Janky Apple ID Security

Hmm, I just had my Apple ID get mysteriously locked too. That process is pretty sketchy feeling, and I'm at home, with all my devices at hand.

This is why I have my AppleID protected by a YubiKey (well three of them actually).

Same thing happened to me tonight. Just a terrible and confusing experience.

Same thing for me. I’m turning off Stolen Device Protection. What a disaster if this happens while traveling or anywhere but home

Same things here, and it also wiped out my application specific passwords which caused problems with several apps.

Had to create new passwords for each of them.

Took a while to get everything reconfigured and synched on my MacBook Pro and iPhone.

I have been plagued with this for months. My iCloud account locks every 1-2 days and I have to unlock it. Sometimes I can unlock it without a password, other times I need to change it. I’ve phone Apple support and they’ve been mostly unhelpful.

The EXACT same thing just happened to me. Was convinced someone was trying to hack me, and it didn't seem like I was going to be able to get back into my account.

Apple seriously needs to get this sorted - It's discouraging me from ever trusting them again.

I have the security delay set for "always" instead of at familiar locations. Is there a reason an hour delay is infeasible? Its not like your data is gone for an hour, it just cant sync, right? That seems better than a stolen phone and account...

@Anonymous In theory, it should be usable, though semi-offline, for that hour, but it’s really annoying to have it keep popping up alerts asking me to log in, and I have low confidence that the system and apps are well tested in that state. I figured it would mess up the movie we were about to watch on Apple TV. Also, the brokenness makes me worried that there are other problems with this feature. Like maybe it will escalate to a longer delay than what it’s supposed to or require another device to unlock. The feature sounds good, but I no longer trust it and would prefer something simpler and more reliable. I’m careful about entering my passcode in public.

Earlier tonight it popped up on all three devices I was actively using (Watch, TV, iPhone) and demanded my Apple ID password be reentered in Settings. I just tapped Not Now until it went away, which took 5 or 6 taps, then it would go away for 5 or 10 minutes and come back. It did that for three or four cycles and then stopped entirely. I just assume that something failed to renew a token due to a server being down or glitching. I’ve seen it do this a few times in the past and it usually clears itself up.

I don’t have the security delay enabled, FWIW.

So happy (and unhappy) that I read this today, a couple of hours after the same thing happened to me. I did a Messages chat with Apple Support to resolve this, which eventually involved resetting my iCloud password and now reconnecting on all of my personal devices. And our Apple TVs. And probably something else. So annoying. But sort of glad I am not alone.

I had the same thing happen on April 4th with an account only used with one computer. I was able to unlock it without any problems and changed the password. A couple days later I kept getting a dialog telling me that it couldn't log into iMessage because of a problem with the account, which was weird since I've never used iMessage with this account/computer. A Google search suggested an error, and restarting the computer made it stop.

Concerned, I tried to look for account activity, but couldn't find it anywhere. (This might be because I've turned off most analytics and logging though.) A search suggests that there isn't one beyond a list of devices associated with the account. I requested a download of my Apple ID data, but it didn't show anything useful. Both Google and Microsoft will show account activity, and Microsoft will even show unsuccessful login attempts.

I'm a bit relieved that I'm not the only one this has happened to, but now I'm wondering if something is happening at Apple. A failure or intrusion?

More reports:

https://9to5mac.com/2024/04/26/signed-out-of-apple-id-account-problem-password/

This is driving me crazy, can you please layout how to do it without having to use your phone number? It’s not recognizing it, my Mac.com account stopped getting emails at 4:10pm this afternoon. I get to the part about having to unlock my account by verifying and changing my password, but here comes the phone number option and it’s not working. This includes doing it on the web. My devices aren’t recognizing each other- ugh this sucks

Oh thank goodness it wasn't just me, was drifting to sleep when I got the notification, thought I'd been hacked. Essentially the same symptoms as Michael except I was also asked to find another device (iMac, in other room) to unlock, which was showing both a system dialog saying that FaceTime needed me to sign in again and the notification for my account being locked, which just took me to the iCloud pane, security section, to change my password, which I had no choice but to do, after backing out of that broken password verification sheet, but at least I'd bypassed the stupid stolen device protection delay, which I will probably still not turn off. All very shitty, and I'm now very, very, very glad that my passwords are all locally stored in Strongbox, the vault on my NAS, accessible through a VPN under my control with no Apple bits involved. I checked my iCloud Drive for any text files, made sure none of them were absolutely critical to authentication, also discovering that my app-specific passwords no longer worked (FFS!) and that my AirPods pairing keys had been zapped, even when I restarted everything, and even though they showed up fine in Bluetooth settings and could still be manually connected. Took the opportunity to look through and correct all my passwords to ensure everything was accounted for including my new Apple ID password, which in fairness benefited from a change after many years and probably woke me up to do a task that I would have otherwise put off, found during this process that Strongbox, though not perfect, really is the right choice for me; highly recommend. So all in all just a really great way to be woken back up, not. Now having some tea, listening to an audiobook, and ranting on the Internet. Thank you Apple, your momumental incompetence is truly unmatched. Have one of these Apple stickers.

Had this happen and it really bothered me. Phone told me I could verifiy using one of my other devices but all of them were locked as well, but would let me send a code to the phone via SMS, which lead to a password reset. Talked to Apple Support to see if there was any insight as to *why* but they couldn't tell me.

Weird inscrutable issues with Apple's black box services is why I'm trying to transition away from them as much as I can. Unfortunately there's nothing I can do about having an Apple developer account so long as I'm an Apple developer.

Pro tip: most of the app-specific passwords were actually former SMTP credentials, now obsoleted by having a single OpenSMTPD relay set up on the network. So set up a relay, tell all your apps to use that, make sure the one password is correct in the relay configuration. Bonus: errors are even reported when you are offline (you won't get them till you're back online and your SMTP server has relayed them to their final destination where you'll pick them up and read them, unless of course you are running a local mail server).

Snap, down to it saying I was not at a significant location when I’m at home.

This just happened to me when I got up Saturday morning in the UK. After resetting my Apple ID password on my phone, I have to do it on my watch, my iPad mini, my iPad Pro, my iMac, my MacBook Air, my Mac mini, my Apple TV… i’m not sure if I also have to do it individually on my five HomePods – four of them in two stereo pairs, which might mean just one password reset per pair. Not to mention apps specific passwords for a couple of apps I use. Thank you Apple for making me waste an hour or two on Saturday morning.

The same thing hit me last night seeing it first while watching Apple TV then all devices. I do not have Stolen Device Protection turned on. Whatever glitch caused this it also wiped out ALL App Specific Passwords I have. Noticing this morning that things like Reminders are syncing slowly if at all.

As I've come to rely on iCloud more -- Ulysses writing projects, medical records shared between desktop and laptop, snapshot photo archives, among many other uses -- this terrifies me. Getting permanently locked out of my Apple ID would be devastating. I realize this is not exactly what we're talking about here, but it has happened to people, and the recent shenanigans sort of points to the potential of it. It's not clear to me that we (i.e. humans) can build and maintain systems of the complexity we've unleashed. The pace of "improvement" is greater than the pace of maintenance, IMO. The fact that all this is managed by Eddie Cue, noted happy-go-lucky sports and race car enthusiast, is not encouraging. iCloud shouldn't be under "Services," but under some sort of core technology / infrastructure tech lead, more like the profile of Johny Srouji.

Same here. Have not been able to get back in since last night. Contacted Apple and they cannot get me in. I can’t change password because it’s linked to my iCloud account. Also cannot create a new iCloud account

The same thing happened to me today. And this is a humongous pain as you have to redo all your app-specific passwords, it forks up Apple Music and if you have many computer, they all are messed up.

I didn't know about that Significant Locations page in Settings, mine similarly only shows a location I went to once weeks ago.

I additionally have iPhone Analytics off, so I'm curious why that and other switches were not only enabled in System Services but have purple arrowhead badges indicating recent location access.

Fortunately I haven't been locked out (yet), but I did get a spontaneous alert on my iPhone last night informing me that my phone number had been added to iMessage (which it already was).

Till Apple doesn't explain it
A quick summary of what isn't the cause so far, after reading several articles and messages :

No email ending in .me or .Mac because other emails were involved

No Stolen Device Protection, many people didn't even had it ON, but I turned mine OFF because if you are not at home it's a longer nightmare from what someone wrote

No old iCloud password , I reset mine VOLUNTARILY in January.

It's happening everywhere, US, Canada, UK, Sweden and Europe in general

Happened to me too. Glad others are reporting. I only have one Apple ID which is a personal email address. I have never enabled Stolen Device Protection. Even still, very disruptive, thought something bad was happening. I contacted Apple Support at 11 AM PST and they were not aware of any widespread issues. It wants me to reset my password. I am resisting. I am hoping this will be nullified by Sunday night. If it is not, I will give in and change my Apple ID password. Very disappointing, I really wonder if this could be related to the rumored Apple ID account system overhaul for iOS 18.

I’m relieved to know it’s not just me. My iCloud account has been locking almost daily for a few months now. It doesn’t make me change my passwords, but it does have me go through the unlock process each time. I’ve signed out of and back into all devices, done everything I can think of to no avail. I couldn’t find anything about this issue except that it probably meant someone was repeatedly trying to log into my account. Every day. For weeks. From all I’m seeing here, it’s becoming apparent that the issue is really at Apple’s end.

I especially love the part where Apple's got their support staff ignoring the growing press around this, pretending like nothing happened, and actually implying to customers that this was user initiated. I've been trying to help out a buddy who kept getting hit with verification server errors when trying to reset his password on his iPhone, and after giving up and trying from a computer, got stuck with a 24-72 hour lock that's going to hurt him financially due to work files on iCloud being inaccessible.

We tried different ways of explaining this to more than one support person, and it's the same line every time: there's no escalation path, just wait it out, you wanted this, so we will make sure you keep it. I've run technical support teams in the past, and worked in tech for decades. I know better than to blame the support reps themselves (they're clearly just using the lines they've been fed), but I hope the person who decided to put their support personnel and Apple's customers through this does some self-reflecting. Gaslighting customers when there's a known issue is not cute.

Same here. Especially fun getting the popup on my Apple TV while my wife and I were trying to watch something.

I got locked out and I called Apple. They didn't know but walked me through fixing the issue.

It was a bit convoluted but the iPhone/iPad are back to normal. (what ever that is)

So glad I don’t use any cloud anything.

This is interesting – hasn't happened to me, but earlier this week I had, all of a sudden, news that an iPhone and an Apple Watch was added to my iMessage – checked and it was my existing devices. Something's gone wrong with Apple but nobody for sure knows what.

DITTO! I reset last night and was hit again this AM. Apple Support was unaware.
Apparently, any lingirng device not updated pinging iCloud with an outdated token in its sleep will trigger the problem AGAIN!.

I have a lot of devices: 8-10 Macs (a couple haven't been powered up for a while,) AppleTVs, eight HomePods, two iPads, two iPhones. Even my Apple Watch was complaining. My curated list of App Specific passwords was wiped and needs to be restored and entered on all devices.

Is it time to diversify? First Tesla, now Apple is becoming non-grata!

Somehow I ended up going for Account recovery. Now I have to wait for 24 hours before continuing to reset my password. It's already been 22 hours passed by. I am waiting 2 more hours for the cooling period to get over.

Same thing here, but this happened while on hotel wifi, so had me in more of a panic than I would've been if at home.

30hrs later and back at home; everything is mostly normal, except Watch - won't accept new password, keeps saying it's wrong, and gives me this effed-up fail screen.
https://pbs.twimg.com/media/GMOnBILWYAAxLn0.jpg

Oh - and my "significant locations": none. Even though I spend ~20hrs/day at home, at least 300days/yr. If that's not "significant"....pleaes, Apple, tell me what is.

My iPhone showed this today. To confirm identity, it asked me to enter my phone number giving just the ending digits. Then it only allowed me to enter a US number (my AppleID is US-based but my phone number happens to be in EU). So if it persisted, I would have been really screwed. Real confidence builder, that.

Luckily, right away I unlocked my iPad with FaceID, and that seems to have pacified the iPhone. I have seen no trace of the account locking since, knock on wood.

Interestingly enough, it happened as I was using the phone to try to initialize (for the first time in a month) a HomePod, bricked since 17.3 and plagued by the much-discussed -5320 setup error. So maybe that login attempt triggered it.

My significant locations shows Home (twice), and some third place which does not seem significant. It also mentions 127 others but I am not worthy enough to view them.

Today (Sunday April 28), I'm locked out again.

I was locked out like everyone else on Friday. Same deal, had to reset my password. Now I'm going through the same thing except that I apparently need to wait 1 hour due to Stolen Device Protection—which did not happen the first time.

While all this is going on users were probably getting "you need to log into iCloud' alerts every 30 seconds. So incredibly annoying when you want to do exactly that.

Not this but related is the lockout that Chels referred to. My very old mother bricked her iPad because she tried to many times to log in. The best we could do was wipe it with her iCloud id and start over. Maybe 1% of the Apple's user base needs this level of draconian, paternalistic "protection."

I am glad I don't have Apple stolen device protection turned on. Seems Apple quality (or lack thereof) is a bigger threat to my phone then some stranger grabbing it!

If Apple is silent and it’s not a hack from someone, I’m thinking that could be an AI experiment gone awry and this is why Apple is keeping the secret

Because confined to Apple OSs and hardware a few years old should I consider myself lucky?

I had this experience - but I was at home so I didn't have the delay. If it had happened to my wife while I was away she'd have been SOL. It's a failure of fundamentals by Apple who owes us and explanation of what happened.

I just checked my Significant Locations, and the only one shown is a restaurant I ate at once **ever** yesterday. WTF?

This happens to me from time to time from months or years ago. Suddenly, a warning shows in Mac indicating that the application "Messages" (formerly iMessage) will not receive messages unless I login with my Apple ID, which is true (I can confirm that). Then that requires several steps to log in my Apple ID, and significant time, which interfere my productivity. And so on until the same issue arises next time. What is going on Apple? Please, do not interfere!!!

System: macOS 13.6.6 (22G630) Ventura on Mac (Intel). Such Mac from mid 2017 does not support macOS 14 Sonoma.

I'm glad I mostly decoupled from Apple Cloud for vital services like e-mail, photos and other important data two years ago.

I haven't been affected by the recent account problems myself. But after reading the comments here and elsewhere, I decided to disable the stolen device protection for now. Apple needs to overhaul this feature and make more transparent how it works. The "Significant Locations" section in settings is too opaque and confusing.

When I woke up yesterday same thing had happened and the phone asked for my Apple ID pw and wouldn't recognize it in the same manner as others here has described. Something happened on my Mac + iPad + tv. I had to reset my pw. I called Apple Support to find out what was going on but they (of course) denied any problems and blamed me as a user, but one support person actually acknowledged that the previous support call had been about the same issues. Now I feel as paranoid as if I had been on Android or Windows in Russia or China (or anything in Israel). Lack of info does not build trust.

So, I will still probably keep ignoring the macOS system notification that harasses me to accept the new iCloud license terms.

Lots of dark patterns with this system notification: e.g. closing the notification presents the iCloud license dialog.

Rather than "Significant Locations," could it be whatever is defined as "Home" or "Work" in the Maps app?

Same thing happened to me in the early hours of the UK morning. Thought I’d been the victim of a failed access attempt, but that didn’t make complete sense because of the need to change my password (rather than a simple 2FA authentication). Now that I realise it was a widespread problem, I’m pretty disappointed with the way Apple has done nothing to address this.

The main issue is the design of Significant Locations settings.
Apple is trying to be smart about it and fails. People should be able to set several such locations manually, and system should suggest few locations as optional, for people to confirm some of them.

My Apple ID locks every day. It is really not a big deal as any of my bona fide devices can unlock it. It is only a pain when adding a device and it is locked.

I suspect that there is some kind of criminal or foreign sponsored hack-hack at work hammering accounts bypassing any crapsha causing this issue.

I finally reset my password for iCloud on my Mac. Then was forced to sign into iMessage again. That worked.

Then updated my iCloud password on my iPhone - that worked. Then iPads.

I updated the password on my Apple TV’s. The first one did ok but right after entering it - my Control4 remote stopped working with it. I have no clue how just updating my iCloud password on an Apple TV would break the network connection between the C4 system and Apple.

I went to the next room - same issue again.

I have my entire C4 system home bridged to HomeKit. This way I have can control the entire house from the Home App too which is faster.

My home app on my phone was showing every single item unavailable. Home hubs were offline. Shit show.

After fussing with turning off the home item in iCloud on my phone and back on again I remember there was a Home app on the Mac.

That one showed everything online! - yet the iPhone and big iPad not.

I then tried my iPad mini - it too was ok and home showed everything.

At this point I realized this was device specific… clearly.

I finally just went for it and turned off iCloud on my iPhone. I hate doing that because of the crazy amount of places it’s connected. It signed me out of Find My and removed credit cards from Apple Pay - oh joy.

