6 ms·

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the A

I hate Apple products for this. I see this pattern across all apple products - not one. On my mac, I setup my touch ID, and log in to my Apple account on the App Store. Time and again, when I try to install apps, it keeps repeatedly prompting for my password, instead of letting me just use my touchID. This applies to free apps as well, which is again silly beyond what is already enough silliness. I briefly see this on my spouse's iPhone as well. Almost felt like Apple hasn't changed a bit after all these years. It keeps fucking prompting for password over and over, randomly when installing apps. although the phone is secured with a touch ID. This happens especially when you reset the phone and starting from scratch - it keeps prompting for the Apple password again and again.

paxys 1y ago
And it's even worse if you are accessing Apple services on a non-Apple device. No matter how many times I click "trust device" when logging in to icloud.com it will still make me do the password + one-time code song and dance the next day. Another pointless annoyance - if Face ID fails when making a payment or installing an app (like it frequently does for reasons like sleeping in bed or wearing sunglasses) it won't fall back to PIN but ask you to enter your Apple account password. Why?? And of course when you're on that prompt there's no way to open your password manager without cancelling out of it entirely. Makes for a fun experience at the checkout counter...
- thyristan 1y ago
  Microsoft crap is similarly broken. After each and every login there is the question whether it should remember me and whether it should ask that question again. It doesn't matter at all what you answewr there, it changes absolutely nothing.
  - count 1y ago
    Disable anti-tracking features and ad blocks, it turns out cookies and temp storage for ad tracking are how IDPs track your choice to trust the device too.
    - thyristan 1y ago
      Adblocking and anti-tracking are mandatory on my company laptop, cannot switch those off. And I wouldn't want to.
      - notpushkin 1y ago
        This is actually one great use for an MDM policy.
    - xp84 1y ago
      Most adblockers etc are pretty selective about cookies. I guess if you got really aggressive like an allow-list approach, you could have friction, but just using ublock's defaults I don't get 'unrecognized' from anything any quicker than I do on a device without it.
  - wycy 1y ago
    I wonder how many millions of productivity hours have been lost due to millions of people having to click through these stupid, useless prompts countless times per day.
  - antod 1y ago
    That is the single most useless dialog/question in IT. I wonder how much money that costs the global economy a year.
- mlinhares 1y ago
  Why in the world does it need you to type a code id you have already accepted it at the other device? This whole flow is stupid, I guess they want to cover their asses.
  - reddalo 1y ago
    I agree with you, but it's the same reason why Microsoft asks you to type a numeric code generated by their Outlook app in order to login. It's to prevent people from dismissing the alert by clicking "OK" without even reading (especially if they're in the middle of something else, e.g. during a scam phone call).
    - brendoelfrendo 1y ago
      Right, the numeric code is proof of intent. In theory, tapping "ok" or "yes, this is me" should be proof of intent. In reality, it's common for those who have compromised someone's password to flood people with these notifications and auth prompts to get them to eventually say "ok," even if by accident.
      - deepsun 1y ago
        Duo Mobile at least make it two clicks (on Android at least). So a distracted user would likely to swipe off the notification, instead of tapping through and clicking "Yes, it is me" on the next screen.
      - mrandish 1y ago
        > it's common for those who have compromised someone's password to flood people with these notifications and auth prompts And by excessive reauthing, legit platforms and apps are helping scammers by conditioning users to click "OK" or enter a passcode reflexively just to get on with their lives. Frequent reauth makes everyone less secure.
        brendoelfrendo 1y ago
        I don't disagree, and I appreciate your keeping the conversation on-topic, but that's very much an incomplete picture. I think our modern app ecosystem as a whole conditions users to click "OK" reflexively. A hypothetical app wants permissions for your camera, location, and file storage. If you click OK, you can use the app. If you don't, some functions may not work. I think the average user gets caught in the desire to use an app for its intended purpose and the need to tinker with settings - which they may or may not understand - if they want to use that app securely. So, they just say OK to everything. Of course, that's not the only situation with these push notifications. MFA fatigue attacks are a real thing, hammering the user with as many notifications as they can in a short time. Maybe the user assumes it's a bug, maybe they try to deny the push notification but eventually hit the wrong button, maybe they just want it to stop; it's not so much about exploiting user conditioning as it is assuming that if you force people into an unfamiliar situations, that some of them will eventually slip up.
- altairprime 1y ago
  It often falls back to PIN if you retry faceid three times. But if the app is using faceid as a biometric second factor, in addition to or instead of as a password caching mechanism, then a device PIN is not biometric attestation and so it downgrades to full password.
