limitedsupply

Look, I totally agree with you: this situation is everyone’s worst nightmare. I wish Apple has responded in a more reasonable and timely way.

Saying that, I can see how by limiting their involvement they are reducing the risk surface. To address issues like that (and there is, of course, a huge spectrum of account hijacking situations) they would need to train an army of international support representatives who would have the authority to overwrite iCloud ownership - an incredibly questionable power. They would need to be able to validate various documents (e.g. US military ID or some obscure residence permit in Japan), be able to verify photos (which with recent ML advancements is becoming increasingly difficult), make phone and video calls to verify identify, and so much more. In turn, these representatives would become vulnerable to social engineering attacks themselves. If they overwrite ownership for a very sensitive account - who would ever trust Apple again?

It’s basically one of the major principles of cryptographic products: it’s safer for them (and, to be honest, for everyone) to deny giving access to one account, then jeopardize trust in the entire company.

I hope Apple will be able to help you through some process - maybe it takes longer than it should have. Good luck!

It looks very similar to Vimeo (just more italicized). The placement is identical too.

This is a really handy tool, and the demo video goes straight to the point!

One minor criticism: it's a bit of a turn off when a well-known logo (and even its position in the header/footer) is so brazenly copied.

You still had a pin code, in addition to the fingerprint. It's an identical situation.

For 2FA - yes. Not for when you lose your password AFAIK.

They phished the password in a separate attack.

That's basically the old idea that a single point of failure/backup is not sufficient. It's not specific to Google, Apple, Microsoft, etc. One copy can get damaged, hijacked, erased by accident - so ideally keep 2 or more (encrypted) copies.

I am sorry this happened to your brother.

I think the information you added makes the majority of the discussion in this thread irrelevant. If the thieves phished the password in a separate attack and then used that to perform iCloud account hijacking - then that's a fairly expected outcome that is not unusual in the industry. Having both the password and the phone basically proves full ownership.

I empathize with your frustration, but realistically speaking, the outcome very likely would have been the same if he used any other phone from a major tech company.

Have you verified this information? Other comments in this thread have and are saying that changing any phone number connected to iCloud requires a password.

Are you sure? Want to re-read it one more time? The phone was _stolen_ at gun point, not unlocked. It looks like the password was later phished when author's brother clicked the fake Apple support link. So at that point they had access to both the password and the phone. But I am guessing, it's not clear how/what they did.

More meaning they would have felt wronged even before that.

In general I agree that it’s unreasonable. Discounts happen, prices change, we can’t always time purchases perfectly.

Thanks for testing this, Gigachad!

At this point I will just stop commenting on this post as it seems like either Apple already fixed this or some of the most critical information has been omitted by the author. So we are just guessing and raging for no reason.

One fix that was mentioned in the comments that would have been easy to implement (and, frankly, bizarre it’s not implemented yet) is confirming password when performing such critical actions as removing or adding devices/telephone numbers.

It would have been helpful to explain that instead of leaving everyone guessing. Being able to unlock the phone is one of if not the most important detail here.

Would you prefer not being able to remove your own old phone from Find My?

There is a lot of disappointment expressed in the comments here but we need level-headed solutions, not just rage against things that are actually useful in 99.9999……% situations.