ie8 fix
madison

Hardware 2.0

Adrian Kingsley-Hughes

Apple - You need to fix this Find My iPhone flaw ASAP!

By | June 16, 2011, 11:17am PDT

Summary: I think that the ‘Find My iPhone’ feature baked into iOS is a great tool, but it’s fundamentally flawed. Here’s the flaw, and it’s stunningly simple.

I think that the ‘Find My iPhone’ feature baked into iOS is a great tool, but it’s fundamentally flawed.

Here’s the flaw, and it’s stunningly simple.

Let’s say I’m in a bar and I take a call or answer a txt or email on my iPhone, but then I get distracted and leave it somewhere (and don’t say it can’t happen …). Now imagine that it’s a bar in a shady part of town and my iPhone is found by some miscreant before the lock screen kicks in (which I have set to 5 minutes, because anything shorter than that gets tedious). Now here’s the problem … why is this person now able to go into Settings > Location Services and disable MY ability to find MY iPhone without having to enter a password or anything? What’s worse, doing this simple operating INFORMS SAID BAD GUY THAT IT DISABLES MY ABILITY TO FIND MY PHONE!

This is crazy. Disabling Find My iPhone should, at the very least, require the password to be reentered, and better still require logging into MobileMe (or iCloud or whatever it’s going to end up being called). I know that if your hardware falls into the bad guy’s (or gal’s) hands anything is possible, but I don’t expect hiding MY iPhone from ME to be this darn simple.

This is dead easy to fix. To be honest, it’s such a dumb design that I have no idea why it’s not already been fixed.

Hey, Apple! FIX IT!!!

[UPDATE: Here's a workaround sent in to me by Toby:

Even if you leave the phone open and not at lock screen you can prevent someone turning off Find My iPhone.

Go to Settings --> General --> Restrictions

You'll be prompted to put in a lock code.

Now select "Location Services".

So now anyone that tries to change settings related to Location Services will need to enter the passcode, even if the phone was open and in apps or whatever.

It works, but I really think that this setting should be default, and perhaps rely on using your MobileMe password for authentication rather than the iPhone passcode.]

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Adrian Kingsley-Hughes is an internationally published technology author who has devoted over a decade to helping users get the most from technology.

Disclosure

Adrian Kingsley-Hughes

All opinions expressed on Hardware 2.0 are those of Adrian Kingsley-Hughes. Every effort is made to ensure that the information posted is accurate. If you have any comments, queries or corrections, please contact Adrian via the email link here. Any possible conflicts of interest will be posted below. [Updated: February 23, 2010] - Adrian Kingsley-Hughes has no business relationships, affiliations, investments, or other actual/potential conflicts of interest relating to the content posted so far on this blog.

Biography

Adrian Kingsley-Hughes

Adrian Kingsley-Hughes is an internationally published technology author who has devoted over a decade to helping users get the most from technology -- whether that be by learning to program, building a PC from a pile of parts, or helping them get the most from their new MP3 player or digital camera.

Adrian has authored/co-authored technical books on a variety of topics, ranging from programming to building and maintaining PCs. His most recent books include "Build the Ultimate Custom PC", "Beginning Programming" and "The PC Doctor's Fix It Yourself Guide". He has also written training manuals that have been used by a number of Fortune 500 companies.

Adrian also runs a popular blog under the name The PC Doctor, where he covers a range of computer-related topics -- from security to repairing and upgrading.

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?
42
Comments

Join the conversation!

Just In

RE: Apple - You need to fix this Find My iPhone flaw ASAP!
highvoltag3 1st Dec
@ipadsucks Grow up!
0 Votes
+ -
Even crazier
oncall 16th Jun
Turning off the phone, or putting it in airplane mode will disable the find my iPhone.
@oncall Doing either of those makes the phone useless to the one who stole it, unless they just want to smash it just for fun lol.
0 Votes
+ -
The point being
oncall 16th Jun
@Bates_

A "knowledgeable" thief aware of location services and the need to quickly disable it, which this article assumes, would immediately turn off a cell phone such that it could not be located then erased and sold later. Likewise a "knowledgeable" thief after data would place the phone into airplane mode such as to avoid the remote wipe functionality.
0 Votes
+ -
RE: Apple - You need to fix this Find My iPhone flaw ASAP!
global.philosopher Updated - 16th Jun
@oncall I agree but you can't have everything. The airplane mode is an important feature but that is a clear draw back...buty hey...not much can be done about it. Try and not get your phone stolen and if it is hope that they are too stupid to know to turn on airplane mode.
Question is can you lock the phone and still track it...that way no oone can use it while you are tracking them...assuming they have not turned on airplane mode.
Perhaps an optional passcode on airploane mode is required to prevent someone from turning it on. That way the only way to disable location servies is to remove the sim which is not an easy job.
0 Votes
+ -
Being realistic
oncall 16th Jun
@global.philosopher

Sure it's neat the stories on the web of people risking bodily harm to recover their stolen iPhones. However, if my phone is lost I am sending a "reward if returned call..." message then I am erasing the phone and buying a new one.
0 Votes
+ -
P.S.
oncall Updated - 16th Jun
Turn on restrictions and disable the ability to turn off location services without a passcode. Problem solved.

