Dave Troy @davetroy

0 posts0 participants0 posts today

apfeltalk :verified:Große Datenbank mit Millionen Klartext-Passwörtern enthält auch Apple-Logins Ein gigantischer Datenfund sorgt derzeit für weltweites Aufsehen. Eine ungeschützte Datenbank mit 184 Millionen Datensätzen <a href="https://www.apfeltalk.de/magazin/news/grosse-datenbank-mit-millionen-klartext-passwoertern-enthaelt-auch-apple-logins/" rel="nofollow noopener noreferrer" target="_blank">https://www.apfeltalk.de/magazin/news/grosse-datenbank-mit-millionen-klartext-passwoertern-enthaelt-auch-apple-logins/</a> <a href="https://creators.social/tags/News" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#News</a> <a href="https://creators.social/tags/Services" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Services</a> <a href="https://creators.social/tags/AppleID" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AppleID</a> <a href="https://creators.social/tags/Cyberkriminalitt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cyberkriminalitt</a> <a href="https://creators.social/tags/Datenschutz" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Datenschutz</a> <a href="https://creators.social/tags/Datensicherheit" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Datensicherheit</a> <a href="https://creators.social/tags/EMailSicherheit" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#EMailSicherheit</a> <a href="https://creators.social/tags/InfostealerMalware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfostealerMalware</a> <a href="https://creators.social/tags/KlartextPasswrter" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#KlartextPasswrter</a> <a href="https://creators.social/tags/Phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Phishing</a> <a href="https://creators.social/tags/Sicherheitslcke" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Sicherheitslcke</a> <a href="https://creators.social/tags/Zugangsdaten" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Zugangsdaten</a>

OpenTechEnable iCloud's ADP in the UK After the BanDownload: Install the Librewolf browser and Proton VPN on your computer. Connect: Use Proton VPN to connect to a US server. Create a new Apple ID in Librewolf, selecting the US as your region. Switch Accounts: On your iPhone, log out of your current Apple account and log in with the new one. You should now have access to ADP! Let me know if it works!<a href="https://mastodon.social/tags/iCloud" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iCloud</a> <a href="https://mastodon.social/tags/AppleID" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AppleID</a> <a href="https://mastodon.social/tags/Privacy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Privacy</a> <a href="https://mastodon.social/tags/VPN" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#VPN</a> <a href="https://mastodon.social/tags/TechTips" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TechTips</a>

Michael Burch :kt_ow:Neuer Artikel auf iPhone-Blog.ch veröffentlicht: Käufe von einem Apple Account zu einem anderen Apple Account übertragen Aus historischen Gründen sind auch auf meinem iPhone zwei Apple Accounts angemeldet. Einer für iCloud und einer für Medien & Käufe. Apple ermöglicht es nun, diese beiden zusammenzuführen. Dabei wird der Account, der in den Einstellungen unter Medien & Käufe angemeldet…Artikel lesen: <a href="https://www.iphone-blog.ch/2025/02/12/kaeufe-von-einem-apple-account-zu-einem-anderen-apple-account-uebertragen/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.iphone-blog.ch/2025/02/12/kaeufe-von-einem-apple-account-zu-einem-anderen-apple-account-uebertragen/</a><a href="https://swiss.social/tags/AppleAccount" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AppleAccount</a> <a href="https://swiss.social/tags/AppleID" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AppleID</a> <a href="https://swiss.social/tags/Medien" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Medien</a>

-0--1-<a href="https://beige.party/@Kierkegaanks" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@Kierkegaanks</a> <a href="https://mastodon.green/@gimulnautti" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@gimulnautti</a> It's one of the reasons I refuse to buy anything that is <a href="https://mastodon.social/tags/Apple" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Apple</a>. When <a href="https://mastodon.social/tags/Apple" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Apple</a> <a href="https://mastodon.social/tags/Disintermediated" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Disintermediated</a> me from THOUSANDS OF DOLLARS of the Music I stored on my <a href="https://mastodon.social/tags/AppleiPod" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AppleiPod</a> and tied it to an <a href="https://mastodon.social/tags/AppleID" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AppleID</a> tied to an ancient <a href="https://mastodon.social/tags/AOL" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AOL</a> account, I began to say <a href="https://mastodon.social/tags/FUCKTECHNOLOGY" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FUCKTECHNOLOGY</a>. I won't be milked anymore.

