iOS Internals · Locks & Encryption · Lesson 5 of 5

Challenge: The Café Snatch

Work out what a thief who saw your aunt's passcode can and can't do.

The case brief

Your Aunt Rosa was having coffee at a busy café across town. She unlocked her iPhone with her 6-digit passcode a few times while a stranger stood behind her. A minute after she set the phone on the table, he grabbed it and ran.

Here's what you know about her iPhone:

• It runs the latest iOS and uses Face ID.
• Stolen Device Protection is on, with Require Security Delay set to Away from Familiar Locations.
• Find My is on, and she uses two-factor authentication.
• She turned on Erase Data last year.
• Her bank password is saved in the iPhone's Passwords app.

The café isn't somewhere Rosa usually goes. She calls you from the café's phone, worried. She says the thief clearly saw her passcode, so he must be able to do anything he likes with her phone now, starting with logging in to her bank.

Racing the clock

The thief gives up on the bank and goes for something bigger. He opens Settings and tries to change Rosa's Apple Account password, so he can lock her out and sell the phone. The iPhone wants Face ID before it will even start, and then a wait before it will finish.

Meanwhile, you're with Rosa. You can sign in to iCloud.com on your phone and mark hers as lost in Find My.

The setting that doesn't help

Rosa lists every security setting she has turned on and asks which ones are protecting her right now. She's especially proud of Erase Data, because she read that it wipes the phone after 10 wrong guesses.

Think about how this thief got in. He didn't have to guess anything. He watched her type the passcode, and now he can unlock the phone whenever he likes.

Rosa's face data

The next day Rosa has a new worry. She reads that her face data is stored on the stolen phone. She wonders whether the thief, or someone he sells the phone to, could pull that data off and use it to unlock her new iPhone or her laptop.

She also asks whether Apple has a copy of her face in iCloud that could leak.