Last week, Apple released iOS 17.3 with much anticipated updates such as Collaborative Apple Music Playlists and AirPlay hotel support. One of the biggest highlights was a new Stolen Device Protection; however, it's not as secure as we initially thought. Stolen Device Protection in iOS 17.3 is meant to add an extra layer of security to prevent bad actors who have your passcode from completing critical operations such as changing your Apple ID password, which would prevent you from being able to track your iPhone or mark it as stolen. Also: This new iPhone app fuses AI with web search, saving you time and energy With the feature enabled, performing critical actions on your phone when your phone is away from familiar locations, such as work or home, requires additional security requirements, including biometric authentication, such as Face ID or Touch ID, or a Security Delay, which requires you to verify your biometrics a second time an hour later. In theory, this is a foolproof solution since being in a familiar location -- such as your home -- typically means the device is in your possession. However, who determines if a location is familiar and that it's worth putting your phone's security guards down? As spotted by 9to5Mac, Apple uses how often you visit a place to determine whether it is a significant -- in other words, "familiar" -- location. This can become a security issue when you frequent less secure places such as your favorite grocery store, bar, or cafe, and Apple,...
Apple's new Stolen Device Protection has a big vulnerability. Here's how to fix it
Affected Software
Frequently Asked Questions
Which devices and software versions include Stolen Device Protection?
The feature was released in iOS 17.3. The article identifies Apple iOS and iPadOS as the affected software.
What attacks is Stolen Device Protection intended to prevent?
It is intended to stop someone who knows an iPhone passcode from performing critical operations, including changing the Apple ID password. Such a change could prevent the owner from tracking the iPhone or marking it as stolen.
What additional checks apply when a device is away from familiar locations?
Critical actions can require biometric authentication through Face ID or Touch ID, or a Security Delay. The delay requires biometric verification again one hour later.
What limitation does the article identify in the protection model?
The additional protections depend on whether the phone is away from a familiar location, such as home or work. The article raises the question of how a location is determined to be familiar, which undermines the assumption that a familiar location means the device is in its owner’s possession.