appleid
Latest
Amazon, Apple stop taking key account changes over the phone after identity breach
By now, you may have heard the story of the identity 'hack' perpetrated against Wired journalist Mat Honan. Using easily obtained data, an anonymous duo bluffed its way into changing his Amazon account, then his Apple iCloud account, then his Google account and ultimately the real target, Twitter. Both Amazon and Apple were docked for how easy it was to modify an account over the phone -- and, in close succession, have both put at least a momentary lockdown on the changes that led to Honan losing much of his digital presence and some irreplaceable photos. His own publication has reportedly confirmed a policy change at Amazon that prevents over-the-phone account changes. Apple hasn't been as direct about what's going on, but Wired believes there's been a 24-hour hold on phone-based Apple ID password resets while the company marshals its resources and decides how much extra strictness is required. Neither company has said much about the issue. Amazon has been silent, while Apple claims that some of its existing procedures weren't followed properly, regardless of any rules it might need to mend. However the companies address the problem, this is one of those moments where the lesson learned is more important than the outcome. Folks: if your accounts and your personal data matter to you, use truly secure passwords and back up your content. While Honan hints that he may have put at least some of the pieces back together, not everyone gets that second chance.
Dear Aunt TUAW: Help me sort iTunes Music by Apple ID
Dear Aunt TUAW, Ah, the problems of modern romance. Since I broke up with "her" (and yes, I know you were saying she wasn't right for me) getting rid of all the remants of the relationship has not been easy, especially "her" digital footprint. She loved her music. So she would bring her iPod to my house and sync it leaving a whole bunch of songs I'll NEVER play again that were purchased under her Apple ID. How can I find them, delete them and finally be ready to move on with my life? Your favorite but knucklehead nephew, Mark Dear Mark, When in doubt, there's usually an AppleScript solution to everything. Doug's Scripts offers one called "track down purchases" that scans your library, looks at the file for each song, and retrieves the apID purchase account for the track. It then builds individual playlists that sorts the songs by account. Be aware that you may encounter snags for homebrew recordings such as those from GarageBand, because the script expects to encounter standard iTunes tracks. If so, you may want to temporarily remove those while running the AppleScript. Let Auntie know if that does the job for you. Hugs, Auntie T.
Fake Apple billing email is circulating
Not surprisingly, scammers are targeting Apple customers with a fake phishing email asking them to update their account billing information. People who are new to Apple and probably received their first Mac or iOS device during the holiday season are particularly vulnerable to this scam. This group of customers would not be surprised to receive an email from Apple shortly after they signed up for iTunes for the first time. According to Intego, the email has the same silver coloring as Apple's website and includes the Apple logo to make it look authentic. If you click on the link within the email, you'll travel to a website that closely resembles Apple's website. Of course, there's a login on the fake page that'll steal your Apple ID and password if you make the mistake of logging into the site. On the next page, there's a form that'll steal your credit card information if you willingly submit this information to the fake site. The only way to tell that this email is a scam is to look closely at the URL contained in the email. The link in the email says "store.apple.com", but the underlying URL directs you to page named "apple.htm" on a server that does not belong to Apple. Depending on your email client, you only have to put you pointer over the link to see a pop-up box that'll expose this fake web address. A real link to Apple's website will end in "apple.com" and not some random name or number like the one shown above. To be extra cautious, you should avoid clicking on links in an email and go directly to Apple's website by typing in "store.apple.com" into your web browser. Once you've manually logged into your Apple account, you can then update your billing information, if necessary. [Via CNET]
Dear Aunt TUAW: Help me iMessage my wife
Dear Aunt TUAW, One iMessage "feature" is that messaging can be started on one device and picked up from another device, like from iPhone to iPad. My wife and I share an iTunes account so that we don't have to pay for apps twice, or worry about signing into different accounts. Will sharing an iTunes account across two iPhones mess with our ability to text to each other with iMessage? Thanks! Your loving nephew, Toby Dear Toby, Fear not. Your store account is distinct from your iMessages account. You can create separate Apple IDs for iMessage so you and your wife can pseudo-text back and forth. You will, however, require two email addresses. Select Settings > Messages > Receive At and create a new Apple ID specific to those addresses. Hugs, Auntie T.
