yeah this happened to me yesterday! i can still get in with passkey on my iphone but im dreading needing to go to apple store and tell them that i have been progressively getting logged out of my normal couple apple devices
Same here in AU, this happened to me about 8 hours ago. Standard reset procedure worked.
Now when trying to configure a Recovery Key from my 2021 iPad Pro I’m told that I can’t do that from ‘this new device’ of mine. ¯\_(ツ)_/¯
And when I try it from my iPhone I have to wait an hour because of Stolen Device Protection. Apparently I’m not at a ‘familiar location’. I’m at home. I work from home. This phone is in this house for 99% of the time.
Check if you have location services -> system services -> significant locations On. If it's disabled then effectively you have no "familiar location" as far as iOS is concerned
I loved Stolen Device Protection when I first heard about it. And now I've wasted hours of my life dealing with it as part of the "Daily Lockout".
And tech companies again demonstrate that they are "all about the user" by providing no clarity, acknowledgement, or empathy around the issue. It's depressing.
Perhaps this is real talent in tech: to make things seem rather than be, and to build ways to avoid service and accountability unless it leads to max profit.
I shouldn't be surprised each time this happens, but optimistically I still am.
This is exactly what CloudFlare and Google have been doing for a while. i meet so many tech illiterate people who "can't log in to the internet" because of some discouraging CAPTCHA or because Gmail decided that even though they knew their passwords, a phone number they haven't used in 2 years (and has probably been reallocated to someone else) is a better proof of identity.
It's a shame it's even legal to discriminate people's browsers based on shady stats and not actual abuse.
That's very unlikely. If you talk to anyone working in a public library or a local non-profit assisting elderly/homeless people, you will notice these issues are systemic and not isolated cases. From the cases i would see first hand, nothing would suggest that they had been compromised in any way.
It would be really awesome if Google would kindly tell them so they could have an opportunity to fix the issue and reactivate their account, instead of hard-locking them out with no recourse.
It's not like people are encouraged to keep their valuable data with these companies, only to lose the ai-fraud-detection lottery.
Because HN loves to complain about this, I get to repeat it as always. Enroll a real 2fa (totp, security key, passkey) on your account and you will not face any of these issues. There's a reason they do this for insecure accounts and an easy way to avoid it.
I've logged into years-dormant Gmail accounts, from small towns in Mexico on a $2usd Mexican SIM and google has not even batted an eye.
Last I saw you could enable full dtrace. Involved a reboot IIRC, which makes sense. I think the process wasn’t too different from what you do to enable unsigned kexts.
It’s… entirely fine that it takes a 3-5 minute process to disable security that keeps processes from snooping on one another. That’s an excellent default.
Happened to me today. First got the message on my computer that my location was unknown and needed to enter a code from the phone. By the end of it, I had to reset my Apple password. No idea why it happened.
Happened to me last night. I got a push notification on my watch that I needed to update my iCloud password. I thought that this isn't right, so I went to my phone and MacBook. Same thing, those devices said I needed to change my password. So I figured someone has my @iCloud email address and tried to login. I do have hardware keys setup, so wasn't terribly worried.
But none the less, I liked my old password and had to change to something else.
Hmm I used to get kicked out regularly (like 3 times per month) out of my apple login before i enabled 2FA. It completely stopped after. I assumed they were fraudulent login attempts.
This does look more like a glitch on their side though...
I have had iPhones for more than a decade, and I never leveraged any "feature" of having an Apple ID on any of them.
I've never bought an app or spent money on one, and I don't use iCloud, so the Apple ID for me is literally just a gateway to downloading free apps that I can always redownload with another one.
If your device is associated with the "Find my Mac" "Find my iPhone" stuff, losing your Apple ID is the same as possibly (only possibly because you can still have user accounts with separate passwords and use the OS, but there will be limitations) bricking your device.
You can't even wipe the hard drive and reinstall macOS without access to the associated Apple ID. This is a good measure to dissuade thieves from wanting to steal Apple devices, but it is a terrible measure from the point of view of a user who has lost their ID.
>If your device is associated with the "Find my Mac" "Find my iPhone"
I said "if your device".
**IF**
Is it difficult to understand?
If it isn't associated (with "find my" turned on) there's no issue.
If it is, and you lose your apple ID, you are SOL. Turning on "find my" with an associated apple ID is the same as making Apple the only entity that can truly control and own your computer. You can no longer reinstall macOS without your apple ID if there's an issue.
Without being signed into an AppleID you cannot install free apps either.
And if you install then sign out, you're also blocked from updating the free apps.
exactly. they already hit the revenue goals even with shitty quality. it's the only goal that motivates work and in a monopoly it's tied to market size only.
what's a few thousand people per month losing all access to their data, if that is not even a blip on their revenue or revenue protections?
if you're going to buy a new iphone, you're going to buy a new iphone. it doesn't matter the slightest if you read some nerds complaining something broke one theirs that same week.
People pay in average $1000 every 3 years ($27 per month). So if 1% people choose Android next time, Apple will lose 1% of 2 billion users x $1000 / 3 years = 7 billion dollars per year.
but if you're close to a monopoly, numbers go up with market size increase. you can lose ((market size Delta) - 1) until your bonus motivated employees have to care.
If you prepare for a case like this then it's easy. If you get caught off guard (like I imagine most people will) it's hard.
I have an unhealthy habit of switching between FOSS and Apple a few times a year (don't ask) and generally it is pretty easy. The most annoying thing to me is Photos export, especially if you don't have access to a Mac. You can't download your whole library from the online environment, there's a 1000 image limit per shot.
edit: Also I have not found a good way to export from Apple Notes so I have a habit of typing into .md files from the terminal.
edit2: Gave it a search and tried Exporter. Duh. Works great!
Actually an anecdote on switching, my father in law bought an iPhone in a pawn shop. It was logged in with someone else’s iCloud account. He just used that until he dropped dead. We had no idea until I had to clean his phone out. My mother doesn’t even know what iCloud is. Literally total ignorance must be the default for everyone these days.
I’ve done the random switch thing as well as a test case. But to Microsoft. It took me a day to export all photos from Photos.app and into OneDrive and that was with a Mac (105Gb). And of course you lose all the edits you did if you export the originals.
Yeah, I never understood this whole "you're locked in, you can't get out of their ecosystem."
This has always been BS. I've switched from Apple to PC to Linux back to PC to Apple back to PC and then Android etc etc. It's actually quite simple. At the moment I'm using Apple stuff, but there's nothing holding me here other than just me being here.
Suppose Walmart has a monopoly in California and Target has a monopoly in Florida. Anybody in California can shop at Target, they just have to go to Florida. "I've switched from California to Florida and then back, it's actually quite simple."
But if you're in California and you need some batteries, even if flying to Florida to buy them from Target is possible, even if you used to live in Florida and might move back there next year, even if you have the money to buy the $300 plane ticket, it's still prohibitively expensive to do it solely to avoid a $5 markup on batteries. Then the two stores don't really have to compete, and you get stuck paying the monopoly price for everything. That's what it means to be locked in.
> You buy different stuff, copy your data across and sell the original stuff.
You buy a different house, move your stuff across and sell the original house. How is it a crappy analogy?
The issue is that the cost of moving removes your choice from individual decisions because they all have to be made together. If you want iMessage then you have to sell your Android and get an iPhone. If you want F-Droid then you have to sell your iPhone and get an Android. What if you want both? This isn't because the free software community would be unwilling to set up a store/repository for iOS, it isn't because no Android messaging app would be willing to interoperate with iMessage, it's because you're locked in to one platform or the other at any given time and have to make all your choices together.
Someone who wants to provide an app store that charges lower fees would have to convince everyone to switch to their platform instead of only convincing people to switch to their store.
The reason they make it that way instead of being able to choose what you run on your device independent of the kind of device is in order to lock you in.
Where is the button to copy your photos from apple to google? Until something like that exists normal people are 100% locked in.
