Can only advise that you should have recovery contacts and a recovery key set up in case something goes wrong.

I have no idea how to untangle this dependency chain. I'm using registrar in my country, so if everything goes wrong, I can just contact them with my ID and hopefully fix things up, but I'd prefer to have 100% reliable e-mail in the first place.

My Apple ID uses a unique password, I keep a recovery key, I don't have its login credentials saved anywhere, and it's a dev account; so I have my LLC's DUNS number attached to it. My devices are the only ones listed in my settings portal.

I have no idea why I get these notifications, lol.

Understanding what the problem is is essentially impossible. Going to a physical store doesn't help, calling their customer service has them telling you to go to www.apple.com/support (???), and writing for support has them rotate you through 4 different, and decreasingly useful, representatives.

The last response I got I was told the issue had to be handled by yet a different representative and it would take an "indefinite amount of time". Which may be a nice way of them saying it's never going to happen.

It really is demoralizing when you realize there is nothing you can do really, even in cases when you have done nothing wrong.

Not impressed to say the least.

The problem stems from nefarious groups getting a hold of email addresses and running distributed dictionary attacks.

Apple’s response is to prevent all logins (including valid ones) from accounts that are under attack.

Unlocking the account involves calling Apple, they’re not going to tell you why the account was locked.

I hope legislation will force Apple to step up and be more transparent / helpful.

https://skogsbrus.xyz/dont-put-all-your-apples-in-one-basket...

I noticed because I got a prompt on my phone, which requested I allow (or disallow) the access.

Since I'm pretty good about password hygiene and security, I of course changed my password immediately and force-signed out all my devices.

That being said: if someone has a password list and is using a bot to scan them all; Apple will of course lock-out sign-in attempts.

Not to say what they're doing is right, there's better ways to handle it. But if I were to apply very recent anecdotal data to this even then this is a meaningful conclusion I could draw.

The fact that your device can become a complete brick, because of an issue in their completely hands-off account management system, smells like a class action suit

Getting cut off from one of these places can have a huge impact on people. They happen without warning and often without explanation.

I think they ought to be forced to be more open around the process and how to get help in general.

For Apple I have usually managed to get a hold of some support. Often not helpful but at least somebody.

With Google and Facebook I have never been able to find anyone.

Sameting that is demonstrated on this site frequently when someone will post a plea for someone who knows people at Google who they can't contact on their behalf. Since they can't get hold of anyone themselves.

(Yes I am sure its covered in the EULA several times that there is close to no support)

(For Google Workplace it is usually possible to get a hold of someone.)

I had read Apple is switching the name AppleID to be Apple Account or something similar at WWDC. Me thinks they are quietly pushing code that somehow is causing this for people.

Maybe it’s an age of account issue or some other commonality.

I signed up for an at me account twenty years ago and still use that as my living and haven’t had issues. Maybe icloud.com users?

This morning, as a precaution, I changed all my important passwords.

Good to know it wasn't just me.

Apple is crazy. My iPad with the authenticator broke, and even though I filled endless forms, verified emails and phone number they just keep sending me emails I was gonna be called by support at a date 3 weeks away.

Got no call, restarted the procedure. Got called in January, and it was an automatic voicemail or something..

I literally couldn't use my work machine (had a backup desktop to use).

Needless to say, except for the MBP I sadly need for work I'm not giving apple a dime for my life.

What's convenient may also be a bigger security gap and impact than many ppl realize.

The recent threads about PalmOS phones seem timely in hindsight. With Palm devices, you installed apps yourself with a sync cable to your computer, and there was no convenient app store, no one could lock you out of your smart phone and your life. Maybe that's an option that should come back. iTunes used to backup and sync just fine.

If there's no real acknowledgement or detailed coming out about this, it's very possible it's a cybersecurity incident of some kind that is serious enough. And it's not just an Apple thing. This has or will happen with every digital identity provider.

There's no one to really pick the phone or answer an email at google or apple when it comes to your digital identity that they want to be holders and providers of.. At least with the government there's a DMV or registry to go to.

Seems like a dangerous advice for a regular person who can just go to Apple and get stuff back?

You have to depend on someone somewhere. Just make that dependency less of an issue should anything show stopping happen.

Personally I’d like to see some legislation around identity providers and service levels and account retention.

In the other hand, if Apple suddenly found out that a good chunk of encrypted volumes weren’t actually encrypted / the key was recoverable by an offline attacker, this would also explain the facts.

But the lack of explanation from Apple is troubling.

And my email is on Fastmail under a custom domain. They have good support so far

The email addresses ending in @icloud.com are scraped from a master list and the attack is directed to apple, while the custom domains are ignored because there is work involved in figuring out where those are hosted.

iCloud lets the user generate secondary email addresses, it’s better to use that and keep the login email address secret.

zero issues since.

> The problem stems from nefarious groups getting a hold of email addresses and running distributed dictionary attacks.

years back my email was leaked by a website that i never visited. apparently someone signed up using my email address and the website never verified the email.

in the meantime more and more people used the same email address [0] to signup everywhere (it’s not the same person, i checked).

[0] gmail ignores dots in usernames: https://support.google.com/mail/answer/7436150?hl=en#:~:text....

at this point my emails should be random hashes@random hash domain

Perhaps so that someone who found your iphone unlocked can't just keep using it and your iCloud in perpetuity?

On iOS or macOS? Was a consent dialog presented before the update was installed?

But none the less, I liked my old password and had to change to something else.

That being.....?

> got my Macbook Pro from work and signed in to my Apple ID on it.

Wouldn't this result in unintentional data sharing from the work device to your personal devices? (and vice versa)

Citation requested.

Of course?? That would be insane. Password-guessing bots are all over the place. Apple should not allow them to cause lockouts.

Or a device on your network is or was compromised and used as a channel to attack others on the internet.

Or your ISP has given you a public address where the last owner was abusing it.. or perhaps the whole ISP block has been added to a shitlist.

And what command line tool are you referencing?

This is HN frontpage. It's on a big "Mac" website. The damage is done.

Many are going to write nonsense like: "Apple is still a $2 trillion company, so this obviously works for them" to which I'll respond with a simple question: Did it not work for Apple before these SNAFUs? Does it work better for Apple now, after fuck ups like that?

It's not normal behavior and they are losing customers over this.

We had an Apple "moment" in the family: around the 2012'ish MacBook Air era. Two at home and they worked fine, for about ten years. Then the battery issues, the keyboard issues, the trackpad issues. Eventually these MacBook Airs died a painful death.

I'm on Linux since the nineties (and, yup, I can get into my system with Apple or Microsoft forcing an online ID down my throat) but the Macs were convenient for the wife.

So we bought a MacBook Air M1. After 13 months or so the screen died alone, overnight: was working fine before closing the lid, was dead in the morning. There are threads with dozens of pages on that subject.

That's when I switched the wife to Ubuntu. Ubuntu, Linux Mint: she doesn't care. Heck, I probably could have her use Debian or Devuan (Debian without systemd).

Apple is done for us. It's over. We'll never ever buy a Mac again and I'll never ever recommend a Mac to anyone.

And I'm far from the only one thinking that way.

The damage is done.

Rationalize as much as you want, invoke AAPL's market cap as much as you want, and enjoy being locked out of of your devices without any recourse.

https://news.ycombinator.com/item?id=28554400

This is why I've always rejected the concept of vendor "ecosystems" and cloud-first SaaS solutions for my personal computing. I've also designed my life so it's not dependent on having uninterrupted access to Facebook or Gmail.