The critical importance of protecting your iPhone passcode

We all know that an iPhone passcode is supposed to remain private.  However, Joanna Stern of the Wall Street Journal recently published an alarming story, and accompanying video, that highlights just how critical this is.  In this post, I want to describe the problem, then discuss some steps you can take to protect yourself.

The scam

Stern’s investigation revealed that access to a short string of numbers—your iPhone passcode—can unravel your entire digital life.  Criminals working in teams, around the country, have come up with ways to cause a victim to unlock their iPhone by typing in their passcodes.  Perhaps someone talks to the victim in a bar and volunteers to take a picture with the victim’s iPhone, pressing the buttons on the side of the iPhone to put the iPhone in the mode where it must be unlocked with a passcode instead of FaceID or TouchID. Next, a different criminal watching over a shoulder or taking a video recording from across the room watches the victim unlock the iPhone with a passcode, thereby learning the passcode.  Finally, the criminals grab the victim’s iPhone to steal it.

The consequence of having both your iPhone and your passcode stolen are more dire than you probably realized.  First, a criminal with your passcode can not only change your passcode (blocking you from using it even if you recover the iPhone) but, far worse, can change your Apple ID password, even without knowing your current Apple ID password.  With the new Apple ID password, the criminal can turn off Find My iPhone.

Think about that.  The first thing that you would probably think to do if your iPhone was lost—track it with Find My iPhone—becomes impossible almost immediately after your iPhone is stolen.

The criminals might then use your iPhone and passcode to pay for items (using the credit cards in the wallet on your iPhone) or send money to themselves (via Apple Cash).  Even worse, if you use Apple’s built-in password management tool to store passwords for things like your bank, the criminals might access your bank account online and transfer money from you to them.  Joanna Stern learned of many people who had $10,000 stolen from their accounts.

A criminal with your Apple ID password can also easily delete a lot of your information—perhaps most notably, all of your pictures.  And with your Apple ID password changed, this can result in you losing access to all of your photos on all of your devices—computers, iPads, etc.—as one of the victims interviewed by Stern described.

These are the highlights from this story, but I encourage you to read the story for more details.  (If you hit a paywall, remember that you can read the Wall Street Journal in the Apple News app if you subscribe to Apple News+)  And whether or not you read the story, I recommend that you watch the excellent video that Stern created, which I’ll embed right here:

Steps you can take to protect yourself

Stern discusses some possible solutions in her video.  I have similar advice.

First, you need to keep your passcode private.  We all already know this, but perhaps knowledge of this specific scam will encourage us all to be more serious about it.  Anytime that you type your passcode in public, shield the screen in a way that someone looking ever your shoulder cannot see what you are typing.  The scam described by Stern in her article may not work on all iPhones, and you may have other protections if your iPhone is subject to Mobile Device Management, but play it safe.  Keep your passcode private, at all times.

Second, consider using a more complex passcode.  The default iPhone passcode is six digits.  It is possible to change that to only four digits, but you should not do so.  In fact, consider doing just the opposite: more than six digits, or a combination of numbers and letters.  Apple explains on this page how to use a more complex passcode.  That's what I do, and I got used to it very quickly.

Third, be very careful about giving your iPhone to someone else—especially someone who you don’t know.  If you do so anyway, and if they hand your iPhone back to you and suddenly you need to enter your passcode, that should be a red flag.  It doesn’t necessarily mean that they are a criminal; it could just be that your iPhone tried to unlock with their fingerprint or their face and put itself in the mode where a passcode is required, but be safe and treat this as a sign to proceed cautiously.  

Fourth, you should strongly consider using a third-party password manager instead of Apple’s built-in password manager—not only for passwords, but for other information and photos.  And in light of the recent troubles at LastPass, the only one that I recommend right now is 1Password.  Stern’s story notes that criminals were able to access passwords using Apple’s built-in password manager and could access pictures in the Photos app of items like social security cards, passports, driver’s licenses, and other confidential documents.  A password manager can store not just passwords but also confidential information, confidential photos, confidential documents, etc.  Even if a criminal has physical access to your iPhone and the passcode, the criminal still cannot access items in your password manager because they are locked behind a different password.

