Security Oversight

Question

Level 1

4 points

Security Oversight

If someone knows the passcode you use to unlock your iPhone they instantly have access to your iCloud, Apple ID and can change your password etc. This is because Apple (for some stupid reason) has a security prompt that says "Enter iPhone passcode" which allows the passcode used to unlock the phone as an option to reset your Apple ID password.

Why is it designed like this? This renders Screen Time and all features within it completely redundant and practically useless because you can instantly turn it off by just saying you forgot your Apple ID password and proceed to reset it. This has been an issue for so long and I have no idea why it hasn't been fixed. Does anyone know a viable solution to this clear oversight in their security system?

iPhone 12, iOS 17

Posted on Dec 27, 2023 6:09 AM

Reply

Answer 1

Top-ranking reply

Mac Jim ID

Community+ 2026

Level 10

92,558 points

Dec 27, 2023 8:23 AM in response to amasas

amasas wrote:

Regardless of the passcode being figured out by strangers scenario, it is still a security issue since Screen Time is a useless feature. All people need to know is how to press "Forgot password". I understand my issue may be a niche one, but it is still extremely frustrating nonetheless.

It is not as easy as just pressing Forgot Password. You will need another Trusted Device used when setting up your Apple ID in order to reset the password or try to reset it using the iforgot website which will take up to 30 days to attempt to verify you are the original owner.

If you forgot your Apple ID password - Apple Support

If you press forgot Passcode using Screen Time, you will also need to provide your Apple ID Password in order to reset it.

If you forgot your Screen Time passcode - Apple Support

Reply

Answer 2

muguy

Level 10

94,600 points

Dec 27, 2023 7:25 AM in response to amasas

The only solution, at present, is to not share your passcode. Most security issues are related to personal behavior.

Reply

Answer 3

Bob Timmons

Level 10

194,904 points

Dec 27, 2023 7:07 AM in response to amasas

No one on a user-to-user site like this one can explain decisions that have been made by Apple.

The solution would be for you to convince Apple to do what you want. If enough other users do the same, Apple might listen. Personally, I have no problem with things the way that they are and I suspect the vast majority of users feel the same way. Good luck though.

Contact Apple here:

Feedback - iPhone - Apple

Reply

Answer 4

Dec 27, 2023 7:36 AM in response to amasas

amasas wrote:

That isn't a solution. As others have alluded to before in other posts, there are scenarios where somebody can see you input your passcode into your phone. That's it. That's all it takes. They steal your phone and instantly have access to anything important. I'm not saying I am at risk of this scenario occurring nor does it matter how realistic it is. The fact remains that this is a huge security flaw and I am searching for a solution (if there even is one...)

It should not be that difficult to hide your passcode. You should do the same when using a debit card. You also have the option to use a more secure alphanumeric passcode of any length if you are concerned about that.

Reply

Answer 5

muguy

Level 10

94,600 points

Dec 27, 2023 6:37 AM in response to amasas

Don’t give anyone your passcode.

Reply

Answer 6

amasas Author

Level 1

4 points

Dec 27, 2023 9:32 AM in response to Mac Jim ID

That's simply not true. It doesn't matter what links you send from Apple Support's website. The real practical sequence of events that occurs is that if you have Screen Time set up, and you choose "Change Screen Time Passcode", a prompt will appear for you to enter your iCloud email and password. If you just press "Forgot Password" the prompt I have been talking about will come up. It allows you to use your phone's passcode to reset your Apple ID password, and just like that, you can turn Screen Time off; rendering it useless. So for example, if you wanted to set up a Screen Time system for your child, they are bound to know their own phone's passcode, so they can just immediately reset it. Therefore the only way to stop this is to get rid of a phone passcode, which isn't exactly a reasonable solution. It's a loophole of problems. As I said, this is a security flaw that Apple needs to address.

Reply

Answer 7

amasas Author

Level 1

4 points

Dec 27, 2023 6:57 AM in response to muguy

That isn't a solution. As others have alluded to before in other posts, there are scenarios where somebody can see you input your passcode into your phone. That's it. That's all it takes. They steal your phone and instantly have access to anything important. I'm not saying I am at risk of this scenario occurring nor does it matter how realistic it is. The fact remains that this is a huge security flaw and I am searching for a solution (if there even is one...)

Reply

Answer 8

amasas Author

Level 1

4 points

Dec 27, 2023 8:07 AM in response to Mac Jim ID

Regardless of the passcode being figured out by strangers scenario, it is still a security issue since Screen Time is a useless feature. All people need to know is how to press "Forgot password". I understand my issue may be a niche one, but it is still extremely frustrating nonetheless.

Reply

Security Oversight

Similar questions