Just how vulnerable are you if you use an iPhone. Spoiler Alert, More vulnerable than you think!

Do you have a secure Code on your Purse and your wife on here Handbag?
Is the manufacturer of your purse/their handbag making sure that you are not having it lie somewhere around, that you could only put a small amount of money in there and only one credit card without a little piece of paper with your PIN?
Is he making sure that you could not put all kinds of personal documents in it, and a reserve key for your house or car, and whatever people are placing into their purse/handbag, too?

If not, why are you not complaining about that?

Apple is providing a high amount of security measures, that people could use to be on the safe site!
If people don‘t want to, and are not using a minimum amount of own brain to protect their stuff, it is not Apple to blame for!!

1 Like

“Darn, I need a capital letter, a number, and a punctuation… How about Password1!”

What they COULD theoretically do, as an option, is run the PIN/password/etc. a user chooses against the HaveIBeenPwnd list. If it’s on the list, advise the user of that fact in a user-friendly way (“Just so you know, the password you’ve chosen is a password hackers are going to try since it’s in a leaked password list”), and let them decide whether or not they want to continue.

In this one very specific case? Don’t type in any codes/passwords/etc. on your phone without being aware of your surroundings. Sitting at the bar with people crowding around you is a HORRIBLE place to key in a passcode.

In general?

  • Pick a hard-to-guess phone unlock code, alphanumeric if you can remember one.
  • Enable biometrics for use in public, so you don’t have to enter your code.
  • Set your phone’s lock timer as short as is feasible for you.
  • Get in the habit of manually locking your phone when you put it down.
  • Don’t store highly-sensitive data in your phone’s photos or notes app.
  • If there’s an area of data that’s highly sensitive, look for apps with separate passwords. And USE a separate password.

Lots of relatively simple stuff that makes a big difference.

So what are some specific solutions that Mac power users can take themselves as well as share them with their family and friends?

This is happening since a longer term already.

Apple is checking peoples’ proposed PINs and passwords? I hadn’t heard that.

No. It’s advising against using a 4-PIN code… I guess she means Apple Passwords… The new version has a function that checks for leaked passwords.

Apple Keychain is since at least early 2021 advising, if you use the same password several times, if it is known for a vulnerability and if it is known for a leakage.

1 Like

Yep, this is good and I think the suggestion was that this could/should be applied to the system PIN/password as well.

I haven’t tried it out on iOS, but given on the Mac, when you setup a new System, you could not set the same password for the System, as you have for your AppleID.

Then let’s dispense with airplane cockpit checklists, or hospital policies, perphaps you can sell your computer as that’s definitely taking tasks away from you.

Sorry, I didn’t realise that you actually knew these people in the video to be able to tell us why they did it?

If you think apple is about user freedom, just talk to the developers forced to use the App Store. I also disagree in that apple cannot allow you freedom if in doing so they are deemed reckless. This whole thread highlights that the day of the PIN is waning, if not over. To cling to it because it’s convenient places you in the same position as those who had their digital identity stolen.

Not everything needs security. It depends on its marketed purpose. For those purposes there are expected requirements. I suppose you would be pretty upset if you bought a car and it came with no locks? Apple Pay, banking apps, all expect good security on an iPone.

But isn’t that irresposible? People think they have freedom to do what they like, but in reality they don’t. It’s what’s best for the community. Just because someone wants to choose an insecure password doesn’t mean apple or any other service should allow them to do so. In the same way you’re not free to drive where you like, park where you like, you’re not even allowed to spend your money how you like. It all needs to fit into the law of the land. And these laws developed bit by bit when scenarios like this hit, or certainly get tweaked with every demonstrated problem and legislated for the common good.

This post seems quite strongly worded, as people such as @johnkree are perfectly entitled to their opinion. And if not everything needs security, then an iPhone with no banking apps etc maybe fits in that. Maybe. Maybe not. Anyway, just making a plea for continued, civil discussion from everyone on this important, hot topic.

5 Likes

I apologise if anything I said is deemed offensive. Certainly not looking to attack any people, but obviously have some disagreement with their comments! :grin:

3 Likes

The difference between what you appear to be proposing and these things is that those things are resources for people to avail themselves of that can be followed or ignored. A doctor can violate a hospital policy, and a pilot can ignore a checklist. Usually it’s a bad idea to do so, but it’s possible - and sometimes might even be a good idea.

