iOS 17.3 to Include Stolen Device Protection Feature
wsj.com
wsj.com
For those who don't want to pay. Goes over the WSJ in depth lol.
> For especially sensitive actions, including changing the password of the Apple ID account associated with the iPhone, the feature adds a security delay on top of biometric authentication. [...] However, Apple said there will be no delay when the iPhone is in familiar locations, such as at home or work.
It's fascinating how the device is using location as another security factor.
https://learn.microsoft.com/en-us/entra/identity/conditional...
Look at all the signals! And what you can do based on them.
PS. If you are building a SaaS, know that 85% of SMBs can SSO or "Sign in with Microsoft". There are things besides GitHub and Google Sign in, and the ones with Microsoft are (a) probably supposed to use it, and (b) don't mind subscribing to software. Focusing exclusively on Oauth or SSO from Google or GitHub accounts is an awkward decision. Add 'Sign-in with Microsoft' and your TAM just got much bigger.
> location services uses several data sources not just GPS
Only if those other data sources are available, afaik.
Interesting idea...Maybe nearby WiFi APs is one data point that the phone uses for determining location without battery intensive use of GPS.
Another vector for law enforcement or state actors to request private information. We will see warrants for all users who have these coordinates near their "familiar location"
https://www.vice.com/en/article/m7vqkv/how-fbi-gets-phone-da...
https://propertyofthepeople.org/document-detail/?doc-id=2108...
> The presentation provides more recent figures on how long telecoms retain data for. AT&T holds onto data such as call records, cell site, and tower dumps for 7 years. T-Mobile holds similar information for 2 years, and Verizon holds it for 1 year.
This might not apply if your opsec avoids mobile providers and you're running only wifi, but that seems like a rare edge case. This fight is fought in court and legislation unfortunately.
_or_ they can just ask the carriers which cellphones are where, which they are already able to do despite it being fairly questionable to me.
However, the radio towers need to triangulate your location to be able to communicate with you, which is not questionable, since that is their purpose. But then storing that information for any non-trivial length of time seems fairly questionable to me too.
On Mac+iOS your devices learn places where they often stay, that information is never exposed to apple at all. I can't recall from the massive product security document whether these are "never leave the device" or "only ever in the end-to-end encrypted synchronized storage". Hence without an update that apple pushed to every device to specifically undermined that privacy protection, there's no way for apple to answer the question of "which devices hang out around this location".
If you get to the point of law enforcement being able to do that, then no amount of device security on any device matters, because even if you were to try and use a custom android image we've reached a point where law enforcement could also just say "a device cannot boot an OS it cannot confirm will obey the spy-on-users legislation". That's why it's so important that these various nonsense laws of compelled spying for any purpose get blocked.
One could imagine a disfiguring accident (or even just recovery from a cosmetic operation) rendering Face ID inoperable.
This could also be made harder if you didn't have password repeated in plain text on your password field letter by letter
Why not allow another password?
You can argue the feature should have existed in earlier versions of iOS, but it didn't, so... yeah.