- whiplash451 1y ago
  In 2025, I don’t think that accessing apple accounts on a non-apple device is a happy path for apple anymore.
  - apitman 1y ago
    "Trust this device" is the modern day elevator door close button.
    - princevegeta89 1y ago
      Haha
    - arccy 1y ago
      I've found that it's only american elevator door close buttons that don't work. The rest of the world manages to keep them operational.
      - pests 1y ago
        On US elevators there is a minimum open duration to accommodate the handicapped or disabled. The door close button can’t force the door closed any faster. Then most set the auto-close duration equal to this minimum open duration and you get this appearance of buttons doing nothing.
        deleted 1y ago
        [deleted]
      - CjHuber 1y ago
        As a obsessive door close button presser, I can definitely tell you that there are many elevators in Europe where the button doesnt work either
- chrisweekly 1y ago
  related pet peeve: faceid is often (but unpredictably) really slow - like, I'm looking at the phone and in a hurry and would prefer to enter my pin but touching the screen goes back to the lockscreen, and swiping up starts faceid again.
- KennyBlanken 1y ago
  > if Face ID fails when making a payment or installing an app (like it frequently does for reasons like sleeping in bed or wearing sunglasses) it won't fall back to PIN but ask you to enter your Apple account password. What? FaceID will prompt for a re-try. Always. It will never fail once and then refuse to do FaceID. If you can't figure out to lift the sunglasses off your face or sit up in bed for a second, that's not anyone's fault but your own. Also, FaceID will never fall back to your account password for Apple Wallet transactions with a physical credit card reader.
  - apenwarr 1y ago
    You’re right except in the very specific case of the App Store purchase or download process. You only get one chance at FaceID and then it demands a password. But, if you cancel and do it again, you get another chance at FaceID. It’s mystifying why they’d make that UX choice.
- vachina 1y ago
  Dismiss the password prompt and reinitiate the auth, FaceID will work again. I’m not sure why Apple doesn’t let us retry FaceID on the get go, but at least theres this method.
MBCook 1y ago
Really? I never have to re-auth unless I get a new device.
- quesera 1y ago
  Same behavior here. I use TouchID to log in several times per day, and am required to enter a password "to enable TouchID" about once per week. iOS and macOS both. This feels reasonable to me.
  - ziml77 1y ago
    It's annoying to ever have to enter a password manually, but it does make sense every 1 or 2 weeks to force it. Not even as a security thing but as a memory thing. It's incredible how something that you seem to know so well can get flushed from your memory after you stop recalling that knowledge regularly.
    - quesera 1y ago
      Exactly. I have enabled TouchID for a couple of banking apps, and I am dreading the likely need for the password reset dance when the time comes (it's been years). I use a password manager, but I've always kept the actually important passwords in wet memory only. When I used the web interface regularly, that was not a problem. However... :-/
grishka 1y ago
Also, on both macOS and Android, there's a time component to device unlocking. You would sometimes get this stupid "your password is required to enable touch ID" or "extra security required, pattern not used in a while" thing with no way to disable it. It's beyond infuriating to me. It's my device. It should not tell me what to do. I get to tell it what to do and it obeys, unquestionably. I'll evaluate my own risks, thank you very much.
- 1718627440 1y ago
  > macOS and Android > It's my device. There is your dissonance.
- yard2010 1y ago
  This is just enshitification in a mask. Next thing you know, guess what? Your device is not yours, you just rent it from the feudal.
socalgal2 1y ago
Also, every time I plug my iPhone into my Mac for syncing it asks "Trust this Device" both the Mac and the iPhone. I click "yes" and yet it asks again next time.
- grishka 1y ago
  Remembering things reliably must be the most unsolvable problem in computer science. Unless it's related to advertising. Then it works flawlessly and sometimes survives device transfers and factory resets.
  - falcor84 1y ago
    "The best minds of my generation are thinking about how to make people click ads." -Jeff Hammerbacher
    - olddustytrail 1y ago
      I saw the best minds of my generation destroyed by madness, starving hysterical naked, dragging themselves through the negro streets at dawn looking for an angry fix
      - Y_Y 1y ago
        How is that supposed to make anyone click on an ad?
        falcor84 1y ago
        Just to expand upon the reference, the comment you responded to is the first stanza of Allen Ginsberg poem "Howl" [0] published in 1956, which is what Hammerbacher paraphrased in the quote that I shared. "Howl" is amazing on its own though, and I highly recommend that people read the whole thing and/or watch the 2010 film about Ginsberg's life where James Franco recites it in its entirety[1]. And as a follow-up, I also highly recommend Scott Alexander's "Meditations on Moloch" that takes inspiration from the poem to analyze societal failures of coordination. [0] https://www.poetryfoundation.org/poems/49303/howl https://www.poetryfoundation.org/poems/49303/howl [1] https://www.imdb.com/title/tt1049402/ https://www.imdb.com/title/tt1049402/ [2] https://slatestarcodex.com/2014/07/30/meditations-on-moloch/ https://slatestarcodex.com/2014/07/30/meditations-on-moloch/