They may not even own a laptop with sufficient storage to download all their photos to. If all they have is one, maybe two, phones with limited storage they're totally fucked. Just like Google & Apple designed it.
And it's not like these services make it easy to bulk download/upload your photos, either.
"Even though I paid for this home (laptop) and have all my things in it, I can totally buy another from another realtor if the current locks me out. So joke's on them, it's not exactly a walled garden"
We can all use hyperbole and carefully pick our narratives when we want.
Example: I can live in this nice comfy condo for a sky high fee (Apple) or I can live in a rickety old shed I have to keep fixing for free so I don’t have to pay the ground rent (Linux).
I’d rather live in the condo even if the lease runs out one day.
I'm not saying it was a bad analogy, just that it's easy to create analogies to create a narrative based on your own perception. Obviously the point was missed.
In this case, their analogy seems to be based on reality.
The key point of their analogy is that buying another condo isn't a good solution to someone locking you out of the one you paid for, just like buying a new phone isn't a good solution to Apple locking you out of your phone that you paid for.
Your complaint with their analogy seems to boil down to "they used an analogy", without actually addressing the point above. Try to focus on the point instead.
I use Tailscale, NextCloud (files, pics, calendar, contacts), Podverse, Obsidian, Bitwarden (Vaultwarden), Home Assistant, ProtonMail, Signal, Element, …. If my iPhone (iCloud) goes down it’s just a node in the network with all my data still my own and available.
That's great for you and everyone on HN who's tech savvy, but your average smartphone user has no idea what those even mean let alone how to set them up and use them. Your parent is right and is being needlessly downvoted.
My dad is often defeated on how to set up or use basic features of his smartphone, let alone on how to migrate stuff from one ecosystem to another, which let's be real, is purposely designed to be as friction inducing as possible.
You can add it the bucket of similar crap that nerds make when they don’t think to actually check if they’re building something that solves a problem that people actually want solved.
The reality is that if you go to any family BBQ and start going on about the importance of self-hosting, I - someone that’s been working with computers my whole life - am going to roll my eyes and not be all that interested in the conversation, let alone anyone else there (chances are they don’t want to talk about computers at all).
The reality is that these open-source / self-hosted solutions are, the vast majority of the time, harder to use and maintain. There are few things that sound less appealing to me than dealing with the realities of helping my family and friends with using any of that stuff.
This is all just some nerd’s out of touch pipe dream.
> This is all just some nerd’s out of touch pipe dream.
Yes, though only because it's a lot of trouble to set up today.
If it were completely commoditizated -- imagine one more button when setting up a new phone ("Choose where your data resides: Apple, Google, Facebook, Self hosted") and it was completely transparent then it would be used much more, especially if that's complemented by one of the nerds setting up e.g. a neighborhood sync server and everybody around knowing it and using it.
So yes, you are not wrong but the situation can change dramatically if ergonomics are improved. Which sadly most of the nerds never work on.
I used to think this. The Google, Apple, and Facebook options are the improved ergonomics solution. It just never pans out for these open solutions. I've been waiting decades for it things to get to that level, but it always ends up the same way - fiddling with servers.
You are restating that the self-hosted options are not as ergonomic yet which I already acknowledged.
As for waiting, yeah, sad story, but most of us don't want to be on the computer for 16-18h a day anymore. I implore any of the more privileged programmers -- people with job security, $200K+ annual salary, a lot of social safety nets -- to open their eyes and stop fucking around with the one millionth LISP interpreter and just start making non-corporate-controlled tech already.
understood. I am only extending that to say that virtually all software is built with the headspace of "some amount of maintenance" is to be expected. To overcome this, it needs to be delegated to someone. That someone will cost money. It's unclear to how this cycle will ever be broken unless the entire solution is somehow also controlled and produced with uniform open source hardware.
Sure, I don't disagree with that, though I think that we the "nerds" should _really_ stop churning tech and versions of stuff so hard, but that's sadly outside of your control and mine.
In other words, if you built one nice Golang / Rust program and only update the server once every 3 months, you can go quite far without touching it too much. Likely 3-5 years.
So, say you choose the "self hosted" option. I really hope you have at least a RAID10 with 2-drive failure, and regular off-site and off-line backups as well. Choosing "self hosted" is a very risky option, because most people have no clue how to protect their data from loss. I'm sure you'll explain next that some hack0r will figure out how to do redundant backup self-hosted for very little cost that even the stupidest human could use, but I just don't see that being an option in my lifetime, if ever. Okay, so then "self-host" in the cloud? Well that's not really "self-hosted" is it?
I will agree that nerds work far too much on pointless pursuits.
I get what you're saying, but not all of those things are self-hosted. For example, Proton Mail isn't harder to use than Gmail. Signal isn't harder to use than any other messaging app.
I've had great luck convincing even church ladies in their 60s to use both just by explaining that "end-to-end encryption" means that only the sender and recipient can read the messages, not big tech companies and advertisers.
For most people, losing their iCloud or Google accounts would be devastating.
I always joke that I'd rather lose all my documents and credit cards than lose my main e-mail account. And only tech savvy folks understand that it is not, in fact, a joke.
How's that? All my contacts can be stored locally, photos backed up both on my computer and to a separate service plus iCloud, it's pretty easy to set up Dropbox or Box in-place of iCloud Files. Apple Wallet is handy but it really just stores digital copies (over-simplifying) of my physical cards, any of which I can request a replacement for outside Apple.
I don't use Safari but if I did any of its bookmarks/history are easy to import into other browsers.
Yes, you can do this with considerable effort.
But the moment you use OIDC with Apple ID there is a good chance you will lose many of the accounts created this way.
OIDC is the one part of this that really is an outsize problem.
I’d say email providers are an even bigger problem though. Good luck getting your accounts back if you lose access to your own email account. I don’t know that iCloud mail is particularly popular, but the risk really applies to any provider.
“Save in an encrypted file”? Christ. We really need to draw a HUGE line between “hacker news user solutions” and “things that are practical for actual people to do”.
Most people have a file encryption program of some kind on their computers. WinRAR, 7-Zip, some versions of Microsoft Windows (note: not supported in Windows 10 Home), Microsoft Word…
I agree, that there is no obvious solution by just enabling a setting...
But no matter what tool you use for it, that is what needs to be done. It is quite simple for example if you use Macpass or Cryptomator on a Mac.
Your contacts can be stored locally but your device will not work if Apple says so as it needs to be "activated" against their servers. And there is no "secondary system". So no, you are completely dependant on Apple and their infrastructure even if you (think you) store data locally.
You can use a Mac or iPhone without an iCloud account. Doing so works fine for Mac, most applications can be downloaded outside an app store. Sadly on iOS it makes the phone pretty useless if you want to install any third-party apps.
Like others say, it's fairly easy to escape, just keep backups outside iCloud. Also, it's probably best to use a password manager that is not iCloud Keychain.
Agreed. What’s more, I find iCloud’s implementation in MacOS to be far less intrusive than OneDrive in Windows, which constantly pushes me to use it as a default, and has at least once unilaterally forced the issue during an update by moving my home folders into OneDrive, and leaving an absolutely wild text file titled “Where Did My Files Go.txt” on the desktop. If I don’t want to use iCloud, I can easily forget it exists.
I’m not terribly partisan when it comes to platforms, I own and actively use an M1 Mac Mini, Dell Precision running Windows, and a Kubuntu box. I understand the assertion that software ecosystems tend to be a featured player in tactics aimed to fix users on a particular device or platform, and I think there’s plenty of evidence that this is broadly the case. But I wouldn’t use iCloud as a particularly good example of it, Apple’s clearly not banking on their cloud storage to drive its revenue.
The truth though is that if a consumer right remains hardly enforceable and impractical to sue and get any real resolution from doing so, corporations can live with consumers retaining it...
I would say that most of the time people don't even know that not everything written in a contract might be valid in case of a legal dispute. However, once in a while we have nice things, such as requesting to be refunded the windows license https://sistemainoperativo.it/#:~:text=Come%20chiedere%20il%...).
Unfortunately it's in Italian, basically if you don't accept windows (and office) tos you can be refunded, almost nobody knows this except some Linux users. However, if you follow the steps (such as not accepting the tos) you're basically guaranteed a refund or to win the legal dispute
Just to add: This right to be reimbursed of Windows OEM has taken extremely long in the 1990ies to become a right, after much lobbying from Linux fans.
I did that once, almost 20 years ago. Bought an IBM laptop that came with windows (there weren't any options w/o Windows back then, for consumers at least). I always planned to put Linux on it.
Rejected the TOC. Made a meticulous image report that showed careful unboxing and setup.
There was a line in the TOC that (from very vague memory) disallowed using the OS for a.o. nuclear power mgmt. I did work in energy back then (but mostly webdev), so I could not rule this useage out. Send it along to Redmond and got a prompt reply from som e salesman for some kind of "industrial licence" for insane amounts. A few back and forths later, I got a measly €20 Euro's back. They put the rest down to admin fees, and OEM discounts.
Anyway. It ran SUSE and (k)ubuntu perfectly.
I guess it's much easier nowadays. But I buy my laptops preinstalled nowadays. Open the lid, answer five or six questions, restore my backups (/etc, .files, ~), reinstall the packages from packages.txt, reboot and continue working.
As of today, in Italy, you get refunded the average market price for a license and not the oem price (roughly ~20€),so depending on the windows version you get 40/80€ + if you have office, you get a few other bucks back, upto ~115€ for windows + office. And yeah, it's a bit easier today but companies still try to make it difficult on purpose, such as asking you to ship back the product, while you're not obliged to. I spent last hour reading the legal proceedings on the site I posted and lol, they're kinda all the same, you ask a refund, you get told to ship it back, you do the "messa in mora" (you legally tell the company to refund you), they tell you to ship, you say you're not obliged to, you're eventually refuned
I imagine this attitude of “even if we had laws protecting consumers they wouldn’t get used” is a big part of why Americans don’t have them. The European laws do get enforced, but of cause there is both room for and movement towards improving consumer protection.
did you ever try to use any USA federal service? you're required an id.me account.
what's that? well some anonymous group saw login.gov, realized the value of the data, and lobbied that it should be open to free capital markets to explore, not the government!
so now if you want to even talk to the irs or veteran service, you need to go to that privately owned id.me site, do a video call, scan all the documents they ask for (even ones without visible anti counterfeit mechanics like your typewritter filled ssn card).
and the best part? right after you create your account, you land on a coupon clipping page that is a facsimile of the garbage pamphlet the usps is forced to shove daily in yout physical mailbox! and among the links on that page are links to Whitepapers about how advertisers can benefit from buying user data from them because it includes gov affiliation like vetetan, taxpayer, etc and bank information!
Not sure if it’s a valid data point or not. I manage 7 people’s Apple ID accounts. This has happened a few times including twice last night but only on the people who use the @icloud.com as their primary email address. Assume that is related to password guessing attacks. Both addresses are in public email leak databases.
Can only advise that you should have recovery contacts and a recovery key set up in case something goes wrong.
> If you decide to stop using a recovery key, follow the steps above on your device and turn off recovery key. When you do, you can use account recovery to regain access to your Apple ID.
But the "steps above" only describe how to turn it on, not off.
I’d say your guess is right - the accounts typically get locked because hacking groups are running attacks on lists of email addresses.
The email addresses ending in @icloud.com are scraped from a master list and the attack is directed to apple, while the custom domains are ignored because there is work involved in figuring out where those are hosted.
iCloud lets the user generate secondary email addresses, it’s better to use that and keep the login email address secret.
I'm using my own domain for e-mail, but obviously I need another e-mail for registrar, hoster, etc. I used to use gmail for that, but recently switched to icloud as I thought gmail is too dangerous with Google banning people around. Seems Apple's no better.
I have no idea how to untangle this dependency chain. I'm using registrar in my country, so if everything goes wrong, I can just contact them with my ID and hopefully fix things up, but I'd prefer to have 100% reliable e-mail in the first place.
The only thing you need to own is your primary email address and as long as that’s on a domain you own then you can move it. That’s about the only independence there is these days. If you use @icloud.com or @gmail.com for everything then you’re screwed.
You have to depend on someone somewhere. Just make that dependency less of an issue should anything show stopping happen.
Personally I’d like to see some legislation around identity providers and service levels and account retention.
I think vbezhenar's point was simply that the recovery e-mail at a registrar should not depend on a domain managed by that same registrar. The registrar can update MX records.
Yeah keep your email provider and iCloud provider separate. For password management, use something like 1Password, and you got your main “identities” separated. In case of losing access to either of them, the impact will be relatively contained.
Many places will let you. Many more will let it forward to a new email address.
Anyone who published papers which included their academic email address will want it to persist forever. Paper publishing happens to be a special priority for many educational institutions.
As long as you can change your Mx records, it doesn’t matter who is hosting your email. If Apple had a problem, you could switch it to any other provider and request the reset email again, etc.
Scary indeed. I tried it just now, after I saw the headline, and I could log into iCloud. But then, I have 2FA activated on my account and Safari uses Sign in with Apple to log in. Or maybe whatever problem it was has been fixed by now.
The thing that scared me recently was two updates that gave me new encryption keys. At first I trusted apple and wrote down the new key. But I became suspicious after the second update and checked online. It seems like it's happening to others, so I used the recommended command-line tool to verify my new encryption key and it didn't verify. Apparently it works after disabling and enabling encryption, but
I'm just keeping it disabled for now.
This also spooked me. I’m a former security professional—there are few good reasons Apple should be doing this, and it smells of a targeted attack. If I had a zero-day exploit to steal your data, this is what it would look like.
In the other hand, if Apple suddenly found out that a good chunk of encrypted volumes weren’t actually encrypted / the key was recoverable by an offline attacker, this would also explain the facts.
But the lack of explanation from Apple is troubling.
Yeah, I’m one of the people affected by this and it has happened to me on multiple machines on multiple updates and I have no idea what’s happening. Of course the keys do not actually work like for everyone else, which is even worse from a consumer UX standpoint (if I didn’t knew better I’d just throw away the old key…)
It's on my todo list to backup and wipe that machine at some point. It's a desktop machine, not a laptop, and I don't save the recovery key to my iCloud, so I don't see how this could be a security threat. But something smells fishy.
I'm not him, but for me it was MacOS. After the update was installed and the system rebooted it presented a dialog asking if I wanted to be able to use iCloud for recovery if I forgot my Mac login password. I let it set that up.
Afterwards I wondered if it was just storing the recovery key I already had in iCloud or if it had generated a new recovery key and my saved one was invalid.
I checked my recovery key ("sudo fdesetup validaterecovery") and it was no longer valid. A bit of Googling failed to turn up a way to get a copy of the recovery key that was in iCloud, and I decided I'd rather have a recovery key I store myself in case I need to recover when I cannot get online so I switched it back.
Switching back is easy. You just turn off FileVault, then turn it back on and choose to manage the new recovery key yourself.
On the first update when it showed me the message, I trusted it and wrote down the new key and threw the original piece of paper into the trash. Then the second time it showed up, I became suspicious and did a quick google search and then ran the command tool just to confirm that the new backup key validates, but it didn't. My hunch is that it was still using the original key I had set up myself, but I couldn't confirm since I had tossed it.
Oh sorry, I would edit the comment but it's locked, I realize now it's not that clear. This is about FileVault encryption on Mac and the recovery key. I think the command was `fdesetup validaterecovery`.
Oh wow, thanks for the heads up! Turns out my recovery key was also invalid... That's something Apple really should have notified people about. These kinds of slip ups without notifying users is terrible.
To this day, I still get random "Enter your password to continue using iCloud" push notifications on my iPhone with no relevant action to trigger such a notification.
My Apple ID uses a unique password, I keep a recovery key, I don't have its login credentials saved anywhere, and it's a dev account; so I have my LLC's DUNS number attached to it. My devices are the only ones listed in my settings portal.
