Thieves took their iPhones. Apple won't give their digital lives back(washingtonpost.com) |
Thieves took their iPhones. Apple won't give their digital lives back(washingtonpost.com) |
What's in it for Apple? Surely it's easy enough to define some kind of verification process based on various pieces -- phone number, credit card, purchase receipt, etc. -- and requiring a police report to be filed or something.
And this isn't like Google or Facebook where accounts are free, preventing manual account recovery from being scalable. People spend thousands of dollars on Apple devices across phones and laptops and more. People who don't spend money on Apple generally aren't keeping their data in iCloud.
I'm confused because it seems like the rational, profitable thing for Apple to do here is to have these procedures for account recovery. So what's stopping them? Is there some kind of huge liability question if they ever facilitate giving access to the wrong person?
If the users have enabled Advanced Data Protection and don't have another Apple device, then I can understand why it would be lost for good. But that doesn't seem to be the case in these lawsuits. They make it clear that Apple has access to the data, and could transfer/restore it if they wanted to.
Protecting the contents of peoples devices and accounts with strong encryption and hardware security is great for the individual and protects them from thieves and governments alike. If Apple designed their devices so that they cannot unencrypt the content without the users secret passsword, that's sensible for a lot of users.
But E-Mail Addresses and Accounts are derivatives of your identity and companies should have ways of returning your accounts to you, even if the content is lost, in case of stolen identities.
I am pretty paranoid about this stuff and only store private data using encryption and on trusted devices running mostly hardened FOSS software (Graphene OS, Fedora Secure Blue, OpenSuse MicroOS, etc.) and my backups are rcloned encrypted to the cloud. Yet for my most important e-mail that is bound to paypal, banking, shopping etc. I use posteo. They do this exactly right. I have personally tested contacting their support to return access to the e-mail address in case of a "lost password". After some validation, they returned access for it to me, but the encrypted content was unrecoverable. That is exactly what any responsible company should do.
Your opinion seems to be to trivialize how important this can be, which fine you do you, but I think saying it only protects "a few dissidents" is a bit ridiculous.
Every protest I've filmed at I hit the lock button 5 times so it forces a passcode. I feel secure knowing the police can't just take it and start scrolling - they need a warrant or they're bust.
You don't have to be a dissident to need your privacy.
Apple has such a process in place: https://support.apple.com/en-us/118574 (The details aren't all laid out on that web page, but Apple support may ask for information like purchase records to confirm ownership.)
What I think is at issue here is that it will only restore access to an account which is not currently being accessed. If an account is being accessed from a logged-in device, Apple is unwilling to cut off the current user's access to that account and hand it over to another party.
And, quite honestly, I can see where Apple is coming from with this policy. Arbitrating access to a contested account can get really messy (e.g. consider a scenario where an abusive partner is trying to access the victim's online accounts).
An account is supposed to belong to a single person. If you are able to definitively prove that you are that person (for example, by showing up to an Apple store with your ID card), you should be able to restore access to it. An abusive partner won't have access to that.
Refusing restoration when someone else has access to it is understandable, but it works the other way around as well: an abusive partner would be able to prevent the legitimate owner from accessing the account.
I think it's far more likely that Apple just can't be bothered. Dealing with stuff like this is messy and complicated, and they aren't going to lose any revenue from those few thousand people a year losing their account and all their data.
This is what I was thinking as I read the article. Imagine what will be written about them when they do give iCloud access to an impostor. Depending on what's on their account thieves could dedicate a ton of time to social engineering Apple into recovering the account. The article mentions police reports being "proof", but that doesn't seem like solid evidence considering how easy it could be to fake a police report from one of the tens of thousands of jurisdictions in the US. This is a problem for a lot of industries actually, i.e. banks and death certificates.
Given the stakes, Cupertino may have decided that it does not wish to arbiter such disputes. Requiring a court order shifts the dispute to that forum.
Look what happened to the mobile carriers and sim-jacking.
As long as the people cut off from the walled garden amount to less than a rounding error in Apple's bottom line, they simply don't care. They will only care when a judge forces them to care, as we had to find out the hard way in a class action lawsuit against Apple. We won, but they lost us as lifetime customers. My wife even owns Apple stock and refuses to buy anything else from them and warns others against it. They could have made it right for practically no cost to them, but they chose the dick move, and they were forced to pay out in the end anyway.
Various entities will still be able to get to the data, while users might incorrectly assume that that's not the case.