In a fun note, car manuals at least used to say that you should walk around the car and check tire pressure in all tires and verify fluid levels each time you drive. It IS a best practice, because all of those things affect both your safety and the safety of others around you. Do you know anybody that does it? :slight_smile:

I would say it puts the responsibility on the user, by giving them the information / tools they need to make an informed choice. The whole original article is about somebody who, objectively speaking, made at least one bad choice. Saying that isn’t the same as blaming them, but if their PIN got shoulder-surfed that’s something that they almost certainly could have prevented by making different choices - just like the hypothetical person whose PIN is 123456.

I disagree on this point, because I don’t see the overriding case for “protecting the community”.

I almost certainly don’t have the community’s credit card details in my phone. The community’s email isn’t going to get hacked. The community’s tax forms aren’t stored in my iCloud Photos. Last I checked, nobody has ever suggested “mandating people install better locks” as a solution to a string of burglaries.

That said, if you can lay out a solid case as to how me getting my iCloud stolen is likely to harm somebody else in a meaningful way, and that this happens at scale, I’m open to hearing it.

1 Like

I’m curious if you, or anyone else, has any experience with AppBlock.
Seems interesting.

This shows pretty nicely, that you either just do not understand, what you are talking about, or that you just want to rant, for itself, not because you have a reason for that!

The ARE protecting “user freedom” (if you want to name it like that) by forcing Devs to use the App Store, and follow certain regulations. You could easily see with Androids what could happen, if you let everybody install anything on the devices!

Apple is in no way forcing you to use a PIN! You have all freedom to use an almost unlimited Alphanumeric code for that at any time!
If you do not do so, it is only you, who made that decision!

You mean like one of these fancy cabriolets…

What now? Either it is “irresponsible” in your Eyes, or Apple should force people do not use a certain password!?
Another time it seams you are not arguing for a special matter, but just because you want to rant about Apple. What is your business in that matter!?
And by the way, you are absolutely FREE to violate ANY law of your country, like you are free to violate the recommendations Apple is giving its users!

You just have to be aware that both could have negative consequences for you, that is simply all!

I was thinking more about having a system in place that is best for the whole community. Mac Power Users may well be able to deal with a more complex system, but I was thinking of one that would also benefit over 80 years olds using iPhones or people with disabilities.

Would not the Butterfly Effect hint towards a larger impact?

For example, someone losing their icloud identity could lead them to financial ruin, or social ruin should embarrasing photos endup in public (or the user being blackmailed), which in turn would impact their family, which could impact the wider community should they end up losing their house or they endup in unemployment. Granted this would be an extreme scenario, but it may point towards nothing really being in isolation.

It’s essential to curtail some freedom (or at least flexibility) in order to provide an acceptable level of security, but paradoxically, protecting users from their own poor choices too much actually decreases the overall security of a system. Finding the balance between those two extremes is really difficult and you obviously don’t agree with Apple in this case. I’m inclined to agree that Apple should probably provide a little more guidance on the potential problems that come with poor choices.

What’s best of a community as a whole is almost always a compromise that yields suboptimal results for the outliers on both ends of any given curve.

This is a lot of words to say that I probably agree with you in principle, but probably not in degree :slight_smile:

2 Likes

I suppose, but I think that’s a very slippery slope.

There’s no health benefit to soda, for example. Should we outlaw it? Should we just get the best medical doctors to determine what people should eat, to avoid long-term medical costs to society? Theoretically that would be “good for the community”.

Exactly. There are lots of things people don’t think about, and will never think about as long as it doesn’t impact them.

This goes back to the core issue in this example - the person in the example above was shoulder-surfed. That’s not Apple’s problem in any meaningful way. It’s the digital equivalent of the person effectively leaving their house key in the lock of their front door.

Solving the “people leaving keys in locks” problem is much more important than the debate we’re having about additional keys, types of keys, etc. as many of the solutions don’t matter at all if people are just going to keep leaving keys in locks.

And the question of “what’s best” vs. “what we force people to do” is still an open question, IMHO. In the final analysis, you either need a solution that’s not so onerous that people seek out other alternatives, or a regulatory environment that ensures there aren’t other alternatives. And each of those options comes with its own rather large set of challenges. :slight_smile:

4 Likes

very good chat about this start after 5 minutes…

Don’t listen to her. :slightly_smiling_face: There’s nothing wrong with checking that sort of thing. I could have saved myself a trip to the hardware store if I had done a walk-around on my snowblower checking for loose bolts before cleaning up from the most recent snow storm.

1 Like