sircastor 1y ago
I have a very old iPad that my kid uses. It’s stuck to iOS 10.3. Also, it can’t use my password manager. The browser is so old that the website won’t load (32-bit app). And the PW manager app isn’t made for this old a device. So Apple wants me to type in my 50+ character password every time I use the App Store app. It’s such a pain.
- paxys 1y ago
  If it helps there's no security advantage of a 50+ character password over a suitable 16 character one.
  - mikepurvis 1y ago
    Remember how 1Password used to install itself as a custom keyboard that could "type" your passwords into arbitrary text fields anywhere in the OS, before password management specific hooks were added? It would be nifty if your phone could just connect to other devices as a BT keyboard and type in passwords there too. Probably not worth the actual fuss of pairing a BT device, but if that part were not so painful it could be quite a nice solution.
    - alasarmas 1y ago
      One major flaw in this approach is the one-way channel (keyboard input) prevents the password manager from knowing if it is supplying credentials to the correct recipient. Phishing attacks are relatively common and users expect a password manager to know these things, even in situations like you have described where it’s clearly impossible. I think this is why this approach hasn’t succeeded in the marketplace and FIDO2/WebAuthn support seem to be table stakes.
      - mikepurvis 1y ago
        Yeah, certainly a proper security module / passkey-type approach is ideal, it would be hard to justify all the bother of developing a bluetooth typer if really the only use-case for it is legacy devices that are old enough to not have an OS supporting the client app, but new enough to still pair with a device pretending to be a bluetooth keyboard.
CamperBob2 1y ago
I'm not surprised that it occasionally prompts for a password (about once or twice a week for me), because otherwise people will forget their passwords and bug them about it. The problem I have is that it doesn't explain who wants the password or why, and the prompts aren't associated with any particular action on my part. Instead, Apple is conditioning people to mindlessly type in their password on demand. Why in the world are they doing a stupid, dangerous, counterproductive thing like that?
- hamburglar 1y ago
  Yes, it’s really bad for security. I just deny it if I don’t know what it’s for. I’m sure I’m missing out on some very important functionality.
  - CamperBob2 1y ago
    My understanding is that iCloud backup requires it, among who-knows-what other things. So I've been reluctant to hit "Not now." I just have to trust their security model to not allow random apps to pop up and issue those prompts.
    - ryandrake 1y ago
      I'd be surprised if there aren't malicious apps that pop up their own counterfeit version of Apple's "Just enter your password again, trust me bro" dialog that looks just like the real thing, and then do nefarious things with the trusting user's input.
      - xp84 1y ago
        Not only apps, webpages can easily do it too! I know that sophisticated users might think to themselves "hey why didn't it play the correct app-switching animation after I clicked 'Open Settings' to enter my password" or something, but normal users could be fooled simply by loading the password-entering UI lookalike right there in the browser, probably more than half the time, which is way more than enough. Apple's continued drive toward having UI disappear when not "in use" makes this so much more trivial. Currently, as long as you've scrolled down an inch or so, Safari's chrome consists of a single line of ~5 point text, the hostname, on a plain background at the bottom of the screen. So, "Wait, i'm still in the browser" is the kind of thing only nerds would think. Normal people would just ignore the tiny text saying "apple.com.account-verification-system.cgi-bin-iphone-3cabcdef38673824.xyz" and assume they're looking at legitimate UI as long as it roughly approximates iOS.
sangeeth96 1y ago
Are you sure you have enabled TouchID for purchases (Settings > Touch ID & Password)? If you don't, I guess it might prompt for passwords. I just need to authenticate once on restart but can pretty much use TouchID almost all the time after that anywhere auth is expected.
- crazygringo 1y ago
  I have on mine, and yes it always prompts for a password anyways if I haven't used the App Store extremely recently (like within the past 24 hours). I'd assume it's a straight-up bug on Apple's part, but they haven't fixed it for years and years, so at this point I think they're just being sadistic. Because yes TouchID works everywhere else. This is App Store-specific. It's literally the only reason I keep a password manager app on my home screen, since it autofills everywhere else but not there so I have to always copy my Apple password manually from the password manager app.
  - sangeeth96 1y ago
    Hmm, might be worth reporting if you haven't already. I just tried installing something with IAPs, which usually triggers the prompt. I had the option to use FaceID on my phone. I tried the same on macOS and I had the prompt to use TouchID. I'm on Tahoe beta right now but it worked the same even while on Sequoia. It's once in a blue moon I see the password prompt, not sure exactly what causes it to appear.
  - dwaite 1y ago
    Are you using a single Apple Account for both the primary account on device (iCloud, etc) and for iTunes? That is the other scenario where I see people hitting this.