For those interested in the silver bullet to backup iCloud.
Get a Mac mini with enough space for your photo library and wire it into your network. Sign into iCloud.
For photos open the app and change the settings to store full res photos locally.
Enable iCloud desktop and documents sync.
Two options
1 - Sign up for Backblaze and ensure you map the folders from iCloud and photos that are being synced to the device. Let it run and do a full sync. I use this option.
2 - Buy an external drive with a lot of space and use Carbon Copy Cloner to mirror your drive. The caveat is your at the mercy of a local copy that a home fire or electrical incident can destroy.
I like Backblaze for the sheer constant syncing it does and they allow me to set up an encryption key so they don’t have access to my data.
[0] https://github.com/icloud-photos-downloader/icloud_photos_do...
A few things you can do here:
- Own a mac with enough storage to download your entire iCloud / Apple Photos data set. Configure your mac to do so. Your mac is still activation locked to your Apple ID though, so backup that local copy through Time Machine or the service of your choice (e.x. Backblaze). A NAS is very helpful to automate this.
- Use app(s) on your phone that will copy of your data to the location of your choice, such as Photo Sync.
In this case, the phone was marked as lost immediately, but a couple of days later the thieves started trying to reset the password on the owner's iCloud account using various methods, the first of which produced 1st party push notifications asking to confirm the account password reset that were sent to the owner's other signed-in devices that were still in their possession. In the moment, it would be so easy for a confused & stressed person to accidentally or mistakenly tap those notifications and enable their own account hijacking.
The thieves then evidently called Apple Support and tried to get the iCloud account password reset over the phone, but by this point the owner had already gotten a new phone and SIM for their phone number, which meant that Apple Support's 2FA SMS codes were received by their replacement phone (in their possession) instead of the stolen phone (in the thieves' possession, and which no longer had cell service). It seems like if they had delayed in getting their new phone and left the stolen device with functional cell service, the hijacking might have succeeded at this point.
Apple's own "What to do if your iPhone is stolen" page [0] has no info these tactics that are actually used in the moment by phone thieves. That page does link to a page about social engineering scams [1] but approaches that in a general sense.
I think Apple's way of handling it should be way more intuitive. For example, they should differentiate between phones that are lost and stolen. If your phone is lost, you want to protect against someone finding it and being able to access the phone's contents. If your phone is stolen, the thieves will most likely try to hijack your iCloud account as well, and they'll try and social engineer both the owner and Apple Support to do so, so add a "Mark as Stolen" option that also adds protections against iCloud account hijacking.
That won't give them access. When you respond to the reset password notifications, it then asks for a new password on the same device you responded on, not on the device that requested the reset.
Apple has no adequate way to actually verify who anybody is without (a) forcing them to physically visit one of a small number of offices (it can't be every store), and (b) probably charging a significant fee to cover the cost of doing real verification.
And even that demands assuming that the identifying information on the account is right.
But in general, the way that most humans "naturally expect" such things to work is simply incompatible with the usually-extremely-convenient nature of computer accounts and cloud services.
Trust your government.
"It works well for everyone else, why are you being so weird by not doing what everyone else does?"
Grant the megacorporations control over your entire life.
Your government will protect you from the megacorporations.
"Self hosting? Open source? Linux? You're weird, just get an iPhone."
The megacorporations never make mistakes.
The government never makes mistakes either.
"What's wrong with you? Are you seriously too poor to afford an iPhone? Get a blue bubble already."
The megacorporations never lie to you, they never manipulate you.
Even if they tried, your trustworthy government would stop them.
This message brought to you by social conformity norms that are most certainly NOT subtly reinforced by the same billionaires and trillion dollar companies that benefit from them.
/s
https://www.wired.com/story/apple-is-an-ad-company-now/
> Oct 20, 2022 - Apple Is an Ad Company Now
> There’s a side to Apple most iPhone owners don’t know. There's Apple the hardware company, the one that has spent the past several weeks showing off new phones, a more rugged Apple Watch and some confusing new iPads. Then there’s the other, quieter Apple, focused on something of a dirty word: advertising. And that part of Apple is getting bigger by the day.
https://appleinsider.com/articles/25/04/14/apple-rebrands-it...
> Apr 14, 2025 - Apple rebrands its advertising business as 'Apple Ads'
> As Apple expands its advertising business, the company has renamed its former "Apple Search Ads" to "Apple Ads," reflecting the expansion of ad placement.
