You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Passcode Requirement: You must change your iPhone unlock passcode within 60 minutes.

Issue:


A couple of weeks ago, after unlocking my iPhone I received a strange prompt on my iPhone 5 (running iOS 9.3.1, not jailbroken) saying that I had to change my passcode within 60 minutes.


Not thinking much of it, I followed the instruction and changed the passcode via the prompt. I didn't think to question the fact it didn't give me any options other than to pick a 4-digit passcode.


After changing it, I was again 2 weeks later (2 days ago as of writing this) prompted to change my passcode, except this time I had 58 minutes to do this.


I found this to be a bit fishy so I researched it and there was no apple documentation on it, only forums of a lot of other iPhone users that had experienced the same thing and the forums were dated as far back as 2012 (that I saw anyway, could have been more before that too).


I rang apple support, and they weren't aware of this issue as there wasn't a feature for iOS that made this happen and recommended I immediately reset my settings (by going to Settings > General > Reset > Reset All Settings). This resets all settings, doesn't erase any of your data.


It was my personal guess that if it was in fact malicious software, it may be connected to the operating system some how because the first time I changed my passcode via the prompt and it worked. So I made the decision to backup everything I wanted to keep manually, and not via iTunes and then manually get everything back. This may have been unnecessary but again it was my guess that any recent iTunes backups I had may have had this issue.


If it was in fact malicious, I'm not sure what kind of access it could of had to my phone, be it data or whatever. I may be slightly paranoid but wanted to remain on the safe side as pretty much everything I have was set up and connected to my phone. So I went the full length and changed a lot of the settings for accounts I have. Again, probably wasn't necessary but being safe.


So if you experience this yourself, just know that it isn't created by apple and you should at least reset your settings.


Hope this clears anything up!


User uploaded file


P.S. This isn't a screenshot I took, it is one I found on another stackexchange thread (source: http://apple.stackexchange.com/questions/124771/is-the-message-you-must-change-y our-passcode-within-60-minutes-valid-non…). Although it is exactly was I got

iPhone 5, iOS 9.3.1, Unusual passcode change prompt

Posted on May 4, 2016 10:02 PM

Reply
Question marked as Top-ranking reply

Posted on May 23, 2016 8:37 AM

Well, Ratter - so sorry you were offended, but I think it was necessary. The fact is, when someone comes here for help, quite often it is for two very relevant reasons: a) they are new to the forums and may not know the rules (thank you for pointing them out), and b) they don't know the answer (which you did not point us to). The lack of providing an answer, combined with a snarky tone only reminds newcomers that they don't know what they are doing. That is unhelpful, and actually encourages us NOT to come back to the forum for help (or to offer our help).


Now, to make this a constructive criticism, I would point to iziah's followup, where he kindly recognizes that not everyone knows the answer and may still be having the problem. That tone is appreciated. Even better would be to point to one of the myriad answers to this problem (that I still can't find). I congratulate you on your Level 4 status, as you must have LOTS of knowledge and experience - but wish you maintained some compassion and helpful spirit, instead of what you offered instead.

41 replies

Sep 5, 2016 8:46 AM in response to Lawrence Finch

Thank you for the additional feedback. The crash scenario seems plausible though somewhat of a coincidence that it happened before the first time I've ever been prompted to change my password. That is the part I still don't understand. I can't find anywhere what would have triggered a password change in my phone. My pw strength has always been above the current minimum requirements and always entered correctly. I'll reach out to Apple directly. Thanks for the contacts.


As far as iTunes, all of my data is on iPhoto and Google Cloud.

May 19, 2017 10:30 PM in response to iziah1

It is emanating from cell tower. It is likely a MDM trying to manage phones from cell towers. The first type of prompt is <Later> or <Continue>. After powering off (without clicking first prompt) and powering on phone a new prompt with only one option appears <Continue>. Either message does not allow navigating away from the prompt without clicking an option. When this happens power off phone, remove SIM card, power on phone, clear browsing history (may not be required), power off phone, reinsert SIM card, and then power on phone. This is required when it prevents navigating away from the prompt message. All the aforementioned explanations on this site and other support forums did not hold true because after removing SIM card and still having WiFi connection this activity would have persisted. Remember surveillance programs wanting backdoors to bypass passcodes? What better way then to ask the owner to give the passcode up since most people do not change these often or at all. Now the cell towers can support remote MDM of phone with ubiquity. Note: Verizon assumes Apple servers are pushing it and Apple has no idea about this, one plus one equals two.