duxup 1y ago
Is this for a particular situation(s)? I do not run into this at all across my apple products.
mountainriver 1y ago
I have to change my apple password every single time I need to download an app. It seems like insane friction for something that is making them a lot of money
- croemer 1y ago
  Same. And annoyingly you're not allowed to reuse old passwords, so you have to keep inventing (and remembering) new ones.
daneel_w 1y ago
I wonder if what you're seeing is geographic. I'm in Scandinavia and authentication lasts a decent while for me, with strict settings. I tried a few things with my SO's iPhone and iPad and they behaved the same.
out-of-ideas 1y ago
> it keeps prompting for the Apple password again and again pro tip (for mac desktop, not iphone): drag the dumb prompt off to the edge of the screen ( i drag from top left of the window and drop it to the bottom right of the monitor ) it will not give a 2nd prompt if the first prompt is closed => i do this specifically when the 'apple accounts' crap has some issue and forever prompts me to re-login. edit: clearification
SchemaLoad 1y ago
At least for Apple I can see this being a way to avoid account lock out. Your Apple ID password would otherwise almost never be used so when people finally go to factory reset their device or something they would realise they long since forgot their password and now have an expensive brick.
NL807 1y ago
I don't have a problem with reauth if the action(s) in question requires a sudo-like operation with a time-out window. It's just a matter of grouping such actions together in manner that requires the least amount of reauth prompts.
everforward 1y ago
I think free apps are still scrutinized because they don’t want attackers to install known-compromised apps or trackers. Like a controlling spouse sneakily face IDing a sketchier Life360 while “making a phone call”. Could be wrong, but that’s the only thing I can think of.
- xp84 1y ago
  For sure. They don't really need to protect your credit card in that way, since if a silly kid bought $300 worth of Super Gems or installed a paid app (are there even any normal paid apps now?) Apple has full control, if you call support, to just say "nope" and take the money back and refund you. But sneaking any random app onto the phone of someone else for nefarious reasons is something Apple is super paranoid about. Which is also why I will get random popups every few weeks for the rest of my life saying things like "Google Maps has been using your location for 179 days." with a "scary" little map of where I've been. No amount of saying "yes, i meant to do that" can convince Apple that it's intentional.
xp84 1y ago
Indeed. And I have several Apple mobile devices around the house that just decide they need the password entered just for general reasons, without any specific triggering action! And those pop up modal dialogs in front of what you're doing (super dangerously, as that teaches users that it's plausible that they might be on the Web, and get a popup asking them to enter a password, that they should click on to lead them to a password-entering place!) The Mac pops those up too, now. Utter insanity.
Wowfunhappy 1y ago
The really annoying thing is that when I purchase an app on my watch, it makes me type the password on my watch... How is this a thing?!
dcow 1y ago
Something is mis-configured. This isn't the default experience. TouchID works just fine for AppStore purchases.
ValleZ 1y ago
It's because an average Apple engineer has to enter his password at least 10 times a day and it's kind of no big deal for them. Source: I was an Apple eng.
b0a04gl 1y ago
[dead]
nofunsir 1y ago
It literally is Jennifer Lawrence's fault. No joke. Same with the forced emails you get ANYTIME you login to iCloud via web.
Terretta 1y ago
This is not Apple's intended default behavior. The various stores use their own biometric auth (the abstraction over touch ID and face ID) settings, which can cause this based on user config, particularly if you're using family accounts of any kind. The most likely issue is one of these is set to ask every time as many families that share devices with kids consider that a feature, not a bug. If all possible places are set to accept biometric ID (there's always one more setting than you think to check), it can be something about your network or device itself, particularly if for some reason you show up as if rotating through random geographies or from "unknown" devices. Modern-ish auth systems (e.g., authentication mechanisms for Google, Microsoft, and Apple) also have a "risk based authentication" ratchet that re-prompts if enough data points are abnormal. Depending on your level of access to admin panels, you may be able to identify what is flagging to re-prompt. Usually this sort of thing can be traced to something like a per-request VPN with no geographic affinity option, or an ISP (especially mobile ISP) that exits you from random cities across border lines.
closeparen 1y ago
The extreme security of iCloud accounts is good, given that iMessage, photos, etc. are all in there. The need to re-authenticate your iCloud account to purchase $0.99 app is eyebrow-raising but understandable. But the need to 2FA to download a free app is insane.
1oooqooq 1y ago
this is only because of all the lawsuits about apple store chargebacks because they allowed kids to make purchases. article is shot Enterprise software and you're talking about games and predatory dark patterns in consumer devices. or do you company distribute software to employees via app store?