> Previously, when a business bought ads on the App Store, they would be suggested at the top of the search screen. In 2022, Apple began expanding its advertising practices adding slots in the Today tab and in the "You Might Also Like" slot below individual app listings.
Some facts:
Only the user's devices hold the keys to decrypt the data.
Apple cannot decrypt it, even if served a subpoena.
Just imagine Google letting people "brick" their accounts because they have a password protected PDF in their Google Drive they don't remember the password for...
And that's to say nothing about the not end-to-end encrypted data, which is still the default for most things in iCloud accounts (without ADP enabled).
Instead of wanting something impossible, accept the reality.
In the end if you dont backup your data locally, then its not your data and you risk losing it.
If your business shuts down because you lost your phone its your own fault for not mitigating this type of risk enough.
I try to do it every month because I am that type of techie. They don’t make it easy.
For photos, i have a 2TB family plan. There is no export functionality I can centrally backup my families photos and shared albums
The supported way to do this is to use a Mac, force it to store all images locally in settings, then highlight all your albums and File->export
This takes hours. I need to stay connected to my network drive because I don’t have 4TB of local storage on my laptop. If there is a failure it’s game over. You can’t resume or even know what failed. There is a tiny progress bar icon to work with. That’s all
iCloud Drive? Same thing. You need to force it to sync all your files, and there is no way to know if it’s hung or what. You can’t do this as family account owner for everyone.
What about all that app data that is saved to iCloud? I don’t even know how to access that to back it up.
Apple makes many things very easy and other things practically impossible.
Backing up your entire iCloud data for disaster recovery is one of those things that’s basically impossible.
That would be the fact that Apple lets anybody that knows the passcode reset the iCloud password as well, without any further authentication. And the passcode can be shoulder surfed by the thief...
"Stolen device protection" was developed as a response to a wave of such thefts: https://support.apple.com/en-us/120340
It seems like a good step forward but still not perfect, and I believe it's not on by default.
On the other side, with Advanced Data Protection, it seems shockingly easy to permanently lock oneself out of an iCloud account: As far as I understand, there is absolutely no way to recover an account protected that way if the recovery code is lost – not even by deleting all data currently stored on it and starting from scratch (e.g. from a local backup).
Given the fact that an iCloud account doesn't only contain a big pile of data, but access to some purchased products and services (subscriptions, app purchases, iTunes songs, the Apple Card etc.), that seems like a pretty big oversight.
Doesn't this require at least one other device to allow access and provide a one-time code?
I can't log in to iCloud in a browser, update payment information, or do anything even remotely sensitive with just one device and my screen lock mechanism(s).
EDIT: I stand corrected. On a device that's designated as "trusted" you can indeed change the password using only the screen unlock using the instructions at https://support.apple.com/en-us/102656
Apple is the only one who truly profits the most from this "innovation".
I have had an iPad stolen, and while I could track, it definitely didn't make any difference.
https://support.apple.com/en-us/102656
This article seems to make it pretty clear that having a passcode on a signed-in device is enough to reset the password.
One of the big distinctions I make in my life is whether a passcode is being typed in frequently and in view of the public. And since these are shorter codes, the entity on guessing from a distance is much lower.
My daughter had her iPhone stolen in L.A. — she immediately wiped it remotely. The thieves were unable to access it.
I got her a new iPhone pretty fast (the budget one) and she was back in business, back in her iCloud account. (She was one of those that saw her device head to Asia. She got a handful of text messages pleading with her to remove the stolen device from her account but she ignored them.)
I’ve read a couple stories where someone was held in an alley while an accomplice went to an ATM to withdraw as much cash as they could.
What, the guy just jumped into the Pacific and started swimming?
It's all about posturing and pretending, image is the only thing that matters to Apple.
Apple could decrypt and return all the user data in all the cases in the article. They aren't doing that. Some folks are rightly pointing out "what is the point of storing all my stuff in your cloud if you're going to lock me out if I lose my phone?" That's not a backup, that's just paying a monthly fee to store more than what your phone alone can store.
Supposed to yes. But in practice there are WAAY too many adults giving their kids devices without a specific child account. People have shared FB profiles ffs.
FWIW, from the 2022 Wired article:
> Insider Intelligence, a market research firm, estimates that Apple brings in $4 billion a year from ads. ... Investment bank Evercore ISI estimates Apple will have a $30 billion ad business by 2026. That’s about the size of iPad sales in 2021, or a bit under half the company’s services revenue.