Dave Wood 🇨🇦Had to chat w/Apple support to have them unlock the account.I was warned: “Just a heads up that further fraudulent activities may permanently disable the account”.I said I didn't like that wording as it implies I did something fraudulent to begin with, which I didn’t. He insisted this was to keep my “account safe”.Apple has too much power. I shouldn't be locked out of my devices/data randomly on Apple's whim. I have $thousands of software/movies licensed to my <a href="https://mastodon.social/tags/AppleID" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AppleID</a> that are at risk.

Dave Wood 🇨🇦Fuck. Can’t even add a new payment. Get the same “Tap Continue” message without a button.<a href="https://mastodon.social/tags/AppleID" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AppleID</a> <a href="https://mastodon.social/tags/SecurityByIncompetence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SecurityByIncompetence</a>

Dave Wood 🇨🇦Reset the password on the account following their instructions, account immediately disabled again.WTF.My guess is that they've lost my CC details. The expiry & security code are blank. When I add them, it says `Tap Continue to request re-enablement`. There is no `Continue` button. Same bug on iOS & macOS. I can't remove the card and add it fresh because I have subscriptions. Can't just add it as it says it's already added. 🤦‍♂️How does Apple make so much $?<a href="https://mastodon.social/tags/AppleID" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AppleID</a> <a href="https://mastodon.social/tags/SecurityByIncompetence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SecurityByIncompetence</a>

Dave Wood 🇨🇦Are we in another mass Apple ID Reset? Or just me? Locked out of my account, and being forced to reset my password. Which it won't let me do because my iPhone isn't in a known location, at home, connected to my WiFi, like it is 99% of the time.<a href="https://mastodon.social/tags/AppleID" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AppleID</a> <a href="https://mastodon.social/tags/SecurityByIncompetence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SecurityByIncompetence</a>

LilMikeSFThe highly competitive segmented <a href="https://c.im/tags/StreamingWars" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#StreamingWars</a> will pick up this weekend as <a href="https://c.im/tags/AppleTV" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AppleTV</a> opens the <a href="https://c.im/tags/paywall" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#paywall</a> and lets in anyone with an <a href="https://c.im/tags/AppleID" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AppleID</a> see their <a href="https://c.im/tags/content" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#content</a> for <a href="https://c.im/tags/FreeTrial" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FreeTrial</a> for a couple daze. Apple is proud of critically acclaimed series fare like <a href="https://c.im/tags/TedLasso" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TedLasso</a> and occasional exclusive TV windows for films like Emancipation, starring Will Smith which they paid over $100 million for. They produced Scorsese and DiCaprio's "Killers of the Flower Moon", but despite big bucks invested in content from name brand stars, less than 7% of US streaming service subscribers tune in, making them just 7th in the pack amongst services. The Cupertino based behemoth has struggled to add subscribers at $9.99 per month ang lag far beyond the market leading <a href="https://c.im/tags/Netflix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Netflix</a>. To boost numbers <a href="https://c.im/tags/Apple" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Apple</a> recently began offering a bundled add on app subscription via <a href="https://c.im/tags/Amazon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Amazon</a>, sharing revenues to gain a presence within Jeff Bezos <a href="https://c.im/tags/AmazonPrime" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AmazonPrime</a> streaming plans like <a href="https://c.im/tags/ContentProvider" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ContentProvider</a> studio rivals <a href="https://c.im/tags/HBOMax" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#HBOMax</a>, <a href="https://c.im/tags/MGM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MGM</a> & <a href="https://c.im/tags/Paramount" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Paramount</a> already had. <a href="https://techcrunch.com/2024/12/30/apple-tv-will-be-free-to-stream-this-weekend/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://techcrunch.com/2024/12/30/apple-tv-will-be-free-to-stream-this-weekend/</a>