paxys 1y ago

And it's even worse if you are accessing Apple services on a non-Apple device. No matter how many times I click "trust device" when logging in to icloud.com it will still make me do the password + one-time code song and dance the next day. Another pointless annoyance - if Face ID fails when making a payment or installing an app (like it frequently does for reasons like sleeping in bed or wearing sunglasses) it won't fall back to PIN but ask you to enter your Apple account password. Why?? And of course when you're on that prompt there's no way to open your password manager without cancelling out of it entirely. Makes for a fun experience at the checkout counter...

thyristan 1y ago
Microsoft crap is similarly broken. After each and every login there is the question whether it should remember me and whether it should ask that question again. It doesn't matter at all what you answewr there, it changes absolutely nothing.
- count 1y ago
  Disable anti-tracking features and ad blocks, it turns out cookies and temp storage for ad tracking are how IDPs track your choice to trust the device too.
  - thyristan 1y ago
    Adblocking and anti-tracking are mandatory on my company laptop, cannot switch those off. And I wouldn't want to.
    - notpushkin 1y ago
      This is actually one great use for an MDM policy.
  - xp84 1y ago
    Most adblockers etc are pretty selective about cookies. I guess if you got really aggressive like an allow-list approach, you could have friction, but just using ublock's defaults I don't get 'unrecognized' from anything any quicker than I do on a device without it.
- wycy 1y ago
  I wonder how many millions of productivity hours have been lost due to millions of people having to click through these stupid, useless prompts countless times per day.
- antod 1y ago
  That is the single most useless dialog/question in IT. I wonder how much money that costs the global economy a year.
mlinhares 1y ago
Why in the world does it need you to type a code id you have already accepted it at the other device? This whole flow is stupid, I guess they want to cover their asses.
- reddalo 1y ago
  I agree with you, but it's the same reason why Microsoft asks you to type a numeric code generated by their Outlook app in order to login. It's to prevent people from dismissing the alert by clicking "OK" without even reading (especially if they're in the middle of something else, e.g. during a scam phone call).
  - brendoelfrendo 1y ago
    Right, the numeric code is proof of intent. In theory, tapping "ok" or "yes, this is me" should be proof of intent. In reality, it's common for those who have compromised someone's password to flood people with these notifications and auth prompts to get them to eventually say "ok," even if by accident.
    - deepsun 1y ago
      Duo Mobile at least make it two clicks (on Android at least). So a distracted user would likely to swipe off the notification, instead of tapping through and clicking "Yes, it is me" on the next screen.
    - mrandish 1y ago
      > it's common for those who have compromised someone's password to flood people with these notifications and auth prompts And by excessive reauthing, legit platforms and apps are helping scammers by conditioning users to click "OK" or enter a passcode reflexively just to get on with their lives. Frequent reauth makes everyone less secure.
      - brendoelfrendo 1y ago
        I don't disagree, and I appreciate your keeping the conversation on-topic, but that's very much an incomplete picture. I think our modern app ecosystem as a whole conditions users to click "OK" reflexively. A hypothetical app wants permissions for your camera, location, and file storage. If you click OK, you can use the app. If you don't, some functions may not work. I think the average user gets caught in the desire to use an app for its intended purpose and the need to tinker with settings - which they may or may not understand - if they want to use that app securely. So, they just say OK to everything. Of course, that's not the only situation with these push notifications. MFA fatigue attacks are a real thing, hammering the user with as many notifications as they can in a short time. Maybe the user assumes it's a bug, maybe they try to deny the push notification but eventually hit the wrong button, maybe they just want it to stop; it's not so much about exploiting user conditioning as it is assuming that if you force people into an unfamiliar situations, that some of them will eventually slip up.
altairprime 1y ago
It often falls back to PIN if you retry faceid three times. But if the app is using faceid as a biometric second factor, in addition to or instead of as a password caching mechanism, then a device PIN is not biometric attestation and so it downgrades to full password.
whiplash451 1y ago
In 2025, I don’t think that accessing apple accounts on a non-apple device is a happy path for apple anymore.
- apitman 1y ago
  "Trust this device" is the modern day elevator door close button.
  - princevegeta89 1y ago
    Haha
  - arccy 1y ago
    I've found that it's only american elevator door close buttons that don't work. The rest of the world manages to keep them operational.
    - pests 1y ago
      On US elevators there is a minimum open duration to accommodate the handicapped or disabled. The door close button can’t force the door closed any faster. Then most set the auto-close duration equal to this minimum open duration and you get this appearance of buttons doing nothing.
      - deleted 1y ago
        [deleted]
    - CjHuber 1y ago
      As a obsessive door close button presser, I can definitely tell you that there are many elevators in Europe where the button doesnt work either
chrisweekly 1y ago
related pet peeve: faceid is often (but unpredictably) really slow - like, I'm looking at the phone and in a hurry and would prefer to enter my pin but touching the screen goes back to the lockscreen, and swiping up starts faceid again.
KennyBlanken 1y ago
> if Face ID fails when making a payment or installing an app (like it frequently does for reasons like sleeping in bed or wearing sunglasses) it won't fall back to PIN but ask you to enter your Apple account password. What? FaceID will prompt for a re-try. Always. It will never fail once and then refuse to do FaceID. If you can't figure out to lift the sunglasses off your face or sit up in bed for a second, that's not anyone's fault but your own. Also, FaceID will never fall back to your account password for Apple Wallet transactions with a physical credit card reader.
- apenwarr 1y ago
  You’re right except in the very specific case of the App Store purchase or download process. You only get one chance at FaceID and then it demands a password. But, if you cancel and do it again, you get another chance at FaceID. It’s mystifying why they’d make that UX choice.
vachina 1y ago
Dismiss the password prompt and reinitiate the auth, FaceID will work again. I’m not sure why Apple doesn’t let us retry FaceID on the get go, but at least theres this method.