May 20, 2017 7:53 AM in response to Sierra Juliet

Nonsense. MDM requires a security profile to be installed on your phone. Go to Settings/General and look for either Device Management or Profiles. If you don't have a security profile the carrier has no control over your phone. If you do have a security profile (and do not have an MS Exchange email account) just delete it. If you DO have an MS Exchange account the owner of that account has wide latitude as to how your phone is managed.

May 20, 2017 10:22 AM in response to Lawrence Finch

It is emanating from cell tower. It is likely a MDM (Mobile Device Management - an enterprise solution) trying to manage phones from cell towers. The first type of prompt is <Later> or <Continue>. After powering off (without clicking first prompt) and powering on phone a new prompt with only one option appears <Continue>. Neither message allows navigating away from the prompt without clicking an option. When this happens power off phone, remove SIM card, power on phone, clear browsing history (may not be required), power off phone, reinsert SIM card, and then power on phone. This is required when it prevents navigating away from the prompt message. All the aforementioned explanations in articles and technical support forums did not hold true because after removing the SIM card and still having WiFi connection this activity would have persisted but did not. Remember surveillance programs wanting backdoors to bypass passcodes? What better way then to ask the owner to give the passcode up since most people do not change these often or at all. Now the cell towers can support remote MDM of phone with ubiquity. Note: according to other articles and technical forums Verizon assumes Apple servers are pushing it and Apple has no idea about this, one plus one equals two.

May 20, 2017 12:03 PM in response to Sierra Juliet

Why should your carrier care how secure your phone is? It just doesn't make sense. And even the carrier has no access to the functionality of iOS without a profile. And if you simply go to the passcode settings and change it to the same passcode the alert goes away. There's no need to jump through any hoops.


Afterthought: Your phone is not even required to have a passcode. A lot of people don't have any passcode at all.

May 20, 2017 12:13 PM in response to Lawrence Finch

I did not claim the carrier or Apple was doing it. Carriers and Apple are not the only ones with access to cell towers. In the last sentence of my previous comments I stated neither one knew what was causing it, hence one plus one equals two, if not them then it's someone else. The fact of matter is this should not be happening to private phones, which are not under some mobile management program.


Yes, I agree phones are not required to have passcodes; therefore, why does it care about changing the passcode when the only people wanting passcode bypasses are the ones that want backdoors? That is what I am getting at here.


The reason for jumping through hoops is it would not allow bypass without clicking a button (i.e. "Later" or "Continue"). The only option was to restart phone and then the second message appeared with the only option being "Continue" and was unable to be bypassed either. Trojans work by clicking things that are presented.

May 20, 2017 12:21 PM in response to Sierra Juliet

There are no trojans on iPhones unless they have been jailbroken. It would be safe to click on either button.


Saying that carriers and Apple are not the only ones with access to cell towers falls into the tin-foil hat territory. First, Apple has no access to cell towers. And the only ones other than the carriers with access to cell towers are the NSA and FBI, and I'm sure they don't care whether you change your password or not.

May 20, 2017 1:13 PM in response to Lawrence Finch

The previous link was relevant to this discussion and the premise. "When data protection is enabled, each data file is associated with a specific class that supports a different level of accessibility and protects data based on when it needs to be accessed. The encryption and decryption operations associated with each class are based on a complex key hierarchy that utilizes the device's UID and passcode, plus a class key, file system key and per-file key. The per-file key is used to encrypt the file content. The class key is wrapped around the per-file key and stored in the file's metadata. The file system key is used to encrypt the metadata. The UID and passcode protect the class key. The passcode not only unlocks the device, but also becomes inextricably enmeshed with the UID to create iOS encryption keys that are more resistant to hacking efforts and brute-force attacks." (http://searchmobilecomputing.techtarget.com/tip/How-iOS-encryption-and-data-prot ection-work).

Passcode Requirement: You must change your iPhone unlock passcode within 60 minutes.

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.