I have no idea why I get these notifications, lol.
I think he means, what causes apple to trigger those notifications. I don’t remember ever seeing that prompt, at least not without myself doing some action to trigger it.
I got that prompt on all my apple devices a couple days ago. I just clicked Cancel on every one. The prompts stopped coming and everything seems to still work. I don't know whether there will be some ongoing problem with my AppleID that I'm not aware of yet, but so far so good.
Only tangentially related, but I have been trying to enroll for Apple's developer program for almost 3 months now.
Understanding what the problem is is essentially impossible. Going to a physical store doesn't help, calling their customer service has them telling you to go to www.apple.com/support (???), and writing for support has them rotate you through 4 different, and decreasingly useful, representatives.
The last response I got I was told the issue had to be handled by yet a different representative and it would take an "indefinite amount of time". Which may be a nice way of them saying it's never going to happen.
It really is demoralizing when you realize there is nothing you can do really, even in cases when you have done nothing wrong.
I had similar issues, and I wish I could remember what solved it. It was something stupidly dumb like I had to log out and log back in on my phone or something. There have a couple of different edge case bugs that prevent people from signing up, and Apple customer support is useless on this.
Same here. It was something trivial with the form that I fussed around with until it worked, or maybe I didn't have iCloud enabled at all and the form didn't alert me about it.
This requires a Dun & Bradstreet DUNS ID number, which isn’t the most difficult thing in the world to obtain, but also isn’t trivial, especially if you don’t actually have any formal business documents.
Yeah, can say from recent experience this just adds _more_ steps and opportunities to ghost for a couple weeks, get another vague email, ghost for a couple weeks...took me about 3 months to get it all going.
The DUNS stuff was pretty funny. All flows related to getting an ID have a big "Are you doing Apple dev stuff?" button. It's like Apple outsourced support to them. Apple's DUNS lookup tool saw my business and the correct DUNS number, but trying to register with it got an error...eventually dissipated after a couple weeks. Same story for registering an account in the first place: it refused to register james@tld.com, where tld is a Google Workspace account, with no discernable error. Again, dissipated after 3 weeks, thankfully.
That's a funny take. I guess Apple is going to pay my sick leave, then? Buy me the hardware I need to do my "work for them"? No? Weird, guess I'm not working for them at all in any way.
No, you're right, it's actually worse than if you worked for them. Lmao. Really the worst of all worlds. You're dead in the water with out their platform, without their grace, or with all of those things, but their incompetent auth platform.
I'm not sure what your point is, but I 100% agree with you. Apple is awful, and you have to be downright masochistic to develop for their platforms. Thinking you're their employee when you develop for their platform is laughable.
You could reframe that easily by saying that without Apple making the hardware and services exist, there would be nothing to run your app on. It’s a symbiotic relationship: devs need Apple and Apple needs devs.
I've had a similar problem trying to renew my Apple developer account. Had it for over 10 years. I had an email a few weeks ago telling me it could not automatically renew (same bank details that worked fine last year). Nothing I could do on their website would make it work. I got hold of someone on their online chat who directed me to the Apple developer forums.
I gave up in the end. But I will have to sort it out before I can release the Mac version of my current project.
A friend and I spent a month or so building an iOS app we were hoping to release and monetize, but we're also entirely unable to get a developer account created. Corporate entity, DUNS number, American, extremely boring people, and just a generic "Error creating developer account" on the signup form. Apple's support was hopeless in helping.
We gave up and re-built it as a web app. The thing that convinced me was the realization: When was the last time you installed/used a non-game App on the app store that, by your assessment, has less than 1 million users? I looked down my list of installed apps and realized that indie apps are kinda dead anyway. And our web app has been pretty successful.
Just curious, with the web app, how has the experience been for your Apple users vis a vis the Androids? Are you seeing some reduction in expected footfall because of your web app decision?
Couldn't see older photos/videos in the Photo app.
Reminder for any iOS user that needs instant iCloud Photos backups (instead of manual monthly), get a Mac Mini, enable the Photos app, disable optimize for storage and keep it on to keep your memories safe.
Always check the recently deleted folder on the Mac every month since iCloud by design is a two-way sync and not a backup, unlike most clouds that are one-way upload (doesn't touch your local files).
Cold storage backup every month using the photos on the Mac should be easier as well.
That’s part of the reason I always opt for the highest possible storage on my main MacBook whenever upgrading - to set Optimize=off for Photos and iCloud. Last upgrade was the 8TB M1. And then I connect that to a local NAS Time Machine backup every few days.
While that might be Apple's "official" solution, there's a major caveat: the Photos app doesn't support storing the Photos library on a networked disk. This forces you to either fit your entire library on your Mac's internal storage or use a directly connected external disk with no network involved.
To overcome this limitation, I developed a MacOS app that creates a full backup of your Photos library. You can safely store this backup on any external storage like a NAS, network drive, internal disk, or external disk. Check it out here: https://ibeni.net
Compared to the "iCloud Photos Downloader," which scrapes data from iCloud, my app uses the official Apple Photokit APIs to back up your photos. This method is more reliable and efficient.
In the future you have people living in excile because the conputer says no. Nobody understands why. Nobody knows how to fix it. The computer says no. Nobody gives a damn.
You have no access to a bank account. No access to find a job. No access to get health care etc
I suggest people to watch "I, Daniel Blake" who talks about malfunctioning administrative systems, and nobody caring about it. I'm aware it's not related to credential issues, but I see it as the same: you have an issue that's related to an edge case, and nobody gives a damn about it, nobody takes the responsibility to look and see what's wrong about it
One frustrating thing about Apple is that if you try to get help, there isn’t really any way to do it. There isn’t any way to open a real support ticket that will be seen by an engineering team there. The store staff can only do basic things. And if you go to their forums, you will get bot-like responses telling you to follow some useless generic steps that do nothing for your specific problem, or weird replies justifying some obviously incorrect thing with an Apple product like asking why you would even want to do whatever you’re trying to do. I am not even sure who those people are that troll those Apple forums and serve as Apple apologists - like if they are employees of Apple or random users - but they are completely useless and basically deter anyone from seeking help in the first place.
It is staggering that a company this big has nonexistent support and I think given the decline in their quality over the years, this will become a bigger and bigger problem. Unfortunately for most people the alternative is Windows, where Microsoft is abusing their monopolistic market power to shove ads and their services everyhwere.
We really need new antitrust laws to break up these companies and support fair competition, and we also need regulations to reign in the biggest technology companies.
Can't you go to an Apple Store? Every time I see some customers seem to have a problem around Apple ID and such and staff helping. The opposite of Google, Microsoft etc. And there is a recovery process for Apple ID if you don't use a recovery key (and I guess if you have some government ID or such).
The way it works is you request the call to any number or you can eg. request a text chat. If you have no access to any phone anywhere then it sounds like bricked iphone (which this "lockout" doesn't do) is a relatively small problem for you
Hah. You expect that calling a store - after you get through the phone tree that gets you to the actual store, that someone at the store is going to sit down and start providing you customer support? No, they're going to tell you to make a Genius appointment, or go to the web, or their support number. They're not going to take time off of the floor, and if they do transfer you to the Genius bar, you've got 3-5 minutes, if that, to get an answer, before they too, do the same thing.
The idea that a sales person in an Apple store is taking 20 minutes or more off the floor to provide some random caller tech support when they don't have any of the tooling around it, can't see your account, very little if any access to support databases, let alone account manipulation, is laughable. Apple does a lot of things. This isn't one of them.
A couple of times in the last years I called them and they were helpful, but my issues were hardware so can't speak for Apple ID related stuff. When you schedule a call in the gui there are options for software troubles I recall though.
For a non-business user, the situation with support (or rather lack thereof) is pretty much the same across Microsoft/Google/Apple. It's amazing that this is even legal, especially when it comes to account suspension/recovery.