MBCook 1y ago

Really? I never have to re-auth unless I get a new device.

quesera 1y ago
Same behavior here. I use TouchID to log in several times per day, and am required to enter a password "to enable TouchID" about once per week. iOS and macOS both. This feels reasonable to me.
- ziml77 1y ago
  It's annoying to ever have to enter a password manually, but it does make sense every 1 or 2 weeks to force it. Not even as a security thing but as a memory thing. It's incredible how something that you seem to know so well can get flushed from your memory after you stop recalling that knowledge regularly.
  - quesera 1y ago
    Exactly. I have enabled TouchID for a couple of banking apps, and I am dreading the likely need for the password reset dance when the time comes (it's been years). I use a password manager, but I've always kept the actually important passwords in wet memory only. When I used the web interface regularly, that was not a problem. However... :-/

grishka 1y ago

Also, on both macOS and Android, there's a time component to device unlocking. You would sometimes get this stupid "your password is required to enable touch ID" or "extra security required, pattern not used in a while" thing with no way to disable it. It's beyond infuriating to me. It's my device. It should not tell me what to do. I get to tell it what to do and it obeys, unquestionably. I'll evaluate my own risks, thank you very much.

1718627440 1y ago
> macOS and Android > It's my device. There is your dissonance.
yard2010 1y ago
This is just enshitification in a mask. Next thing you know, guess what? Your device is not yours, you just rent it from the feudal.

socalgal2 1y ago

Also, every time I plug my iPhone into my Mac for syncing it asks "Trust this Device" both the Mac and the iPhone. I click "yes" and yet it asks again next time.

grishka 1y ago
Remembering things reliably must be the most unsolvable problem in computer science. Unless it's related to advertising. Then it works flawlessly and sometimes survives device transfers and factory resets.
- falcor84 1y ago
  "The best minds of my generation are thinking about how to make people click ads." -Jeff Hammerbacher
  - olddustytrail 1y ago
    I saw the best minds of my generation destroyed by madness, starving hysterical naked, dragging themselves through the negro streets at dawn looking for an angry fix
    - Y_Y 1y ago
      How is that supposed to make anyone click on an ad?
      - falcor84 1y ago
        Just to expand upon the reference, the comment you responded to is the first stanza of Allen Ginsberg poem "Howl" [0] published in 1956, which is what Hammerbacher paraphrased in the quote that I shared. "Howl" is amazing on its own though, and I highly recommend that people read the whole thing and/or watch the 2010 film about Ginsberg's life where James Franco recites it in its entirety[1]. And as a follow-up, I also highly recommend Scott Alexander's "Meditations on Moloch" that takes inspiration from the poem to analyze societal failures of coordination. [0] https://www.poetryfoundation.org/poems/49303/howl https://www.poetryfoundation.org/poems/49303/howl [1] https://www.imdb.com/title/tt1049402/ https://www.imdb.com/title/tt1049402/ [2] https://slatestarcodex.com/2014/07/30/meditations-on-moloch/ https://slatestarcodex.com/2014/07/30/meditations-on-moloch/

sircastor 1y ago

I have a very old iPad that my kid uses. It’s stuck to iOS 10.3. Also, it can’t use my password manager. The browser is so old that the website won’t load (32-bit app). And the PW manager app isn’t made for this old a device. So Apple wants me to type in my 50+ character password every time I use the App Store app. It’s such a pain.

