Motherboard:
In each of these muggings, the perpetrator allegedly held the victim up at gunpoint, demanded that they pull out their iPhone, and gave them instructions: Disable “Find My iPhone,” and log out of iCloud.
And:
A stolen iPhone which is still attached to the original owner’s iCloud account is worthless for personal use or reselling purposes (unless you strip it for parts), because at any point the original owner can remotely lock the phone and find its location with Find My iPhone. Without the owner’s password, the original owner’s account can’t be unlinked from the phone and the device can’t be factory reset. This security feature explains why some muggers have been demanding passwords from their victims.
And:
In practice, “iCloud unlock” as it’s often called, is a scheme that involves a complex supply chain of different scams and cybercriminals. These include using fake receipts and invoices to trick Apple into believing they’re the legitimate owner of the phone, using databases that look up information on iPhones, and social engineering at Apple Stores. There are even custom phishing kits for sale online designed to steal iCloud passwords from a phone’s original owner.
Fascinating read, especially the coverage of phishing. Incredible balance, with the makers who make valuable things on one end, and the people seeking to convert those efforts into illicitly gotten cash on the other.
Could Apple create some kind of cookie that would stay on the phone for 24 hours after the phone has had the security features turned off so they could get it back anyway? Probably would turn into a circular security black hole.
Actually, Apple has already provided a solution for this. If you are managing your device with Apple Configurator (which you should be, if only to have your device pair-locked for security) then you can use “Managed Lost Mode” whether the device is signed into iCloud or not. Configurator manages by device, not by user account. You could even disable iCloud logout so that the nogoodniks couldn’t log your account out in the first place.
Configurator is a MUST in today’s political climate. Get it and learn to use it. If it helps you not have your phone stolen or at least means some their gets no value out of their ill-gotten gains, then that’s a bonus.
https://itunes.apple.com/ca/app/apple-configurator-2/id1037126344?mt=12 )
they likely could but as you said ‘circular security black hole’. not to mention the notion that they could track a device with the features off being used by law enforcement etc.
the last one at least can be stymied by better training for their staff to validate receipts, etc. and better training by their staff to teach customers about phishing etc. they seem to recognize that some of their customers are stupid enough they need to be taught how to swipe etc on their iPhone, so they should recognize that some of their customers are stupid enough to punch in their passwords on any old site