Fifth, use two-factor authentication (“2FA” or “MFA” for multi-factor authentication) when you can, and avoid using a text message as the second form of authentication if you have a choice.  When there is a choice, it is much better to use another app like 1Password to store the one-time passcode (one that changes every 30 seconds).  I’ll be honest: this is a little complicated to set up, especially the first time you do so, but it gets easier every time.  And if you have read this far into this post, I suspect that you appreciate the value of security, so the trouble is likely worth it for you.  Unfortunately, some banks and other institutions don’t give you a 2FA option other than text messages, which of course offers you zero extra protection when the criminal has access to your iPhone.

It would not surprise me if Stern’s story and similar news of these scams prompts Apple to make some changes to the iPhone that make some of the steps being used by criminals either impossible or more difficult.  But then again, Apple may not do so because this scam has still only impacted a very small percentage of iPhone owners, and Apple knows that almost every step taken to increase security can also make life more difficult for innocent iPhone owners in some other way.  Plus, even if Apple makes changes, clever criminals may find new workarounds.  Fortunately, the steps that I recommend above can help to protect you regardless of whether Apple, or the criminals, change their approaches.

       

Read More

Podcast episode 88: Tracking Medications and Shaking Your Moose Face

After taking a week off, Brett Burney and I are back this week to discuss a large variety of interesting topics.  We start by taking the long view towards technology, then shift completely to discuss some of the interesting new Emoji coming soon to your iPhone, including a Moose and a Shaking Face.  We discuss lots of different Siri commands that you probably did not know about.  We discuss Uber live notifications, medication notifications, AirPlay alternatives, creative charging, and then finish up by wishing that we had kept a shrink-wrapped iPhone from 2007.

In our In the Know segment, Brett explains how to temporarily mute notifications from the Lock Screen and why you might want to do that.  I discuss the fantastic Photo Shuffle Lock Screen and explain what to do when a picture comes up that you really like, or you really hate.

Click here to listen to the audio podcast, or just use your podcast player of choice.  You can also watch the episode on YouTube:

 

       

Read More

In the News

This week, longtime tech journalist Harry McCracken showed on Twitter the remarkable difference between a picture taken by a Palm Treo in 2005 and a picture taken by an Apple iPhone 14 in 2023.  John Gruber links to that post and correctly remarks: "One of tech’s truisms that has no exceptions: We overestimate how much progress we can make in a year, and underestimate how much we can make in a decade."  Ten years ago, the topics being discussed  here included Siri Eyes Free, which was technology that made it easier to get information from your iPhone while you are driving (in the days before CarPlay), speculation on how popular a version of Microsoft Office for the iPad might be if Microsoft ever released it, and my first time using an app called 1Password, now one of the most essential apps on my iPhone.  And now, the news of note from the past week:

• When iOS 16.4 is released, we will get new Emoji on the iPhone.  Keith Broni of Emojipedia previews some of the new Emoji including Shaking Face, Donkey, Moose, Wing, Folding Hand Fan, Flute, and Khanda (the symbol of Sikhi, an Indian religion and philosophy).
• The Uber app got a major update this week.  As Filipe Espósito of 9to5Mac explains, the home screen of the app has a new, clean look, and Live Activities support is expanded.
• Tim Hardwick of MacRumors reports on the legal battles between Apple and medical device company AliveCor about patents that allegedly relate to the ECG feature of most Apple watches.  Because of a December ruling from the U.S. International Trade Commission, there is a risk of a ban on Apple Watch imports.  Although I'm a lawyer, this is way outside of my area of expertise, so I don't know enough to predict what might happen here, but it certainly could be interesting.
• D. Griffin Jones of Cult of Mac has a good overview of the track medications feature of the iPhone's Health app. 
• Brent Dirks of App Advice recommends Apple TV apps that can help you to redesign a room in your home.
• Nick deCourville of The Mac Observer identifies numerous ways to mirror an iPhone to a TV if you don't have an Apple TV.
• If someone  you know is a fan of the new show Wednesday—a spin-off of The Addams Family—then they might be interested in this Apple Watch stand featured by David Snow of Cult of Mac.  Better yet, you can make yourself using a 3D printer.
• Speaking of cute chargers for Apple products, Ed Hardy of Cult of Mac shows off a tiny version of the original Mac that charges three USB-C ports.
• An original iPhone from 2007, never opened from its box, was just sold at an auction for $63,356.40, as reported by Michael Simon of Macworld.  I presume the main reason that the owner auctioned it off is that the original iPhone used AT&T's Edge network, which AT&T shut down on January 1, 2017.
• And finally, Apple TV+ released a trailer for a new show called Extrapolations, which comes out next month. Apple says that the series has "Eight interwoven stories about love, work, faith and family from across the globe" that take place in the near future when climate changed has caused huge problems.  What jumped out at me is the cast: Meryl Streep, Sienna Miller, Kit Harington, Daveed Diggs, Edward Norton, Diane Lane, Tahar Rahim, Yara Shahidi, Matthew Rhys, Gemma Chan, David Schwimmer, Adarsh Gourav, Keri Russell, Marion Cotillard, Forest Whitaker, Eiza González, Murray Bartlett, Indira Varma, Tobey Maguire, MaameYaa Boafo, Hari Nef, Heather Graham, Michael Gandolfini, Cherry Jones, Gaz Choudhry, Ben Harper, Judd Hirsch, and Neska Rose. That is an incredibly impressive cast. Wow. Here is the trailer:

       

Read More

Review: CovoBox: hide your electronics behind real books

One of the unfortunate consequences of our increasingly digital lives is a need for more plugs, cords, routers, hubs, etc.  And as they accumulate, they become more unsightly.  I have a set of shelves in my living room, and on one shelf I have a lot of electronics: an eero Pro to provide great Wi-Fi in my living room, the cords for a HomePod mini, a hub for my Lutron Caséta system (connected to the extra Ethernet port on that eero Pro), a cord for a diffuser, etc.  It makes sense to have all of those electronics on a single shelf because I have a wall outlet there, but it makes the shelf ugly to look at.  Fortunately, I recently found a solution: CovoBox.  CovoBox is made from real books, but they are cut out at the back to create a hidden compartment for your cords.  It is a wonderful solution that looks great, and as a bonus, I prevented some unwanted books from going into a landfill.

Before and After

Rather than describe CovoBox, this is one time when a picture is worth a thousand words.  Here is what my shelf looked like before the CovoBox:

Here is what it looks like with the CovoBox:

Ordering a CovoBox

Each CovoBox is custom-built for you.  There is the regular CovoBox (which I got) which has a height of up to 9.5". There is also the Tall CovoBox which has a height of up to 11.25" (if you get the large) or up to 12" (if you get the oversize) or 13" (with the MAXXI).  Once you choose the height that you want, you choose the length, in two-inch increments, with different prices for each increment.  Then you choose the color.

For example, I have the regular CovoBox, which has a starting price on Amazon of $29.  If I get a length of only 3" there is no extra charge.  But 5" adds a $20 charge, 7" adds a $40 charge, etc.  The version that I got is 17" so that added an extra $140 to the $29.

If you select the Multicolor option, which is what I got, you will a variety of books without paying extra for color.  But if you want a color theme for the books, you need to pay more.  Black adds an extra $49.  Blue adds $99.  Orange and yellow add $139.  Or select a custom color for $159.

The version that I purchased is open at the top.

However, if you are using a lower shelf, or placing the CovoBox on a table, you may want to order the CovoBox² or the Tall CovoBox².  With this version, you can see the tops of the books.  That adds to the price; not only is the starting price different ($57 for CovoBox) but there is a larger price increase for each increase in length (such as $40 for each two inches of length for the CovoBox).  For example, for a 17" version that I got, instead of paying $169 for my CovoBox, you would pay $337 for the CovoBox².   But the result seems nice if that is what you are looking for:

When you look at my CovoBox from the back, the cuts on the books are obvious.  But from the front, on my shelf, it is virtually impossible to notice that the books are cut:

Yet another option is the Horizontal CovoBox, which has books laying on their side:

If you want even more options, like a tall version that you might place on the floor next to a coach, check out the CovoGoods store on Etsy.  The Etsy shop even has a few discounted, pre-made selections—perhaps items ordered by people who later changed their minds after they were made.

Conclusion

The CovoBox is not an inexpensive product, especially if you select a larger size.  But because it is made using real books, it looks great, just like books on a shelf.  On my shelf, it is virtually impossible to tell that it is hiding a bunch of ugly electronics and cords.  And as a bonus, it is nice to know that some unwanted books are getting a new life.