Not trying to excuse their behavior, but my best friend and roommate was a part time phone support in college so I learned a few tricks…
1. They get a lot of dumb questions. If you want a “talk to an engineer” bug report, you really need to prove competency to the support staff. Obviously be nice because they’re not the source of your problems they’re just trying to do their job.
2. Chat staff aren’t able to do much, phone staff have more power and insight. Chat staff can’t see your account, can’t issue pity refunds, can’t make choices outside of the generic script. You should call during US business hours if you’re trying to call the US support. Best case scenario is finding a college student.
3. They’re required to have you follow the generic published help scripts first. If you pull up the webpage and directly tell staff you followed each step - then read them the steps for proof you know them - they’ll often be able to just to the “custom help” portion.
4. If you make any reference to the TOS/Laws/etc they will mark your account as troubled and you will never get service again. You get legal canned responses only. They seem you not a valuable customer anymore. Don’t reference warranty law, definitely don’t threaten to sue, etc.
5. They can see how many apple products you have registered, how much you spend, etc and the customer service agent can decide how generous to be. If you only own a 5yo iPhone, and you’re contacting support claiming the screen magically broke in your sleep they won’t help. If you’ve upgraded every iPhone in your house every year for a decade, they might be nice when it “magically breaks on its own”.
6. They have minimal training outside of the above mentioned docs. Again, the phone staff has better training. They have common devices in front of them, and if you can get someone sympathetic on the phone, they might try to reproduce it live. That’s the golden ticket to a bug report.
>4. If you make any reference to the TOS/Laws/etc they will mark your account as troubled and you will never get service again. You get legal canned responses only. They seem you not a valuable customer anymore. Don’t reference warranty law, definitely don’t threaten to sue, etc.
This is problematic. They'll be happy to parrot out whatever TOS section you violated if you get banned under TOS, but completely stonewall you if you bring it up?
In situations like these, I draw analogy to a hypothetical legal system that does the same thing. Imagine that you are defending yourself in a court of law, and you bring up a specific legal code in your defense. The court then brickwalls you and assumes you are a bad actor, and you get thrown in jail. I know the analogy isn't perfect, but none are.
The main problem is all the kooks who will dispute an overdue payment by citing the Constitution, the Flag Code, and the Magna Carta. You can’t have support staff engaging with these people.
I assume the intent (right or wrong) is that they don’t want to deputize phone staff to deal with “legal” issues. They’re not lawyers, so if you make it a law issue, they’ll move you to a law support. But a big company won’t actually have a lawyer argue over the phone - lawyers like “courts or quiet” policies.
i also did this: created an email address that i use exclusively on apple. it actually wasn’t hard at all.
zero issues since.
> The problem stems from nefarious groups getting a hold of email addresses and running distributed dictionary attacks.
years back my email was leaked by a website that i never visited. apparently someone signed up using my email address and the website never verified the email.
in the meantime more and more people used the same email address [0] to signup everywhere (it’s not the same person, i checked).
Another tip is to run a custom domain for email that just serves to redirect mail to your real email address. It's is a handy way of keeping track of how and who has leaked your information.
For example I give custom email addresses to every service I sign up for, then I can see who they on-sold that information to, or if the email address turns up in database hack.
The only thing to be mindful about with this approach is to choose a service that gives you a fair bit of control over how to manage that incoming email. Such as being able to bounce or block specific email addresses including the use of wildcards, because I notice some hacking groups will try permutations based on the original email address.
Does account sign-in also ignore dots? If not, if sign-in is sensitive, there's a path to somewhat better safety: Start incrementally moving all daily email to variants containing added dot characters.
In the app we have released, we use an email (we don’t care which one, as long as it can receive email) as the login ID.
The main reason is to limit the data we require be stored on the server.
We only have one required PID item: the login ID. The user also enters a display name, but that can be anything, and does not need to be unique.
Since we need the email anyway, we would need to have it stored separately, so this means only one PID item is stored. We also afford Sign in with Apple, which allows the user to obfuscate their email.
Not having the information is the best way to ensure it doesn’t leak.
It's not fully arbitrary, but one can make an Apple ID from any email address or phone number (i.e. you can use a hotmail address if you like), both approaches dodge the issue mentioned since they're not obviously apple accounts.
However the issue with using something like a gmail or hotmail account is that instead of targeting Apple's servers, they just target Google and Microsoft's instead.
Got a message on her phone (settings notification). She had to change her password through the settings app.
Called Apple just to check and they said they weren’t seeing any weird activity. That they did see the password was changed, but no weird login or attempted logins.
"As a tip: Do something completely unintuitive, annoying and also you had to have started doing this years ago, and maybe apple won't lock you out. Fingers crossed!"
> The problem stems from nefarious groups getting a hold of email addresses and running distributed dictionary attacks.
I use [REDACTED] as a provider and I create an email address/account (if possible) per company/domain I interact with (e.g.: personal_github@domain.tld or amazon_personal@domain.tld). This produces two results:
1. No shared credentials across any space.
2. Any junk emails to these addresses immediately tells me who's sold it (or been hacked) and I delete the account[s] and relevant email aliases and get on with my day.
Some services, like Firefox, are starting to offer a form of "hide my email address" but this doesn't solve the problem of using <fistnamelastname@somepopularhostingservice.tld> as the same login id across a lot of services. If that was dumped somewhere, it is probably a strong bet someone has used that as their login, elsewhere.
I don't know if there's another viable solution - but this reduction of possible login ids to one unique id per site is the only way I know how to (possibly) prevent myself from being an easy dictionary attack target.
With risk of being spammy, this is probably the most relevant discussion I've seen so far on HN w.r.t my experience of being locked out from my Apple ID.
I hope legislation will force Apple to step up and be more transparent / helpful.
You don't have a requirement to have an email account to login to Windows. MS is pushing it hard, (deceptive trend in big software) but the user can still push back.
I don't know if its still true today, but last time I setup a macOS machine (2020), it didn't require, but pushed, an Apple ID. My Pixel phone I setup this February also didn't require, but pushed, a Google account. I think iOS did require an AppleID, though.
macOS doesn't require Apple ID, although you wouldn't be able to use the app store without it (but pretty much everything worth installing is available as direct downloads anyway). This is similar to the current state of affairs with Win11, except that the latter very aggressively pushes you to use your online email/password as Windows login, whereas macOS insists on having a local account even if you do also set up Apple ID.
In hindsight, yes that was a bad move (especially considering that my work laptop is still locked to my banned ID…)
As an Apple noob at the time, I assumed that if my MDM-managed device prompted me to log in with my Apple ID, that it of course would be an allowed action.
With regards to data being shared, the only thing I noticed was wifi passwords and peripherals pairing (apple keyboard).
Don’t want to sound like I’m victim blaming the author. But I can tell you exactly the issue with their account: registering with an email on a self hosted .xyz domain. Using sketchy tld’s is just asking for this kind of trouble.
Nothing sketchy about self hosting your email. Sure, that is what the big tech cartel wants you to think so you're forced to let them handle your correspondence "for your own safety". Don't believe their lies.
Issue isn’t self hosting email, it’s self hosting it at .xyz.
They had one of the cheapest registration costs. And so ended up with a high concentration of spammers compared to older established tld’s like dot com. Using the tld for legitimate purposes is really challenging due to the high number of systems that flat out blacklist it.
Making assumptions on someone's right to communicate based on their choice of email domain is discrimination, and only serves to drive people to their walled gardens.
I'm not the one making assumptions, it's thousands of independent hosts, and all big tech orgs (including specifically Apple in this case) who are making that assumption. I didn't say the assumption was right, just that it's trivial to avoid falling afoul of it by choosing to use a different TLD.
You end up fighting an uphill battle against every third party that blacklists .xyz, It’s not worth the fight just to use a cute tld and save a few dollars on registration cost.
I babysit a few corporate mailfilters and have more spam from .xyz than from all other TLDs combined. I dont block on that (most get disappeared due to 'new domain') but that's the cohort all .xyz pages are sharing.
xyz has been accomodating to scammers ever since its inception. After a decade I think we can say that it is on purpose.
