“The Risk of Apple’s Recovery Key Feature: How Thieves Can Lock You Out of Your Own iPhone”

In 2020, Apple added a new security feature to the system called “Recovery Key”. This is a randomly generated 28-digit code that can be used to reset your password and regain access to your Apple ID. However, creating this key disables another account recovery option, and that’s what those who steal or accidentally find iPhones bet on.

The WSJ server reports on a man whose iPhone 14 Pro was stolen in a bar last October, in which he had stored (together with the cloud) his daughter’s eight-year photo history. But the thief used the newly created Recovery Key to change the password on his private Apple ID account. And by doing so, he ensured that the original owner would never gain access to the phone again in his life. Even though the man was willing to fly to Apple headquarters and pay $10,000 to regain control of his own iPhone. Apple support didn’t help him at all.

When you create a Recovery Key, iPhone informs you that if you create it, you will lose any other options to restore your account

You can access the Recovery Key via Settings – – Password and security. When you click on an item Recovery key your Apple ID account password may or may not be requested. However, you will need to enter the lock or current device code when activating the recovery key. In a bar full of people, a would-be thief just had to look at the display lock, thanks to which he soon gained full access to the phone.

After all, even Apple warns that if you lose the recovery key, you can be completely cut off from your account. Apple adds on the support page that it is advisable to store the Recovery Key itself in a safe place or give a copy of this key to a family member. It will appear on your display only once, and Apple will save an encrypted copy of it on its servers. If you act quickly when you lose your phone, you can easily regain control of at least your account and cloud data.

Fortune smiled on one user

Another user whose iPhone 13 Pro was stolen last summer was lucky. A remote support representative verified his identity and deactivated the Remote Recovery Key. This gave him access to his account, which was especially important for the photos from the cloud, which he immediately backed up.

So, on the one hand, the recovery key looks like a useful security feature, but it can be very easily misused for nefarious purposes. If only because even if one key is already created, a possible finder or thief can create a new key. He just needs to know the phone’s lock, which can be easily traced in the case of less complicated variants.

How to reset your Apple ID password:

Source: WSJ, Apple