paxys 1y ago
If it helps there's no security advantage of a 50+ character password over a suitable 16 character one.
- mikepurvis 1y ago
  Remember how 1Password used to install itself as a custom keyboard that could "type" your passwords into arbitrary text fields anywhere in the OS, before password management specific hooks were added? It would be nifty if your phone could just connect to other devices as a BT keyboard and type in passwords there too. Probably not worth the actual fuss of pairing a BT device, but if that part were not so painful it could be quite a nice solution.
  - alasarmas 1y ago
    One major flaw in this approach is the one-way channel (keyboard input) prevents the password manager from knowing if it is supplying credentials to the correct recipient. Phishing attacks are relatively common and users expect a password manager to know these things, even in situations like you have described where it’s clearly impossible. I think this is why this approach hasn’t succeeded in the marketplace and FIDO2/WebAuthn support seem to be table stakes.
    - mikepurvis 1y ago
      Yeah, certainly a proper security module / passkey-type approach is ideal, it would be hard to justify all the bother of developing a bluetooth typer if really the only use-case for it is legacy devices that are old enough to not have an OS supporting the client app, but new enough to still pair with a device pretending to be a bluetooth keyboard.

CamperBob2 1y ago

I'm not surprised that it occasionally prompts for a password (about once or twice a week for me), because otherwise people will forget their passwords and bug them about it. The problem I have is that it doesn't explain who wants the password or why, and the prompts aren't associated with any particular action on my part. Instead, Apple is conditioning people to mindlessly type in their password on demand. Why in the world are they doing a stupid, dangerous, counterproductive thing like that?

hamburglar 1y ago
Yes, it’s really bad for security. I just deny it if I don’t know what it’s for. I’m sure I’m missing out on some very important functionality.
- CamperBob2 1y ago
  My understanding is that iCloud backup requires it, among who-knows-what other things. So I've been reluctant to hit "Not now." I just have to trust their security model to not allow random apps to pop up and issue those prompts.
  - ryandrake 1y ago
    I'd be surprised if there aren't malicious apps that pop up their own counterfeit version of Apple's "Just enter your password again, trust me bro" dialog that looks just like the real thing, and then do nefarious things with the trusting user's input.
    - xp84 1y ago
      Not only apps, webpages can easily do it too! I know that sophisticated users might think to themselves "hey why didn't it play the correct app-switching animation after I clicked 'Open Settings' to enter my password" or something, but normal users could be fooled simply by loading the password-entering UI lookalike right there in the browser, probably more than half the time, which is way more than enough. Apple's continued drive toward having UI disappear when not "in use" makes this so much more trivial. Currently, as long as you've scrolled down an inch or so, Safari's chrome consists of a single line of ~5 point text, the hostname, on a plain background at the bottom of the screen. So, "Wait, i'm still in the browser" is the kind of thing only nerds would think. Normal people would just ignore the tiny text saying "apple.com.account-verification-system.cgi-bin-iphone-3cabcdef38673824.xyz" and assume they're looking at legitimate UI as long as it roughly approximates iOS.

sangeeth96 1y ago

Are you sure you have enabled TouchID for purchases (Settings > Touch ID & Password)? If you don't, I guess it might prompt for passwords. I just need to authenticate once on restart but can pretty much use TouchID almost all the time after that anywhere auth is expected.

crazygringo 1y ago
I have on mine, and yes it always prompts for a password anyways if I haven't used the App Store extremely recently (like within the past 24 hours). I'd assume it's a straight-up bug on Apple's part, but they haven't fixed it for years and years, so at this point I think they're just being sadistic. Because yes TouchID works everywhere else. This is App Store-specific. It's literally the only reason I keep a password manager app on my home screen, since it autofills everywhere else but not there so I have to always copy my Apple password manually from the password manager app.
- sangeeth96 1y ago
  Hmm, might be worth reporting if you haven't already. I just tried installing something with IAPs, which usually triggers the prompt. I had the option to use FaceID on my phone. I tried the same on macOS and I had the prompt to use TouchID. I'm on Tahoe beta right now but it worked the same even while on Sequoia. It's once in a blue moon I see the password prompt, not sure exactly what causes it to appear.
- dwaite 1y ago
  Are you using a single Apple Account for both the primary account on device (iCloud, etc) and for iTunes? That is the other scenario where I see people hitting this.

duxup 1y ago

Is this for a particular situation(s)? I do not run into this at all across my apple products.

mountainriver 1y ago

I have to change my apple password every single time I need to download an app. It seems like insane friction for something that is making them a lot of money

croemer 1y ago
Same. And annoyingly you're not allowed to reuse old passwords, so you have to keep inventing (and remembering) new ones.

daneel_w 1y ago

I wonder if what you're seeing is geographic. I'm in Scandinavia and authentication lasts a decent while for me, with strict settings. I tried a few things with my SO's iPhone and iPad and they behaved the same.

out-of-ideas 1y ago

> it keeps prompting for the Apple password again and again pro tip (for mac desktop, not iphone): drag the dumb prompt off to the edge of the screen ( i drag from top left of the window and drop it to the bottom right of the monitor ) it will not give a 2nd prompt if the first prompt is closed => i do this specifically when the 'apple accounts' crap has some issue and forever prompts me to re-login. edit: clearification

SchemaLoad 1y ago

At least for Apple I can see this being a way to avoid account lock out. Your Apple ID password would otherwise almost never be used so when people finally go to factory reset their device or something they would realise they long since forgot their password and now have an expensive brick.

NL807 1y ago

I don't have a problem with reauth if the action(s) in question requires a sudo-like operation with a time-out window. It's just a matter of grouping such actions together in manner that requires the least amount of reauth prompts.

everforward 1y ago

I think free apps are still scrutinized because they don’t want attackers to install known-compromised apps or trackers. Like a controlling spouse sneakily face IDing a sketchier Life360 while “making a phone call”. Could be wrong, but that’s the only thing I can think of.

xp84 1y ago
For sure. They don't really need to protect your credit card in that way, since if a silly kid bought $300 worth of Super Gems or installed a paid app (are there even any normal paid apps now?) Apple has full control, if you call support, to just say "nope" and take the money back and refund you. But sneaking any random app onto the phone of someone else for nefarious reasons is something Apple is super paranoid about. Which is also why I will get random popups every few weeks for the rest of my life saying things like "Google Maps has been using your location for 179 days." with a "scary" little map of where I've been. No amount of saying "yes, i meant to do that" can convince Apple that it's intentional.

xp84 1y ago

Indeed. And I have several Apple mobile devices around the house that just decide they need the password entered just for general reasons, without any specific triggering action! And those pop up modal dialogs in front of what you're doing (super dangerously, as that teaches users that it's plausible that they might be on the Web, and get a popup asking them to enter a password, that they should click on to lead them to a password-entering place!) The Mac pops those up too, now. Utter insanity.

Wowfunhappy 1y ago

The really annoying thing is that when I purchase an app on my watch, it makes me type the password on my watch... How is this a thing?!

dcow 1y ago

Something is mis-configured. This isn't the default experience. TouchID works just fine for AppStore purchases.

ValleZ 1y ago

It's because an average Apple engineer has to enter his password at least 10 times a day and it's kind of no big deal for them. Source: I was an Apple eng.

b0a04gl 1y ago

[dead]

nofunsir 1y ago

It literally is Jennifer Lawrence's fault. No joke. Same with the forced emails you get ANYTIME you login to iCloud via web.

Terretta 1y ago

This is not Apple's intended default behavior. The various stores use their own biometric auth (the abstraction over touch ID and face ID) settings, which can cause this based on user config, particularly if you're using family accounts of any kind. The most likely issue is one of these is set to ask every time as many families that share devices with kids consider that a feature, not a bug. If all possible places are set to accept biometric ID (there's always one more setting than you think to check), it can be something about your network or device itself, particularly if for some reason you show up as if rotating through random geographies or from "unknown" devices. Modern-ish auth systems (e.g., authentication mechanisms for Google, Microsoft, and Apple) also have a "risk based authentication" ratchet that re-prompts if enough data points are abnormal. Depending on your level of access to admin panels, you may be able to identify what is flagging to re-prompt. Usually this sort of thing can be traced to something like a per-request VPN with no geographic affinity option, or an ISP (especially mobile ISP) that exits you from random cities across border lines.

closeparen 1y ago

The extreme security of iCloud accounts is good, given that iMessage, photos, etc. are all in there. The need to re-authenticate your iCloud account to purchase $0.99 app is eyebrow-raising but understandable. But the need to 2FA to download a free app is insane.

1oooqooq 1y ago

this is only because of all the lawsuits about apple store chargebacks because they allowed kids to make purchases. article is shot Enterprise software and you're talking about games and predatory dark patterns in consumer devices. or do you company distribute software to employees via app store?