This is why I don't sign in or enable 'find my' on any of my devices. Apple even has a backdoor which bypasses the encryption, allowing them to wipe a device in store.
Logging in takes control of your device out of your hands.
Not exactly what's outlined in the article, but earlier this week I encountered an issue where I couldn't log into my laptop despite entering the correct password (it kept showing 'wrong password' errors). I managed to reset the password using the recovery feature through my Apple ID, but it was still unsettling.
I can only imagine the uproar if this was happening to the users of any other company. But it's pretty muted here with a lot of consideration given for apple rather hostility. Nice to see.
547 comments
[ 1.6 ms ] story [ 361 ms ] threadsuper weird, somethings going on
Now when trying to configure a Recovery Key from my 2021 iPad Pro I’m told that I can’t do that from ‘this new device’ of mine. ¯\_(ツ)_/¯
And when I try it from my iPhone I have to wait an hour because of Stolen Device Protection. Apparently I’m not at a ‘familiar location’. I’m at home. I work from home. This phone is in this house for 99% of the time.
Not amazing is it.
And tech companies again demonstrate that they are "all about the user" by providing no clarity, acknowledgement, or empathy around the issue. It's depressing.
Perhaps this is real talent in tech: to make things seem rather than be, and to build ways to avoid service and accountability unless it leads to max profit.
I shouldn't be surprised each time this happens, but optimistically I still am.
It's a shame it's even legal to discriminate people's browsers based on shady stats and not actual abuse.
It's not like people are encouraged to keep their valuable data with these companies, only to lose the ai-fraud-detection lottery.
I've logged into years-dormant Gmail accounts, from small towns in Mexico on a $2usd Mexican SIM and google has not even batted an eye.
If you have questions about it, I will do my best to clarify.
But we pay the markup because it Just Works.
Well it doesn’t just workes anymore.
But the “quarantine” semi-visible file mode is a pretty good example IMHO.
https://stackoverflow.com/questions/68505425/cannot-interact...
Unfortunately “can’t phone home” === break.
But none the less, I liked my old password and had to change to something else.
So... anyone with just your iCloud email address can get you locked out?? That's not what I would call secure...
This does look more like a glitch on their side though...
I have had iPhones for more than a decade, and I never leveraged any "feature" of having an Apple ID on any of them.
I've never bought an app or spent money on one, and I don't use iCloud, so the Apple ID for me is literally just a gateway to downloading free apps that I can always redownload with another one.
In fact 98% of the revenue on apps come from free apps.
You can't even wipe the hard drive and reinstall macOS without access to the associated Apple ID. This is a good measure to dissuade thieves from wanting to steal Apple devices, but it is a terrible measure from the point of view of a user who has lost their ID.
I said "if your device".
**IF**
Is it difficult to understand?
If it isn't associated (with "find my" turned on) there's no issue. If it is, and you lose your apple ID, you are SOL. Turning on "find my" with an associated apple ID is the same as making Apple the only entity that can truly control and own your computer. You can no longer reinstall macOS without your apple ID if there's an issue.
Without being signed into an AppleID you cannot install free apps either. And if you install then sign out, you're also blocked from updating the free apps.
When your identity provider has total control over your life, and you signed away your right to sue for damages, this is what happens.
[1] https://www.apple.com/support/systemstatus/
As for not suing them, I suspect that wouldn’t wash if you were deprived of property due to a software issue.
what's a few thousand people per month losing all access to their data, if that is not even a blip on their revenue or revenue protections?
if you're going to buy a new iphone, you're going to buy a new iphone. it doesn't matter the slightest if you read some nerds complaining something broke one theirs that same week.
but if you're close to a monopoly, numbers go up with market size increase. you can lose ((market size Delta) - 1) until your bonus motivated employees have to care.
(I have tested this - always have an exit strategy)
I have an unhealthy habit of switching between FOSS and Apple a few times a year (don't ask) and generally it is pretty easy. The most annoying thing to me is Photos export, especially if you don't have access to a Mac. You can't download your whole library from the online environment, there's a 1000 image limit per shot.
edit: Also I have not found a good way to export from Apple Notes so I have a habit of typing into .md files from the terminal.
edit2: Gave it a search and tried Exporter. Duh. Works great!
Actually an anecdote on switching, my father in law bought an iPhone in a pawn shop. It was logged in with someone else’s iCloud account. He just used that until he dropped dead. We had no idea until I had to clean his phone out. My mother doesn’t even know what iCloud is. Literally total ignorance must be the default for everyone these days.
I’ve done the random switch thing as well as a test case. But to Microsoft. It took me a day to export all photos from Photos.app and into OneDrive and that was with a Mac (105Gb). And of course you lose all the edits you did if you export the originals.
This has always been BS. I've switched from Apple to PC to Linux back to PC to Apple back to PC and then Android etc etc. It's actually quite simple. At the moment I'm using Apple stuff, but there's nothing holding me here other than just me being here.
Suppose Walmart has a monopoly in California and Target has a monopoly in Florida. Anybody in California can shop at Target, they just have to go to Florida. "I've switched from California to Florida and then back, it's actually quite simple."
But if you're in California and you need some batteries, even if flying to Florida to buy them from Target is possible, even if you used to live in Florida and might move back there next year, even if you have the money to buy the $300 plane ticket, it's still prohibitively expensive to do it solely to avoid a $5 markup on batteries. Then the two stores don't really have to compete, and you get stuck paying the monopoly price for everything. That's what it means to be locked in.
You buy different stuff, copy your data across and sell the original stuff.
That’s not lock in. It is if there is no other stuff to buy.
You buy a different house, move your stuff across and sell the original house. How is it a crappy analogy?
The issue is that the cost of moving removes your choice from individual decisions because they all have to be made together. If you want iMessage then you have to sell your Android and get an iPhone. If you want F-Droid then you have to sell your iPhone and get an Android. What if you want both? This isn't because the free software community would be unwilling to set up a store/repository for iOS, it isn't because no Android messaging app would be willing to interoperate with iMessage, it's because you're locked in to one platform or the other at any given time and have to make all your choices together.
Someone who wants to provide an app store that charges lower fees would have to convince everyone to switch to their platform instead of only convincing people to switch to their store.
The reason they make it that way instead of being able to choose what you run on your device independent of the kind of device is in order to lock you in.
They may not even own a laptop with sufficient storage to download all their photos to. If all they have is one, maybe two, phones with limited storage they're totally fucked. Just like Google & Apple designed it.
And it's not like these services make it easy to bulk download/upload your photos, either.
Example: I can live in this nice comfy condo for a sky high fee (Apple) or I can live in a rickety old shed I have to keep fixing for free so I don’t have to pay the ground rent (Linux).
I’d rather live in the condo even if the lease runs out one day.
It's not: "I’d rather live in the condo even if the lease runs out one day"
It's more like: "I’d rather live in the condo even if the realtor arbitrarily locks me out, even though I did pay for it"
The key point of their analogy is that buying another condo isn't a good solution to someone locking you out of the one you paid for, just like buying a new phone isn't a good solution to Apple locking you out of your phone that you paid for.
Your complaint with their analogy seems to boil down to "they used an analogy", without actually addressing the point above. Try to focus on the point instead.
My dad is often defeated on how to set up or use basic features of his smartphone, let alone on how to migrate stuff from one ecosystem to another, which let's be real, is purposely designed to be as friction inducing as possible.
The reality is that if you go to any family BBQ and start going on about the importance of self-hosting, I - someone that’s been working with computers my whole life - am going to roll my eyes and not be all that interested in the conversation, let alone anyone else there (chances are they don’t want to talk about computers at all).
The reality is that these open-source / self-hosted solutions are, the vast majority of the time, harder to use and maintain. There are few things that sound less appealing to me than dealing with the realities of helping my family and friends with using any of that stuff.
This is all just some nerd’s out of touch pipe dream.
Yes, though only because it's a lot of trouble to set up today.