I assume you don't have young kids who like to play with your iPhone so you're forgiven for not being knowledgeable about the use of restrictions wink
@oncall

This is a bit like the default Safari setting to run files marked as safe ... the default SHOULD be a passcode entry to shut the service off ... not the reverse. This, in my mind, is a bit of a perversion brought about by the 'everything just works' mentality. In the interest of security, some things might have to be a bit more complicated.
0 Votes
+ -
Whatever
oncall 16th Jun
@noagenda

Hardly the primary point of this blog. The primary point of this blog was a design flaw that "supposedly" needed fixing and I pointed out a fix already exists. So instead of being a helpful blog "oh here's a common problem and the fix but maybe Apple could do it better", and we could spend our time discussing the pros and cons of enabling automatic application of the screen-lock passcode to underlying functions (a bad idea IMHO), it just comes off as a whiney misinformed rant.
0 Votes
+ -
Nice fix.
Bruizer 16th Jun
@oncall

I had wondered about this "loophole" once a while back but then forgot about it.

Thanks for the idea.
a fit because he's ignorant.
@fr_gough
To the point of offering explanations as to why Apple did not (and does not) makes mistakes, by offering up an endless line of excuses and reasons that Apple is ubnder no obligation to point out.

Then when Apple admits to the error and corrects it, you act as though you had never made the excuse, insrtead offering Apple praise for finding and fixing the issue forthright.

plain
0 Votes
+ -
@Mr. Spock
fr_gough 16th Jun
No. As opposed to me, who would, as my first course of action, google to see if there was a way to prevent someone from turning off location services. Especially if I was about to write an article lambasting Apple for having some sort of flaw. It's called getting your ducks all in a row before making an accusation and is the sign of maturity and professionalism.
@oncall

Tip of the day! Thanks. I figured there would be a way to do this but had not got around to it.
@oncall This will also kill a bunch of features like any new app that needs access to the locations or try creating a reminder after you have activated this (Good luck!) 'cause it won't let you.
0 Votes
+ -
when someone loses their phone. In fact, I think we should append our health care reform bill to include entitlements so that below average intelligence people (i.e. IQ 120) get a free Apple device of their choice and a nice stand to put it in, plus a cobra car alarm for security reasons.

Now back to our usual "feelings of entitlement" pages, because hey, sometimes it's all about what the "other" guy did wrong!!!
0 Votes
+ -
RE: Apple - You need to fix this Find My iPhone flaw ASAP!
slingzenarrowzuvowtrayjissforchin 16th Jun
@rock06r
Har! I got a good chuckle out of that one.
hahaha love it shows you why iphone is still a junk phone. and watch out iphone when windows phone 7 arrives with nokia models and new mango update it going to show some surprise in store. I have feeling Skype and Qik we will see new windows phone 7 new phones in Sept.

Ck out new windows 8 desktop system it is using windows phone 7 tiles looks so awesome and more modern. http://youtu.be/OM8t0H5d2sg

I am glad no more ICONS like iphone has.
0 Votes
+ -
Just shut up troll.
Bates_ 16th Jun
@ipadsucks Go back to your bridge troll. Oncall nailed it. There is no flaw, which makes this article pointless, sorry AKH but you can prevent this from happening rather simply.

Go spout your iPhone hate somewhere else "ipadsucks" because you obviously know nothing about it.
0 Votes
+ -
ESL lesson
Robert Hahn 16th Jun
I be watchin for de mango when da monkey boy get on table do the dance with arms. Feel Verizon no like the Skype no like the monkey boy put the Skype on the Verizon phone in Sept or Oct or Nov or netime.
@ipadsucks Grow up!
0 Votes
+ -
IF you're in a bar and
IF you take a call and
IF you get distracted and
IF you leave your phone and
IF someone finds it in less than 5 minutes and
IF that someone is a miscreant and
IF they know how to change the settings
there could be a problem.

Is that right?
@msalzberg I agree, the article is pretty lame. But hey, can you imagine how many articles just like this he can write? The next time the author will forget in a bar his notebook, iPad, iPod, his second phone he forgot to lock just before answering the phone call on his iPhone,,,,
@msalzberg
0 Votes
+ -
It appears that 'IF's'
Mister Spock 16th Jun
@SonofaSailor
only apply to Microsoft. Should a chain of eight precise events happen in a particular chronological order on a particularly configured machine that allows someone limited access to your data, it is known as a "Gaping Hole", yet should something less complicated happen to an Apple product, it is known as an "impossibility".