The growth in ad revenue is large enough that Apple's latest 10-Q highlights it: "Services net sales increased during the first quarter of 2025 compared to the same quarter in 2024 due primarily to higher net sales from advertising, the App Store and cloud services."
At what point will you consider Apple to be an advertising company? Not until ads are 50% of revenue?
$4B is less than 1% of their revenue.
If they can grow their ad business from $4B to $250B (50% of revenue) then yes maybe I’ll call them an ad company, but I am talking about their reality today, and the reality of Apple for the past 50 years, not fantasy or fiction.
What on earth are you referring to?
That's not exactly the same as refusing to comply with a court order.
The middle ground option where Apple has the ability to do this but is also somehow able to take a stand against the government is kind of difficult to support, because it doesn't make much sense.
I didn’t know what that meant - so I googled it. And it says something entirely different….
Quote: Pressing the lock button (or side button) five times quickly on an iPhone or many Android devices will activate Emergency SOS. This will prompt a countdown and eventually, if not cancelled, initiate a call to emergency services, potentially alerting emergency contacts and sharing your location.
Note that there are 5 side buttons now (if you include the 2 volume button) on current iPhones. So “side button” doesn’t mean much. The top right side button is the default lock button on all iPhones and AFAIK always has been. That’s what you use to trigger it.
Personally, I just open the slide-to-turn-off phone screen instead (hold volume + side button for a couple seconds). Once that screen is loaded, it'll require a passcode to unlock after you cancel out.
But they don't.
Yes there are some high-profile instances of Apple refusing to assist. Since you've heard about those, it is only because there is no gag order on them, which means they are cases the powers that be don't care if you hear about them.
Apple is a US corporation, so for anything the government actually wants to get without publicity, they'll get a rubber stamped NSL which forces both compliance and silence and of course Apple will quietly comply.
This is why the argument of "I trust XYZ company to do right" is illogical. It doesn't matter, because they will be forced to comply. The only way to keep your data safe is to never hand it over to these third parties in the first place.
Apple has played the marketing game around some high-profile cases because they got some incredibly juicy free promotion for it but they collaborate with many governments on a daily basis.
I don't have the link but there is a page out there showing all the requests for data access that are fulfilled by big tech companies. Apple is very much collaborating in the EU, without making a single noise about it.
It's all about marketing and keeping their power. If Apple had any principle they wouldn't even being able to operate in China...
We can see from Apple's 2024Q4 10-Q that "Revenue" is described as "Net sales", and that Q4 had $8 billion for the IPad, so about $32 billion for the year - comparable to the prediction of "$30 billion ad business by 2026".
Total net sales in Q4 was $124 billion of which $26 billion was services (where ads and Google income are placed).
The $4 billion was from a few years ago. The actual number doesn't seem to be published, but the numbers seem more like 7-8 billion, which is about 5% of revenue, not less than 1%.
Apple’s 2024 revenue was $391 Billion. Advertising is therefore about 1% of their revenue. Simple mathematics.
"Total net sales" is $391 Billion. $295 Billion from products plus $96 Billion from services.
https://www.apple.com/newsroom/pdfs/fy2024-q4/FY24_Q4_Consol...
Don't confuse quarterly with annual revenue.
Quarterly is just for three months. Four quarters within a year. Apple's fiscal (financial) year ends in September.
If "Investment bank Evercore ISI estimates Apple will have a $30 billion ad business by 2026" is correct, then $30 billion/$391 Billion is over 7%.
If we go by the 2022 publication number (so likely from 2021) of $4 billion then yes, that's about 1%.
I can't find concrete numbers. https://www.emarketer.com/chart/260183/apple-ad-revenues-wor... has 10 billion in ad revenue for 2024, which would put it at 3% last year.
https://www.investors.com/news/technology/apple-stock-advert... says "he sees Apple's global ad revenue hitting $19 billion by 2026" which would be 5%.
I would also force users to watch a video explaining the security features and quiz them before turning them on. You can't expect users to immediately understand how the security model works.
Even with their strong privacy fundamentals they know more about their account holders than any single business should.
My bank is able to verify me remotely to login to their app from a new device in under 15 minutes, just with a photo of my ID card and a video of my face. And the bank is liable for any losses caused if they misidentify me.