If it were completely commoditizated -- imagine one more button when setting up a new phone ("Choose where your data resides: Apple, Google, Facebook, Self hosted") and it was completely transparent then it would be used much more, especially if that's complemented by one of the nerds setting up e.g. a neighborhood sync server and everybody around knowing it and using it.
So yes, you are not wrong but the situation can change dramatically if ergonomics are improved. Which sadly most of the nerds never work on.
As for waiting, yeah, sad story, but most of us don't want to be on the computer for 16-18h a day anymore. I implore any of the more privileged programmers -- people with job security, $200K+ annual salary, a lot of social safety nets -- to open their eyes and stop fucking around with the one millionth LISP interpreter and just start making non-corporate-controlled tech already.
In other words, if you built one nice Golang / Rust program and only update the server once every 3 months, you can go quite far without touching it too much. Likely 3-5 years.
I will agree that nerds work far too much on pointless pursuits.
I've had great luck convincing even church ladies in their 60s to use both just by explaining that "end-to-end encryption" means that only the sender and recipient can read the messages, not big tech companies and advertisers.
For most people, losing their iCloud or Google accounts would be devastating.
I always joke that I'd rather lose all my documents and credit cards than lose my main e-mail account. And only tech savvy folks understand that it is not, in fact, a joke.
I don't use Safari but if I did any of its bookmarks/history are easy to import into other browsers.
I’d say email providers are an even bigger problem though. Good luck getting your accounts back if you lose access to your own email account. I don’t know that iCloud mail is particularly popular, but the risk really applies to any provider.
The issue is rather, that most people rely on these convenient services 100% and dont (want to) think about what happens in a bad case scenario.
Like others say, it's fairly easy to escape, just keep backups outside iCloud. Also, it's probably best to use a password manager that is not iCloud Keychain.
I’m not terribly partisan when it comes to platforms, I own and actively use an M1 Mac Mini, Dell Precision running Windows, and a Kubuntu box. I understand the assertion that software ecosystems tend to be a featured player in tactics aimed to fix users on a particular device or platform, and I think there’s plenty of evidence that this is broadly the case. But I wouldn’t use iCloud as a particularly good example of it, Apple’s clearly not banking on their cloud storage to drive its revenue.
Unfortunately it's in Italian, basically if you don't accept windows (and office) tos you can be refunded, almost nobody knows this except some Linux users. However, if you follow the steps (such as not accepting the tos) you're basically guaranteed a refund or to win the legal dispute
Rejected the TOC. Made a meticulous image report that showed careful unboxing and setup.
There was a line in the TOC that (from very vague memory) disallowed using the OS for a.o. nuclear power mgmt. I did work in energy back then (but mostly webdev), so I could not rule this useage out. Send it along to Redmond and got a prompt reply from som e salesman for some kind of "industrial licence" for insane amounts. A few back and forths later, I got a measly €20 Euro's back. They put the rest down to admin fees, and OEM discounts.
Anyway. It ran SUSE and (k)ubuntu perfectly.
I guess it's much easier nowadays. But I buy my laptops preinstalled nowadays. Open the lid, answer five or six questions, restore my backups (/etc, .files, ~), reinstall the packages from packages.txt, reboot and continue working.
what's that? well some anonymous group saw login.gov, realized the value of the data, and lobbied that it should be open to free capital markets to explore, not the government!
so now if you want to even talk to the irs or veteran service, you need to go to that privately owned id.me site, do a video call, scan all the documents they ask for (even ones without visible anti counterfeit mechanics like your typewritter filled ssn card).
and the best part? right after you create your account, you land on a coupon clipping page that is a facsimile of the garbage pamphlet the usps is forced to shove daily in yout physical mailbox! and among the links on that page are links to Whitepapers about how advertisers can benefit from buying user data from them because it includes gov affiliation like vetetan, taxpayer, etc and bank information!
My experience status pages (with Azure) is that they are a PR/legal mouthpiece. They only change once something becomes newsworthy.
https://en.wikipedia.org/wiki/Goodhart%27s_law
Goodhart's law is an adage often stated as, "When a measure becomes a target, it ceases to be a good measure".
Error: 'normal' undefined.
;)
To set up your iPhone, you have to log into your Apple account. Macs don't care as much.
If you use "Log In With Apple" then you'll lose that. And if you've decided to use the terrible Passkeys idea, you're locked out of that too.
(1) AppStore This is especially relevant on iPhones and iPads where this is the only way to practically access software and updates.
(2) iCloud Data sync and backup. Some iPhone/iPad software might insist on this to work.
(3) Subscriptions, purchases through Apple Music, software, movies, TV shows, Fitness, etc.
(4) ID for other services Using ApplelD to log into other services. Some don't allow for any other way of signing in.
Can only advise that you should have recovery contacts and a recovery key set up in case something goes wrong.
Seems like a dangerous advice for a regular person who can just go to Apple and get stuff back?
Regular person can’t even remember their email address so a good point though.
I ask because Apple's docs helpfully say
> If you decide to stop using a recovery key, follow the steps above on your device and turn off recovery key. When you do, you can use account recovery to regain access to your Apple ID.
But the "steps above" only describe how to turn it on, not off.
Edit: thank you.
The email addresses ending in @icloud.com are scraped from a master list and the attack is directed to apple, while the custom domains are ignored because there is work involved in figuring out where those are hosted.
iCloud lets the user generate secondary email addresses, it’s better to use that and keep the login email address secret.
I have no idea how to untangle this dependency chain. I'm using registrar in my country, so if everything goes wrong, I can just contact them with my ID and hopefully fix things up, but I'd prefer to have 100% reliable e-mail in the first place.
You have to depend on someone somewhere. Just make that dependency less of an issue should anything show stopping happen.
Personally I’d like to see some legislation around identity providers and service levels and account retention.
And my email is on Fastmail under a custom domain. They have good support so far
Anyone who published papers which included their academic email address will want it to persist forever. Paper publishing happens to be a special priority for many educational institutions.
For the majority of users.
In the other hand, if Apple suddenly found out that a good chunk of encrypted volumes weren’t actually encrypted / the key was recoverable by an offline attacker, this would also explain the facts.
But the lack of explanation from Apple is troubling.
On iOS or macOS? Was a consent dialog presented before the update was installed?
Afterwards I wondered if it was just storing the recovery key I already had in iCloud or if it had generated a new recovery key and my saved one was invalid.
I checked my recovery key ("sudo fdesetup validaterecovery") and it was no longer valid. A bit of Googling failed to turn up a way to get a copy of the recovery key that was in iCloud, and I decided I'd rather have a recovery key I store myself in case I need to recover when I cannot get online so I switched it back.
Switching back is easy. You just turn off FileVault, then turn it back on and choose to manage the new recovery key yourself.
https://news.ycombinator.com/item?id=38043574
And what command line tool are you referencing?
My Apple ID uses a unique password, I keep a recovery key, I don't have its login credentials saved anywhere, and it's a dev account; so I have my LLC's DUNS number attached to it. My devices are the only ones listed in my settings portal.
I have no idea why I get these notifications, lol.
Perhaps so that someone who found your iphone unlocked can't just keep using it and your iCloud in perpetuity?
Yeah, that's what I tried to guess too. Like, maybe those are sent periodically?
Could be there's some heuristics like "logged in from a different city" or such, too.
Or a device on your network is or was compromised and used as a channel to attack others on the internet.
Or your ISP has given you a public address where the last owner was abusing it.. or perhaps the whole ISP block has been added to a shitlist.
Understanding what the problem is is essentially impossible. Going to a physical store doesn't help, calling their customer service has them telling you to go to www.apple.com/support (???), and writing for support has them rotate you through 4 different, and decreasingly useful, representatives.
The last response I got I was told the issue had to be handled by yet a different representative and it would take an "indefinite amount of time". Which may be a nice way of them saying it's never going to happen.
It really is demoralizing when you realize there is nothing you can do really, even in cases when you have done nothing wrong.
Not impressed to say the least.
