The first iOS 17.3 beta rolling out to developers today includes a new “Stolen Device Protection” feature that is designed to add an additional layer of security in the event someone has stolen your iPhone and also obtained the device’s passcode.
When the feature is turned on, iPhone users are required to authenticate with Face ID or Touch ID for additional actions, including viewing passwords or passkeys stored in iCloud Keychain, applying for a new Apple Card, turning off Lost Mode, erasing all content and settings, using payment methods saved in Safari, and more.
The phone passcode, though, not your account password, which I still find an odd choice. All you need(ed) was the pin to unlock the phone to completely take over the entire account, including all your passwords and with it probably bank accounts, pictures, disabling find my, etc.
This is a security vs. usability tradeoff, and while many people here would take security over usability any day of the week (which is what this feature finally provides as an option), Apple caters to much wider audiences. People tend to forget their account passwords, and having the option to reset their Apple ID account password with two other factors (“something you own” being the device, “something you know” being the device’s passcode) comes in very handy. I know people who neither remember their passwords nor want to use a password manager. So having a simple way around that by default that’s at least somewhat secure and now having an option to increase security seems like a good solution. Even though I would’ve liked to have an option to completely disable messing with my Apple ID using any form of device authentication.
I get the trade of and it’s probably been the correct choice as I can’t imagine that specific theft affected a large portion of users. Still an odd place if you find yourself without your phone and soon after locked out of your digital life including you bank account and much more.
It’s great Apple is taking steps to improve the situation there.