Why can my bank do it but apple cant?
Perhaps even more important, the bank knows exactly what liability it's assuming, and what risk it's exposing you to. There's a limit on how much money the app will let you move (even if the bank doesn't tell you what it is). All the transactions you can do are defined by the bank, it knows what's going on at all times, and it can and does apply extra checks for risky-looking transactions.
And bank transactions in general have a whole reversal-based security layer on top of all that.
On the other hand, people use their Apple accounts to log into God-knows-what third party systems with God-knows-what risks and God-knows-what other security measures or lack thereof.
Oh, and also the bank charges you ongoing overt or hidden fees specifically to cover the costs of securing your money. And of insurance if it fails to do so.
Meanwhile Apple is unable to manage to identify its own customers in its home jurisdiction.
Banks write off tens of billions of dollars of fraud costs a year. They can do this because money is fungible.
I don't know, I'm not a multi-billion dollar multinational organisation employing some of the smartest and highest paid engineers in the world.
Off the top of my modest head though, an ID check at one of the thousands of stores they have around the world sound like it could work.
The fact that the government doesn’t have a great standard for identity and it’s left to banks and tech companies is crazy.
You know there are smart criminals who use fake, or fraudulent passports and travel documents? And yet we still go through the process of using them because a system with some control is better than chaos and no control.
You haven't figured out that there are hidden charges? They're not giving you an account because they love you. They're giving you an account because they're making money on your deposits and/or transactions and not passing it on to you. And the money they're making is pretty proportionate to their risks; the more money you have to lose, the more they're going to make.
Whatever revenue iCloud manages to eke out of a random iPhone is going to be far less, and far less correlated with risk. Apple has to structure the system around the user who buys zero premium services.
> has a £10k limit on transactions
So a low limit by the standards of what we're talking about here, and a nice, quantifiable, insurable amount to boot. Which, as I said before, is the most important part of the whole thing. Oh, and I suspect you'll find out that the limit magically gets lower if the money is being sent to wesellgiftcards.com or whatever.
The person featured in the sob story here claims to have lost an entire career. That's going to be worth quite a bit more than that transaction limit, but how much more is hard to say because it's unquantifiable. It is of course stupid to make that dependent on your iPhone, but Apple still has to worry about it if Apple starts trying to take on responsibility for that kind of stupidity.
> despite having never seen any of my real documents in person
You should get a more responsible bank. Although nowadays they may be able to pull, for instance, your ID pictures from government databases to compare with whatever you send them over the Internet... since they have the numbers (and maybe the authorization) to do the lookups. Unlike Apple.
> Meanwhile Apple is unable to manage to identify its own customers in its home jurisdiction.
"Home jurisdiction" is irrelevant. It's not about where your headquarters are. It's about where you operate. Whatever Apple sets up in its "home jurisdiction", it also effectively has to support throughout the world. There aren't enough phone buyers in Cupertino to support Apple's valuation.
2026 is in the future. Doesn’t exist yet in reality
I don’t really know what point you’re trying to make now
I don't think dividing the pre-Oct 2022 ad income by the 2024 revenue is all that meaningful.
It's an insignificant part of their business even if it doubled or tripled in size.
Apple is obviously not "an advertising company" as opposed to Google which has been an advertising company since the beginning.
Apple was founded as a computer company ~50 years ago which sold the Apple I. Steve Jobs and Steve Wozniak. Nothing to do with ads. Now 50 years later they are starting to make some extra money on the side from ad revenue.
You won't call them an ad company until it's 50% of revenue. I understand that.
But if Alphabet were to buy UnitedHealth Group, so that Alphabet's ad revenue were under 50%, Alphabet would still be an ad company.
The newspaper which I subscribe to is also an ad company, because they sell ad space.
The radio station I listen to most is not also an ad company, because it's a volunteer-run, listener-funded station.
My company is not an ad company because it only gets revenue from product sales and consulting services.
Apple has never been an "ad company". They sell computers, software, subscriptions, and they take a cut of the App Store revenue. Ads are a tiny part of their revenue now. Doesn't make them an "ad company" like Google, where ads are their primary revenue source.
I bought a lot of Apple products. They made their money from the high margin in the purchase price, not ad views which I have never seen anywhere on my Macs and maybe seen a couple of the ads on the app store on my phone. They earned about 1 cent on those two ad views, and thousands of dollars from the hardware sales and iCloud subscription.