If you are looking for a good way to hide ugly electronics, cords, routers, plugs, hubs, etc. on a shelf or some other location where it would look better to see books, CovoBox is a great solution.

Click here to get CovoBox on Amazon (prices vary)

       

Read More

Podcast episode 87: Reliable Report Cards and Mysty Watercolor Memories

Many of the topics in the latest episode of the In the News podcast address putting new things in historical perspective.  Brett and I discuss the new Apple website and how much it has changed over the decades.  We talk about the new Apple financial report and explain how the iPad can be doing better than ever right now at the same time that it is disappointing many folks who have been following the iPad for a long time.  We talk about the new version of Myst on the iPad and how far it has come from the version many of us played on Apple computers in the 1990s.  And we talk about how the newest HomePod compares to the original version released years ago.  On top of all of that, we talk about CarPlay apps, the Camo app, and HomeKit smartplugs.  It is a jam-packed episode, but you can take your time with it because we won’t be able to record an episode next week.

In our In the Know segment, Brett explains how you can fix an Apple Watch if the Digital Crown doesn't turn as well as it should.  I explain how you can fix an iPhone if it doesn't want to wake up—spoiler alert: push volume up, push volume down, then hold down the power key—and we explain why you should do your best to remember that combination.

Click here to listen to the audio podcast, or just use your podcast player of choice.  You can also watch the episode on YouTube:

       

Read More

In the News

This week, Apple debuted a new look for the Apple website. There are still tabs at the top devoted to topics like iPhone, iPad, and Mac, but now you can hover your computer mouse over each tab, or tap once on a tab on an iPad, to see a large list of pages associated with that tab.  There is a somewhat similar layout for the iPhone, but it is based on a menu button at the top right.  It's a nice design change that makes it easier to get to the specific part of the Apple website that you want.  Additionally, many of the pages on the website have been spruced up with graphics that animate as you scroll down the website.  For an interesting look at past Apple website home pages, check out this page from the Version Museum, which covers 1994 to 2020.  And now, the news of note from the past week:

• I added a new paragraph to my recent review of Camo, the app that lets you use your iPhone as a webcam, to note that I initially had some difficulties using Camo when my iPhone was connected to my Windows computer using a cord.  I solved that problem by updating a driver, and it helped Camo to work much better.  I'll discuss this issue in more detail when we record today's episode of the In the News podcast.
• What do people who pay attention think about Apple's performance in 2022?  Jason Snell of Six Colors released the latest version of his annual Report Card to answer that question.  Folks were happy with wearable technology like the Apple Watch and AirPods, but more grumpy about HomeKit and developer relations.
• Benjamin Mayo of 9to5Mac compares the original HomePod to the new model.
• If you want to use HomePods in a stereo pair, they need to be of the same generation.  Unless you use a workaround, described by Chance Miller of 9to5Mac in this post, which involves using the Airfoil app on a Mac.  If you own a single original generation HomePod and a single new HomePod, it might be something worth trying to see what you think.
• Anthony of CarPlay Life recommends apps that car owners should install.
• Nathaniel Pangaro of AppleInsider reviews the Meross Smart Plug Mini, a simple HomeKit-compatible smart plug.
• Amazon is selling the second-generation Apple Pencil for only $89.99, a substantial $40 discount.
• Aidan Pollard of Insider tells the story of a couple whose luggage was lost by Air Canada after their honeymoon. Thanks to an AirTag, the couple was able to track the bag for months, and they finally recovered it after learning that their ID tag had become disconnected from the luggage and then the airline donated the luggage to a charity.  AirCanada says that the owners should have put identifying information inside of the luggage to account for the possibility of the tag outside of the luggage becoming detached, but I suspect that most people don't do that.
• I don't play a lot of video games, but I have fond memories of loving the game Myst when it came out on the Mac in 1993; the graphics were incredible (considering the technology of the day) and the puzzles were fun to solve.  Juli Clover of MacRumors reports that a newly remastered version of Myst is now available for the iPad and iPhone called Myst Mobile.  It is free to play, although you eventually need to pay $9.99 to unlock the entire game.  For devices with an M1 or M2 chip, the games defaults to "Epic" settings to allow the graphics to look as good as possible.
• And finally, Apple released this video three weeks ago to advertise the new HomePod, but I hadn't seen it until last night, and it does a good job of promoting the key features.

       

Read More