apfeltalk :verified:Apple TV Plus Kostenfrei: Streame Dieses Wochenende Gratis Apple TV Plus bietet dir vom 3. bis 5. Januar 2025 die Möglichkeit, seine gesamte Mediathek kostenlos zu streamen. Mit diesem Angebot möchte Apple den Jahresbeginn feiern und gleichze <a href="https://www.apfeltalk.de/magazin/news/apple-tv-plus-kostenfrei-streame-dieses-wochenende-gratis/" rel="nofollow noopener noreferrer" target="_blank">https://www.apfeltalk.de/magazin/news/apple-tv-plus-kostenfrei-streame-dieses-wochenende-gratis/</a> <a href="https://creators.social/tags/News" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#News</a> <a href="https://creators.social/tags/TV" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TV</a> <a href="https://creators.social/tags/AppleID" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AppleID</a> <a href="https://creators.social/tags/AppleTVPlus" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AppleTVPlus</a> <a href="https://creators.social/tags/Filme" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Filme</a> <a href="https://creators.social/tags/ForAllMankind" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ForAllMankind</a> <a href="https://creators.social/tags/KostenloseSerien" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#KostenloseSerien</a> <a href="https://creators.social/tags/MonarchLegacyOfMonsters" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MonarchLegacyOfMonsters</a> <a href="https://creators.social/tags/Severance" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Severance</a> <a href="https://creators.social/tags/Silo" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Silo</a> <a href="https://creators.social/tags/StreamingWochenende" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#StreamingWochenende</a> <a href="https://creators.social/tags/Streamingdienste" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Streamingdienste</a>

adingbatponderI am the organiser of family <a href="https://fosstodon.org/tags/icloud" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#icloud</a> under <a href="https://fosstodon.org/tags/macos" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#macos</a> <a href="https://fosstodon.org/tags/ios" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ios</a>. Child left home & wants (I told them they want...) to have entirely their own <a href="https://fosstodon.org/tags/appleid" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#appleid</a> & their own separate iCloud service they pay for themselves. Do you have any tips on what to do, & what not to do, to ensure all their synchronised <a href="https://fosstodon.org/tags/iphone" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iphone</a> and <a href="https://fosstodon.org/tags/macbookpro" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#macbookpro</a> data, and all other Apple <a href="https://fosstodon.org/tags/icloud" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#icloud</a> data, is moved to their iCloud without loss & in a fail-safe manner? Thinking of involving <a href="https://fosstodon.org/tags/timemachine" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#timemachine</a> but many apps have hidden library files. Thanx!

Ch M[ae][iy]e?r 🇪🇺 🖤 🤍<a href="https://mastodon.social/@kleibold" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@kleibold</a> damit sollte das ja auch im <a href="https://digitalcourage.social/tags/FediLZ" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FediLZ</a> für Gesamtkonferenzbeschlüsse bezüglich verwendeter Software oder Lernplattformen (z.B. <a href="https://digitalcourage.social/tags/MS365" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MS365</a>, <a href="https://digitalcourage.social/tags/AppleID" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AppleID</a>, <a href="https://digitalcourage.social/tags/iCloud" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iCloud</a>, ...) gelten. 🤔 "Wird den Beschäftigten keine echte Wahlmöglichkeit gegeben, [...], scheidet die Freiwilligkeit einer Einwilligung in die damit verbundene Datenverarbeitung regelmäßig aus."Es sei denn, die Schule verwendet ausschließlich Software, Hardware und Dienste, die keinerlei persönlichen Daten zu "eigenen Zwecken" verarbeitet. Diese dürfte dann verpflichtend eingeführt werden.