You must learn to understand current terminology
plain
@SonofaSailor

First of all, there's a last "IF." IF he knows your passcode, he can then use the phone.

Also please note the "if / and."

Anything is possible. However, some possibilities are more remote than others. This is pretty remote.
@Mister Spock

Wow, nice straw man you have there.
0 Votes
+ -
@MisterSpock

Touche. It's funny how "iOS is soooo user friendly and soooo easy to use"... yet in this case, it becomes a matter "IF the hacker knows how to disable the settings"!!! Like that would take a genius to figure out (mind you, they don't have to do it in a 5 minute window, now that they've picked up the phone and reset lockout counter)

@msalzberg "there's a last "IF." IF he knows your passcode, he can then use the phone."...

http://www.youtube.com/watch?v=WrjwaqZfjIY

Wrong. the whole premise of the article and argument is if someone picks up the phone before the lockout function occurs. That being the case, the person doesn't need to know the passcode. They just need to make sure they don't let the phone sit idle for however long until they do whatever they'd like to do with your phone.

That was Adrian's original point: to require a passcode to disable/turn off the "Find my iPhone function"
0 Votes
+ -
oooooooh
OneTwoc21 16th Jun
so THATS how I should steal an iphone :P
@OneTwoc21 it would not be easy to find a moron with an iPhone who will happen to do all these things in this particular sequence,,,,
@pupkin_z


You mean other than the blogger?
@pupkin_z

I'm sorry, but just because they bought an Apple product, does not boost their IQ. They are still capable of making the same stupid or inattentive mistakes that anyone else who owns any kind of other device are capable of.

Case in point: when the Mac Defender issue first came out, the reply by alot of apologists was: "No Mac user stupid enough to allow/install that crap"... but it turned out Mac users are just as stupid as everyone else.
0 Votes
+ -
Good suggestion. Perhaps it should be a default setting. If one's that concerned (for the time being) they may also go to 'Settings' and under 'General' look into 'Passcode Lock' and set the phone to 'Require Passcode' immediately. That may help a bit.
0 Votes
+ -
Before you freak out...
nhudd 16th Jun
You ought to look into the fact that this in indeed purposefully designed this way. Your "workaround" provided by Toby is in fact the designed method specifically provided by Apple to all corporations who need this exact level of security enabled.

The next thing you know, you'll be freaking out over the fact that Apple lets you set 1234 as your access code! How could they allow something so insecure?!!!

Good Grief!
The next thing you know, you'll be freaking out over the fact that Apple lets you set 1234 as your access code! How could they allow something so insecure?!!!

Because it just works, that's why.

lol..
Thanks for the info! I applied the update section of your article to my iPhone and iPad.
0 Votes
+ -
Those of you who brag how great your android or windows 7 phones are, just makes me laugh. The iPhone is decades beyond these other devices. Most just don't get it.

That's okay, because you have to have knockoffs to give cheap people some choice. But the slamming of the iPhone left and right, is nothing more than a joke as far as I'm concerned.
I have the simplest solution.... 1. Don't go drinking in a bar in the bad part of town. (we know what happens to "special" iPhones when people go drinking in bars and they misplace their phone) 2. Don't drink too much. 3. If your at a bar with friends, pay attention to them, not your phone. Keep it in your pocket.
Now that they fixed their major flaw, "AT&T" seems like they should fix the other ones.
Lets us not take responsibility for anything we do. (Said with dripping sarcasm) Sheesh! Your phone is a valuable item in more ways than just one! Are you going to leave your diamond wedding ring, or wallet, laying on a bar and then turn your back on it? Take some responsibility and keep the damn thing in your pocket.
0 Votes
+ -
Why Amend ObamaCare?
Gr8Music 17th Jun
We already subsidize phones and service via Universal Service Fund. Maybe they'll throw-in the alarm...

http://www.snopes.com/politics/taxes/cellphone.asp
Maybe I'm missing something I did what they said to do above, then I deleted the mobile me account from my iPhone, and my iPhone doesn't show up when I try to find it using find my iPhone from another iPhone.
0 Votes
+ -
Try activating the restrictions on for locations and then creating a Location Based Reminder in the new Reminders.app that comes by default with the iPhone. You will not be able to.

Now to those saying that it is fine to let such an option be turned off as easily: YOU MUST BE KIDDING!
Of course any knowledgeable thief would activate airplane mode or turn it off put it in DFU and just restore it but that's not the point the point is that you do not have to be "knowledgeable" to go int Setting -> Locations and turn it off either everything or just Find my iPhone specially when it's so obvious when you get to that Screen.

This is a FLAW.

To the Apple Defenders here, I am one of you but I do see flaws and bugs where they are and this is one.

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix