Comment by djrogers | Hacker News Reader

Comment by djrogers | Hacker News Reader

So the TLDR; is that Apple allows a trusted device (your iPhone) and PIN/passcode to be the identification required to reset a lost iCloud password.

I honestly think this is a reasonable security model, as every other 'forgot password' workflow that I see services use is already vulnerable to my phone and passcode being in the wrong hands.

Think about the common options here. Apple could send out a rest link via email, but bad guy already has my email. They could send a verification code via SMS - oh wait, this is MY PHONE we're talking about. How about they send a push notification to... nevermind.

About 3 seconds worth of thought brings one to the conclusion that with my phone and pin/passcode, a bad actor could reset the passwords for pretty much every service I use - it's not just iCloud.

So someone explain to me in non hand-wavy terms how you'd expect this to be any different/better?

> So someone explain to me in non hand-wavy terms how you'd expect this to be any different/better?

From the article:

Any attempt to change or remove that password must pass through iOS, which would require to provide the old password first. Forgot the original password? There’s no going back, you’re stuck with what you have unless you are willing to factory reset the device and lose all data in the process.

Apparently, there was no password recovery. Now there is, and as a convenience it even skips the whole email step. This has implications for accessing the data present on the device, which is the whole point of the article.

Correct. The parent comment also totally ignores the new attack vector introduced to iOS backups.

I will clarify - I'm referring to the iCloud password reset, not the ability to create a new backup with a different password. You're rebutting my arguments about the former with quotes about the latter.

Except this attack vector requires the attacker both has your phone and knows your passcode. Meaning they don't need to access your backups any more, they already have all your data!

> Apple could send out a rest link via email, but bad guy already has my email.

If you lose your phone, you can change your email password.

If you lose your phone you could mark it lost on iCloud, or remove it from iCloud altogether

Reply on news.ycombinator.com