Blake PattersonI am having some kind of iCloud problem that's driving me insane. If anyone has ideas, please share them.A few days ago I sent an image through Messages on iOS to a group and got a "Not Delivered" marker next to it. Tried a few times -- same. I can click and send as SMS, and it goes through. I then noticed this same behavior happening on my Mac. According to my phone, I am logged into my iCloud account. I then noticed an alert in Settings on iOS saying to "Update Apple ID Settings." So, I go to do so and see (image attached):-- -- -- -- Update Apple ID Settings Some account services required you to sign in again.[Continue] -- -- -- --When I click continue, the waiting glyph spins for 2-3 seconds and then stops -- nothing happens. Over and over. Rebooting the phone (and on last reboot it picked up the latest iOS update) made no difference. ( Also I see my iCloud backup has not run in 2 weeks and I got a warning - so I clicked "Backup Now," which rebooted the phone... )I then went to logout of iCloud and received a series of "enter password to logout of" this or that service, then finally warned about all data on the phone being deleted in so doing, choose what I want to retain, etc. Christ. Is there another path here other than the monumental event of logging out of iCloud with all the ramifications that come with? Extremely aggravating. Thanks, anyone.<a href="https://oldbytes.space/tags/Apple" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Apple</a> <a href="https://oldbytes.space/tags/iCloud" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iCloud</a> <a href="https://oldbytes.space/tags/AppleID" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AppleID</a> <a href="https://oldbytes.space/tags/error" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#error</a> <a href="https://oldbytes.space/tags/problem" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#problem</a> <a href="https://oldbytes.space/tags/issue" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#issue</a> <a href="https://oldbytes.space/tags/bug" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bug</a> <a href="https://oldbytes.space/tags/help" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#help</a> <a href="https://oldbytes.space/tags/iOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iOS</a> <a href="https://oldbytes.space/tags/macOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#macOS</a> <a href="https://oldbytes.space/tags/iPhone" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iPhone</a> <a href="https://oldbytes.space/tags/Mac" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Mac</a>

〄Long ago I created my first <a href="https://earth.law/tags/Apple" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Apple</a> ID. Almost as long ago I set up <a href="https://earth.law/tags/MobileMe" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MobileMe</a> which became a second <a href="https://earth.law/tags/AppleID" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AppleID</a>. Today I discovered a result: - duplicative charges for Apple One Premier and iCloud & Music, adding to hundreds over the years and hundreds more for another family member’s Apple Music. - there's STILL no way to merge Apple accounts. - I can't simply abandon one account, because one has my Apple Card and the other has all my app purchases.I may be an <a href="https://earth.law/tags/AppleFanboy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AppleFanboy</a> but this is BROKEN.

chris@strafpla.netDon‘t let that rant keep you from changing your <a href="https://mstdn.strafpla.net/tags/AppleID" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AppleID</a> / <a href="https://mstdn.strafpla.net/tags/ICloud" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ICloud</a> password, I have way more than an average number of Apple devices, so I always find the corner cases. Still there‘s a lack of a proper overview over the different authentication scenarios. I have for example no idea what powers registered email addresses or phone numbers have.

Erik van Straten<a href="https://mastodon.social/@jpsachse" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@jpsachse</a> : or when your account gets pwned and the attacker does a better job proving that they are you than you - after all, *they* have access to your account - while you do not.🔸 ANDROID PASSKEY BLACK HOLE *Or* when you press a button "Clear data" (at the bottom of <a href="https://chrome.google.com/sync" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://chrome.google.com/sync</a>) which is accompanied by the text:« This will clear your Chrome data that has been saved in your Google Account. This might clear some data from your devices. »For you to subsequently find out that ALL OF YOUR PASSKEYS on (all of) your Android device(s) are IRRETRIEVABLE GONE (I reported this to Google in June 2023 and published it 6 months later in <a href="https://seclists.org/fulldisclosure/2024/Feb/15" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://seclists.org/fulldisclosure/2024/Feb/15</a>). It's still unfixed.🔸 WHY NO EXPORT AND NO BACKUP W.r.t. being able to export and/or backup all private keys belonging to all of your passkeys: that's a big dilemma (depending on your POV).The main (advertised, not taking into account a possibly desired vendor lock-in) reason is simple: if *you* have direct access to such private keys, *malware* running on your device does too.The compromise is that they are automatically synced to your cloud account, and from there to other devices (of the same brand, provided they run an OS version that's not too old), including a new device if you brick or lose your old device.However, if there's serious malware on your device, then, even if the malware authors cannot steal all of your passkeys (that is, their private keys), then you're toast anyway; a RAT such as AnyDesk may fool you into believing that you're logging in to website A while in fact it's B and they steal it's session cookie - and pwn the webaccount.🔸 SYNCING PRIVATE KEYS BTW it's hardly being discussed, but being able to synchronize secrets between secure hardware enclaves in such a way that *you* are denied access, is quite an achievement (considering that, if you buy a new phone, the only available secrets to the transport system are your definitely weak passcode, and your, potentially weak, cloud password that may be used to encrypt the private keys in transit).I *know* that it's complicated because I accidentally found out around June 2023 that Android can get confused: passkeys *seem* to sync just fine, but passkeys created on phone 1 do not work on phone 2 and vice versa. Somehow the phones had started using *different* encryption keys used to securily synchronize them (I also mentioned that issue in my reports to Google in the summer of 2023, and I mention it in the FD (seclists.org) message).I don't know how Apple syncs secrets in iCloud keychain, and neither whether a situation may exist where passkey's private keys sync but are unusable (like may happen when using Android).🔸 APPLE'S OWN PASSKEY MISERY However, Apple has got their own bunch of problems with passkeys being usable *without* requiring biometrics or a passcode to unlock them from iCloud Keychain, see <a href="https://infosec.exchange/@ErikvanStraten/113050312014160350" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://infosec.exchange/@ErikvanStraten/113050312014160350</a> and follow-up (it gets worse every time I look at it) <a href="https://infosec.exchange/@ErikvanStraten/113053761440539290" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://infosec.exchange/@ErikvanStraten/113053761440539290</a> (more details in earlier toots in that thread).In short: if you don't use biometrics to unlock your iPhone or iPad (OR you do, but you have -unlikely- disabled a specific configuration setting), then anyone with access to your iDevice in an unlocked condition (*), can sign in to: <a href="https://appleid.apple.com" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://appleid.apple.com</a> and/or <a href="https://icloud.com" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://icloud.com</a> WITHOUT entering your passcode (or using biometrics).(*) your child, spouse, someone you don't know (well) who borrows your phone to make a call (because their's battery is dead), NOTABLY including a thief who stole it while you were using it (or saw you type your passcode and can unlock it by themselves: <a href="https://youtu.be/QUYODQB_2wQ" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://youtu.be/QUYODQB_2wQ</a>).I'm not sure yet, but this may even render Apple's anti-theft system totally moot.