Then my phone got stuck on the ‘copying iCloud items’ - no clue what that is doing because I didn’t select to keep anything stored on the phone from iCloud. I let it run for 20min then power cycled phone. Went back to iCloud - still showed me signed in. Clicked sign out which was available to click. Nothing. Clicked it 5 times. A minute later it signed me out.

Someone online said that if screen time is enabled on your device - it can prevent sign outs from iCloud in general - good to know.

I opened the home app now just for fun - completely empty and reset = home is completely tied to iCloud. Good to know as well. Fuckers never tell us anything.

Restarted phone - then signed back into iCloud - tweak things from place to place, etc.

Then held my breath and opened Home app - Voila! - everything visible and online now.

I then opened the home app on my big iPad - it too was now showing things online. Like wtf does toggling iCloud on my phone have to do with my iPad?? - clearly something.

Now to get my Control 4 system remotes talking to Apple TV again.

There is a setting in the C4 app to turn on Apple TV integration. I had tried 10x to do this earlier in the day and it refused to do it saying my C4 controller was already connected.

This time however - it worked and let me add it again. Voila - all of my remotes now work again too.

So despite apple forcing me to reset my password - it should’ve told me to fucking sign out completely once doing that and sign back in. The full sign out and sign in wasn’t needed on my Mac or small iPad though. Lovely how consistent this shit is.

As we know - the phone is the central hub for their entire ecosystem and if it’s funky - the rest is unstable too.

There ya go - only lost about 5 hours total on all of this shit.

I wrote about how this ties in with an ongoing iCloud issue here: https://warnercrocker.com/2024/05/03/time-for-apple-to-come-clean-about-icloud-part-2/

In regards to the fixes and getting things back to "normal" there are some interesting and curious similarities.

“ I think it’s a bad idea to to use an iCloud address as the login for any important accounts.”

When Apple initially announced the ability to host third-party domains on iCloud, I considered it for a moment, but then realized that if, for some reason, I got locked out of my iCloud account, I would probably be locked out of my main email account as well. Eggs, baskets.

This is the second time I had this lockout issue, must change password demand, happened to me a couple of months ago. Same issue both times logged out of everything must change password and re-create all app specific passwords, turns into hour/hours long process both time.

Brian Krebs shared an article (3/29-24) on this topic

https://krebsonsecurity.com/2024/03/recent-mfa-bombing-attacks-targeting-apple-users/

@Sigve I wrote about that here, but I think it’s a different issue.

It gets even worse:
I just switched on my older iPad Pro which was shut down since weeks and sure enough it popped up a message about my Apple ID being locked (apparently it replays old alerts) with no way to cancel out. Immediately shut it down again and will see another time, if it pops up the alert again.

And still no official Word from the Mothership about what happened!

Ugh. It's been a month since that Apple ID mess happened and things are still a little wonky across all my devices. I've logged out and back into iCloud on almost all of them, and yet iMessages aren't showing up everywhere, photos aren't consistently syncing and even some apps like Drafts aren't syncing properly. WTF?

Though I haven't encountered the AppleID lock issue or the incorrect Significant Location problem, I recently helped a client with an iPhone (iOS 17.5) that had some blank System Setting screens and a blank Messages app screen. It had other obvious issues, too.

He already tried rebooting several times before I started to help.

The solution was to make sure the iPhone was backed up to iCloud, then erase it completely and restore it from its iCloud backup.

After watching this client use his iPhone during troubleshooting, I noticed he incessantly force-quit apps when he finished using them.

Though I still occassionaly use iOS's force quit (swiping an app off the top of the screen), I remember an Apple executive recently pleaded with users to stop force-quitting apps on the iPhone (and, I assume, on the iPad) because it could corrupt the system.

Though I disagreed with the exec's blanket statement because force-quitting is (or was?) sometimes necessary to stop a buggy app, I suspect my client's incessant force-quitting corrupted iOS.

After the wipe and restore, I told my client to stop using force-quitting regularly and only if an app continues to misbehave after restarting the iPhone, which he should do more often anyway since no iPhone malware, even zero-click exploits, persists after restarting (doesn't apply to macOS, though, and even iOS malware that fakes a "slide to turn off" doesn't persist after a reboot).

I thought this issue was behind me, but it came back today for no clear reason: Again, account locked and mandatory password change :-(