Hacker News new | ask | show | jobs
by kemayo 875 days ago
This is a pretty direct response to the WSJ's iPhone theft story from last year[1], which was focused on people managing to shoulder-surf your passcode while you're in a public place, steal your phone, then use your passcode to reset your Apple ID password (thus locking you out of being able to report the phone as stolen). It apparently relied on multiple people and a certain amount of social engineering -- one party managing to get the phone into a passcode-required state, another to see it entered, and a third to actually lift the phone.

The hope would thus be that although someone could walk into your workplace and steal your phone off your desk, they would be much less likely to have been able to watch you enter your passcode first.

[1]: https://www.wsj.com/articles/apple-iphone-security-theft-pas...

1 comments

Yeah I saw that article too. It closes that one hole the wsj reported on but pretending there aren’t other credible threats is silly. a bad actor at work could observe the password and then steal the phone at a later date, and take it to the bathroom for instance. That’s just what I’ve come up with from there to of my head.
I agree in spirit with your stance, and it is a good solution to the shoulder surfing problem.

But generally I don’t think it’s plausible for a mass market device to counter every kind of threat, or every iteration of a more specific kind of threat.

In a workplace or home theft scenario, there are _presumably_ better ways of identifying a thief than at, say, a random bar.

My beef with this feature is that my Significant Locations haven’t been accurate for over a month, so my home location isn’t “trusted”.