<a href="https://hachyderm.io/@rmondello" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@rmondello</a> <a href="https://iosdev.space/@johnbrayton" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@johnbrayton</a> <a href="https://infosec.exchange/@agl" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@agl</a> <a href="https://infosec.exchange/tags/Passkeys" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Passkeys</a> <a href="https://infosec.exchange/tags/WontFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WontFix</a> <a href="https://infosec.exchange/tags/FullDisclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FullDisclosure</a> <a href="https://infosec.exchange/tags/AppleID" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AppleID</a> <a href="https://infosec.exchange/tags/iCloud" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iCloud</a> <a href="https://infosec.exchange/tags/1FA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#1FA</a> <a href="https://infosec.exchange/tags/0FA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#0FA</a> <a href="https://infosec.exchange/tags/0FAIfUnlocked" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#0FAIfUnlocked</a> <a href="https://infosec.exchange/tags/0FAIfStolenUnlocked" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#0FAIfStolenUnlocked</a> <a href="https://infosec.exchange/tags/Passwordless" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Passwordless</a> <a href="https://infosec.exchange/tags/ItsByDesign" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ItsByDesign</a> <a href="https://infosec.exchange/tags/ItsSTUPIDITYByDesign" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ItsSTUPIDITYByDesign</a> <a href="https://infosec.exchange/tags/iCloudKeychain" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iCloudKeychain</a> <a href="https://infosec.exchange/tags/Apple" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Apple</a> <a href="https://infosec.exchange/tags/iDevices" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iDevices</a> <a href="https://infosec.exchange/tags/iPhone" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iPhone</a> <a href="https://infosec.exchange/tags/iPad" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iPad</a> <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a> <a href="https://infosec.exchange/tags/GapingSecurityHole" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GapingSecurityHole</a> <a href="https://infosec.exchange/tags/Ignorant" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Ignorant</a> <a href="https://infosec.exchange/tags/Ignorance" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Ignorance</a> <a href="https://infosec.exchange/tags/Convenience" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Convenience</a> <a href="https://infosec.exchange/tags/ConvenienceOverSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ConvenienceOverSecurity</a> <a href="https://infosec.exchange/tags/ConvenienceVsSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ConvenienceVsSecurity</a> <a href="https://infosec.exchange/tags/Android" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Android</a> <a href="https://infosec.exchange/tags/Passkey" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Passkey</a> <a href="https://infosec.exchange/tags/Sync" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Sync</a> <a href="https://infosec.exchange/tags/SyncIssues" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SyncIssues</a> <a href="https://infosec.exchange/tags/WSJ" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WSJ</a> <a href="https://infosec.exchange/tags/JoannaStern" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#JoannaStern</a> <a href="https://infosec.exchange/tags/Theft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Theft</a> <a href="https://infosec.exchange/tags/Thief" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Thief</a> <a href="https://infosec.exchange/tags/Thieves" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Thieves</a> <a href="https://infosec.exchange/tags/PhysicalAccess" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PhysicalAccess</a> <a href="https://infosec.exchange/tags/Biometrics" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Biometrics</a> <a href="https://infosec.exchange/tags/TouchID" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TouchID</a> <a href="https://infosec.exchange/tags/FaceID" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FaceID</a> <a href="https://infosec.exchange/tags/Passcode" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Passcode</a> <a href="https://infosec.exchange/tags/UnlockScreen" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#UnlockScreen</a> <a href="https://infosec.exchange/tags/ScreenUnlock" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ScreenUnlock</a>

Erik van StratenIt's even WORSE than I thought.If a miscreant steals your iPhone or iPad, either unlocked or after watching you enter its passcode, they may be able to access all of your data in iCloud and in your AppleID cloud settings using a browser - even if you configured Screen Time Restrictions to limit access to critical data.Here's how (where it reads "Touch ID" replace that with "Face ID" if your iDevice isn't equipped with a fingerprint scanner);1️⃣ Assuming that you've NOT configured biometrics to unlock your iPhone or iPad (OR you've turned off 'Settings' > 'Touch ID and Passcode' > 'Password Autofill'), and:2️⃣ You open, for example using Safari, <a href="https://appleid.apple.com/sign-in" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://appleid.apple.com/sign-in</a> or <a href="https://icloud.com" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://icloud.com</a> and tap 'Sign in' and:3️⃣ You tap the (x) at the top right of the box that pops up at the bottom of the screen, and:4️⃣ You tap in the field labeled "Email or phone number", and:5️⃣ At the bottom of the screen, in the light gray box reading "Sign in to apple.com with your saved passkey?", you tap the blue button that reads: Use "<your icloud.com email address>"then the browser you're using is logged in to your AppleID account or to your iCloud account respectively.🔓Consequences In your Apple ID account, you (or an attacker who does this) can see all -and edit most- of your account details. I've not tested it but they may now be able to lock *you* out of your account.In your iCloud account they can choose 'Locate device' and disable *any other* iDevice you may have.💥 This is *even* true if you've configured "Screen time" restrictions in such a way [1] that a thief of your iDevice, who succeeds in unlocking it's screen (*), CANNOT view your account details ar the top of 'Settings', while it even fully hides the 'Touch ID and Passcode' submenu entry in 'Settings'.(*) For example, after they watched you enter your passcode (see WSJ's Joanna Stern's video's that I referred to in my previous toot) - OR IF THEY SIMPLY STOLE IT FROM YOU IN AN UNLOCKED STATE![1] <a href="https://www.ghacks.net/2024/01/31/how-to-block-account-changes-on-iphone-using-screen-time/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.ghacks.net/2024/01/31/how-to-block-account-changes-on-iphone-using-screen-time/</a>🛟 Mitigations Screen Time Restrictions [1] *does* seem to add an extra defensive layer, albeit probably insufficient.After enabling it (note that it takes about a minute or so before all protections are actally in place, so be patient), when logged in to your Apple ID account using a browser, doing most (if not all) things labeled 'Continue on device...' do not work (no notification will be received by the iDevice). However, an attacker can probably still wreak havoc.It's best to configure biometrics EVEN if you don't intend to use it to unlock your iDevice(s).Note: personally I've configured only my pinky finger to unlock the screen of my iPhone SE2. One advantage is that I can unlock my iPhone in public places without (most of the times) having to enter my screen unlock passcode.IMPORTANT: after configuring biometrics, confirm that 'Settings' > 'Touch ID and Passcode' > 'Password Autofill' is ON.<a href="https://infosec.exchange/@webhat" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@webhat</a> <a href="https://hachyderm.io/@rmondello" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@rmondello</a> <a href="https://infosec.exchange/tags/FullDisclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FullDisclosure</a> <a href="https://infosec.exchange/tags/AppleID" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AppleID</a> <a href="https://infosec.exchange/tags/iCloud" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iCloud</a> <a href="https://infosec.exchange/tags/1FA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#1FA</a> <a href="https://infosec.exchange/tags/0FA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#0FA</a> <a href="https://infosec.exchange/tags/0FAIfUnlocked" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#0FAIfUnlocked</a> <a href="https://infosec.exchange/tags/0FAIfStolenUnlocked" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#0FAIfStolenUnlocked</a> <a href="https://infosec.exchange/tags/Passwordless" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Passwordless</a> <a href="https://infosec.exchange/tags/ItsByDesign" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ItsByDesign</a> <a href="https://infosec.exchange/tags/ItsSTUPIDITYByDesign" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ItsSTUPIDITYByDesign</a> <a href="https://infosec.exchange/tags/iCloudKeychain" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iCloudKeychain</a> <a href="https://infosec.exchange/tags/Apple" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Apple</a> <a href="https://infosec.exchange/tags/iDevices" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iDevices</a> <a href="https://infosec.exchange/tags/iPhone" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iPhone</a> <a href="https://infosec.exchange/tags/iPad" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iPad</a> <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a> <a href="https://infosec.exchange/tags/GapingSecurityHole" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GapingSecurityHole</a> <a href="https://infosec.exchange/tags/Ignorant" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Ignorant</a> <a href="https://infosec.exchange/tags/Ignorance" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Ignorance</a> <a href="https://infosec.exchange/tags/Convenience" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Convenience</a> <a href="https://infosec.exchange/tags/ConvenienceOverSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ConvenienceOverSecurity</a> <a href="https://infosec.exchange/tags/ConvenienceVsSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ConvenienceVsSecurity</a>

Expert Plus 🍀🔱I got an iPhone 5C. Wanted to try <a href="https://moth.social/@mammoth" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@mammoth</a> . Apparently it requires an account .Dear Apple users! How on the fucking Earth did you created an account (Apple ID) ??????????Apparently, no matter what I try, Apple doesn't lets me to create an account on iPhone 5C nor on its web version.I want to try an iPhone . Never tried one in my life.But such treatment from Apple quite dissapoints me.I know it's a stupid question, but how do I create a freakin account on Apple's website ??????????<a href="https://mementomori.social/tags/mastodon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mastodon</a> <a href="https://mementomori.social/tags/apple" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#apple</a> <a href="https://mementomori.social/tags/appleid" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#appleid</a>