part because you're talking about guessable passwords, but the threat the artice is talking about is someone watching you type in your passcode and then stealing your iPhone. The point I'm trying to make is that I don't think that should be game over, there should be additional barriers to prevent escalation from single device access to Apple account/multi-device access. Guessable passwords are of course not good, but to a human a six digit password is actually pretty hard to guess. The auto-wipe feature introduces a new vulnerability where anyone with physical access to your phone for a minute can wipe it for you. This is a very high-risk threat scenario for people with toddlers in their home. Remote-wiping the phone from the Apple website is fine, but from what I understand in the article, the thief has already taken control of your account by the time you're home/have access to a second device to do so. However, it seems Apple actually does provide the tools to avoid the issue in the article, which is to use a second password for Screen Time and add some restrictions. So we can agree on that point :)
  - traceroute66 3y ago
    > The auto-wipe feature introduces a new vulnerability where anyone with physical access to your phone for a minute can wipe it for you. Its called backup. What happens if you loose your phone or drop it in a river ? You'll be in the same boat in those scenarios as you would if someone local-wiped your phone.
    - misnome 3y ago
      Dropping your phone in a river won’t lock you out of your account for accessing those backups.
  - elephanlemon 3y ago
    I just went to set up a screen time passcode after reading the article… you are limited to a four digit code. It does limit the number of attempts you can make, but I can’t believe a four digit code is all that’s standing in the way of total account ruin.
    - danso 3y ago
      That seems like it should be enough protection. The goal of most thieves is to drain your bank account/Apple Pay. Changing your account password gives them more time to take advantage of your account, but most of them aren't interested in doing a deep dive in your personal life, or care that you're locked out of your Apple account. A rate-limited 4-digit passcode gives you breathing room to login to your Apple account and report your phone as stolen.

traceroute66 3y ago

> Physical access is not game over, there should be additional layers of security (i.e. a passcode) Please re-read what I said. In particular I point you to the "AND" in capital letters. ;-) As I said. Apple gives you the tools. Use them.

larsnystrom 3y ago
I skipped that part because you're talking about guessable passwords, but the threat the artice is talking about is someone watching you type in your passcode and then stealing your iPhone. The point I'm trying to make is that I don't think that should be game over, there should be additional barriers to prevent escalation from single device access to Apple account/multi-device access. Guessable passwords are of course not good, but to a human a six digit password is actually pretty hard to guess. The auto-wipe feature introduces a new vulnerability where anyone with physical access to your phone for a minute can wipe it for you. This is a very high-risk threat scenario for people with toddlers in their home. Remote-wiping the phone from the Apple website is fine, but from what I understand in the article, the thief has already taken control of your account by the time you're home/have access to a second device to do so. However, it seems Apple actually does provide the tools to avoid the issue in the article, which is to use a second password for Screen Time and add some restrictions. So we can agree on that point :)
- traceroute66 3y ago
  > The auto-wipe feature introduces a new vulnerability where anyone with physical access to your phone for a minute can wipe it for you. Its called backup. What happens if you loose your phone or drop it in a river ? You'll be in the same boat in those scenarios as you would if someone local-wiped your phone.
  - misnome 3y ago
    Dropping your phone in a river won’t lock you out of your account for accessing those backups.
- elephanlemon 3y ago
  I just went to set up a screen time passcode after reading the article… you are limited to a four digit code. It does limit the number of attempts you can make, but I can’t believe a four digit code is all that’s standing in the way of total account ruin.
  - danso 3y ago
    That seems like it should be enough protection. The goal of most thieves is to drain your bank account/Apple Pay. Changing your account password gives them more time to take advantage of your account, but most of them aren't interested in doing a deep dive in your personal life, or care that you're locked out of your Apple account. A rate-limited 4-digit passcode gives you breathing room to login to your Apple account and report your phone as stolen.