The DUNS stuff was pretty funny. All flows related to getting an ID have a big "Are you doing Apple dev stuff?" button. It's like Apple outsourced support to them. Apple's DUNS lookup tool saw my business and the correct DUNS number, but trying to register with it got an error...eventually dissipated after a couple weeks. Same story for registering an account in the first place: it refused to register james@tld.com, where tld is a Google Workspace account, with no discernable error. Again, dissipated after 3 weeks, thankfully.
I gave up in the end. But I will have to sort it out before I can release the Mac version of my current project.
We gave up and re-built it as a web app. The thing that convinced me was the realization: When was the last time you installed/used a non-game App on the app store that, by your assessment, has less than 1 million users? I looked down my list of installed apps and realized that indie apps are kinda dead anyway. And our web app has been pretty successful.
Reminder for any iOS user that needs instant iCloud Photos backups (instead of manual monthly), get a Mac Mini, enable the Photos app, disable optimize for storage and keep it on to keep your memories safe. Always check the recently deleted folder on the Mac every month since iCloud by design is a two-way sync and not a backup, unlike most clouds that are one-way upload (doesn't touch your local files).
Cold storage backup every month using the photos on the Mac should be easier as well.
To overcome this limitation, I developed a MacOS app that creates a full backup of your Photos library. You can safely store this backup on any external storage like a NAS, network drive, internal disk, or external disk. Check it out here: https://ibeni.net
Compared to the "iCloud Photos Downloader," which scrapes data from iCloud, my app uses the official Apple Photokit APIs to back up your photos. This method is more reliable and efficient.
Ultimate irony.
It is staggering that a company this big has nonexistent support and I think given the decline in their quality over the years, this will become a bigger and bigger problem. Unfortunately for most people the alternative is Windows, where Microsoft is abusing their monopolistic market power to shove ads and their services everyhwere.
We really need new antitrust laws to break up these companies and support fair competition, and we also need regulations to reign in the biggest technology companies.
I really doubt that calls are disabled since it's "just" appleids, but the irony is still amusing. Landlines still have some uses after all!
The idea that a sales person in an Apple store is taking 20 minutes or more off the floor to provide some random caller tech support when they don't have any of the tooling around it, can't see your account, very little if any access to support databases, let alone account manipulation, is laughable. Apple does a lot of things. This isn't one of them.
1. They get a lot of dumb questions. If you want a “talk to an engineer” bug report, you really need to prove competency to the support staff. Obviously be nice because they’re not the source of your problems they’re just trying to do their job.
2. Chat staff aren’t able to do much, phone staff have more power and insight. Chat staff can’t see your account, can’t issue pity refunds, can’t make choices outside of the generic script. You should call during US business hours if you’re trying to call the US support. Best case scenario is finding a college student.
3. They’re required to have you follow the generic published help scripts first. If you pull up the webpage and directly tell staff you followed each step - then read them the steps for proof you know them - they’ll often be able to just to the “custom help” portion.
4. If you make any reference to the TOS/Laws/etc they will mark your account as troubled and you will never get service again. You get legal canned responses only. They seem you not a valuable customer anymore. Don’t reference warranty law, definitely don’t threaten to sue, etc.
5. They can see how many apple products you have registered, how much you spend, etc and the customer service agent can decide how generous to be. If you only own a 5yo iPhone, and you’re contacting support claiming the screen magically broke in your sleep they won’t help. If you’ve upgraded every iPhone in your house every year for a decade, they might be nice when it “magically breaks on its own”.
6. They have minimal training outside of the above mentioned docs. Again, the phone staff has better training. They have common devices in front of them, and if you can get someone sympathetic on the phone, they might try to reproduce it live. That’s the golden ticket to a bug report.
This is problematic. They'll be happy to parrot out whatever TOS section you violated if you get banned under TOS, but completely stonewall you if you bring it up?
In situations like these, I draw analogy to a hypothetical legal system that does the same thing. Imagine that you are defending yourself in a court of law, and you bring up a specific legal code in your defense. The court then brickwalls you and assumes you are a bad actor, and you get thrown in jail. I know the analogy isn't perfect, but none are.
The problem stems from nefarious groups getting a hold of email addresses and running distributed dictionary attacks.
Apple’s response is to prevent all logins (including valid ones) from accounts that are under attack.
Unlocking the account involves calling Apple, they’re not going to tell you why the account was locked.
zero issues since.
> The problem stems from nefarious groups getting a hold of email addresses and running distributed dictionary attacks.
years back my email was leaked by a website that i never visited. apparently someone signed up using my email address and the website never verified the email.
in the meantime more and more people used the same email address [0] to signup everywhere (it’s not the same person, i checked).
[0] gmail ignores dots in usernames: https://support.google.com/mail/answer/7436150?hl=en#:~:text....
at this point my emails should be random hashes@random hash domain
For example I give custom email addresses to every service I sign up for, then I can see who they on-sold that information to, or if the email address turns up in database hack.
The only thing to be mindful about with this approach is to choose a service that gives you a fair bit of control over how to manage that incoming email. Such as being able to bounce or block specific email addresses including the use of wildcards, because I notice some hacking groups will try permutations based on the original email address.
Does account sign-in also ignore dots? If not, if sign-in is sensitive, there's a path to somewhat better safety: Start incrementally moving all daily email to variants containing added dot characters.
In the app we have released, we use an email (we don’t care which one, as long as it can receive email) as the login ID.
The main reason is to limit the data we require be stored on the server.
We only have one required PID item: the login ID. The user also enters a display name, but that can be anything, and does not need to be unique.
Since we need the email anyway, we would need to have it stored separately, so this means only one PID item is stored. We also afford Sign in with Apple, which allows the user to obfuscate their email.
Not having the information is the best way to ensure it doesn’t leak.
That's a requirement of the app, and why we need to store emails.
However the issue with using something like a gmail or hotmail account is that instead of targeting Apple's servers, they just target Google and Microsoft's instead.
Citation requested.
Got a message on her phone (settings notification). She had to change her password through the settings app.
Called Apple just to check and they said they weren’t seeing any weird activity. That they did see the password was changed, but no weird login or attempted logins.
So, in my sample of 1, that wasn’t the case.
Yet did not give a cause for the lockout?
Are Google accounts similarly vulnerable to such attacks?
I use [REDACTED] as a provider and I create an email address/account (if possible) per company/domain I interact with (e.g.: personal_github@domain.tld or amazon_personal@domain.tld). This produces two results:
1. No shared credentials across any space.
2. Any junk emails to these addresses immediately tells me who's sold it (or been hacked) and I delete the account[s] and relevant email aliases and get on with my day.
Some services, like Firefox, are starting to offer a form of "hide my email address" but this doesn't solve the problem of using <fistnamelastname@somepopularhostingservice.tld> as the same login id across a lot of services. If that was dumped somewhere, it is probably a strong bet someone has used that as their login, elsewhere.
I don't know if there's another viable solution - but this reduction of possible login ids to one unique id per site is the only way I know how to (possibly) prevent myself from being an easy dictionary attack target.
Edit: formatting
I hope legislation will force Apple to step up and be more transparent / helpful.
https://skogsbrus.xyz/dont-put-all-your-apples-in-one-basket...
> got my Macbook Pro from work and signed in to my Apple ID on it.
Wouldn't this result in unintentional data sharing from the work device to your personal devices? (and vice versa)
As an Apple noob at the time, I assumed that if my MDM-managed device prompted me to log in with my Apple ID, that it of course would be an allowed action.
With regards to data being shared, the only thing I noticed was wifi passwords and peripherals pairing (apple keyboard).
Never mix work and personal. It isn't worth it.
https://news.ycombinator.com/item?id=28554400
They had one of the cheapest registration costs. And so ended up with a high concentration of spammers compared to older established tld’s like dot com. Using the tld for legitimate purposes is really challenging due to the high number of systems that flat out blacklist it.
xyz has been accomodating to scammers ever since its inception. After a decade I think we can say that it is on purpose.
Logging in takes control of your device out of your hands.
there are caveats to passkeys thou.