Security oversight reduces complexity of Apple ID passwords
One of our readers pointed out a hiccup on Apple's security settings for Apple ID passwords. While Apple ID passwords usually require a mix of capital and lowercase letters, this issue removes that condition. Earlier this year Apple changed the password requirements for Apple ID, the credential for logging into the iTunes Store, MobileMe accounts, etc. Apple ID passwords already had to include both numbers and letters, but then Apple added the requirement of at least one capital/uppercase letter in the password. Existing users who had Apple IDs and passwords already set up were not required to change their passwords, but any new user creating an Apple ID through the iTunes Store was required to use a mixed-case password, as a gesture towards increased security. Passwords with mixed numbers/letters and mixed case are presumably harder to crack than case-insensitive passwords with just numbers and letters. Passwords like that are also harder to remember -- which may reduce their effectiveness, as xkcd pointed out. Capitalizing a single letter also doesn't dramatically increase password entropy, while the simple xkcd scheme actually does & thereby makes your password much tougher for a computer (if not a human) to guess by brute force. While one could argue whether or not Apple's change really helps password security that much, there's no question that it does make things more tricky for data entry: alphanumeric mixed-case passwords are somewhat of a pain in the butt to enter if you forget which letters are capitalized and which are lowercase. Also, entering intercapped passwords on an iOS device is even more of a pain because the extra tap required for the Shift modifier key slows down typing; Apple requires users to re-enter their Apple ID passwords every so ofter after a set amount of time has passed when shopping at the App Store, iBookstore, or iTunes Store on an iOS device, so the password entry dance will be frequent. However, despite Apple's initiative on making an Apple ID harder to crack, its very own password reset tool, iForgot, represents a security oversight. It allows a user to bypass the mixed-case password requirement. Apple ID holders can simply navigate to iforgot.apple.com and start the password reset process: you enter your Apple ID and an email will be sent to your address on file which contains a link that allows you to reset your password. The oversight here is that an Apple ID password created through iForgot doesn't require a capital letter. Now, whether you use iForgot to get rid of mixed case in your password is up to you. iTunes accounts are frequent hacking targets, and the more security the better. However, if those capital letters in your Apple ID really bug you, you now know how to change them. I'd do it fast however. Apple is sure to close this loophole once it's made public. Also keep in mind that if you do change it, you'll need to abandon your current password. Apple doesn't allow you to reset your password (mixed-case or not) to one that was used in the past year. Thanks to reader Phillip for the heads up.
Apple ID account/device limits gain attention
Trevor Sheridan sent us a note earlier today, asking if we'd look at his blog post about encountering Apple ID limits with iOS devices. Although Trevor just now encountered this issue, the policy actually went into effect a couple of months ago, back in June. When you use Apple's new multi-device download feature, you will be limited to a total of 10 devices and computers, each authorized with the same Apple ID. What's more, once a device or computer has been assigned to an Apple ID, it cannot be reassigned for 90 days. Apple's Knowledge Base support article details how you can deauthorize devices, and how to check the wait time before they can be re-assigned. Naturally, this is bad news for anyone who shares an iPhone or other iOS device with a loved one and who switches around the Apple ID accordingly. Once an Apple ID is authorized for media downloads, that authorization is going to stick for a few months at least. At some point, Apple is going to have to start seriously re-evaluating how real life meets Apple ID accounts, in terms of separating data within a family. Some examples: keeping only kid-friendly material on certain devices, even when iCloud backups and data sharing are in force (also known as the "cheating spouse outed by iCloud" scenario), joining data between adults (marriage and cohabitation), and when joint accounts need to be split (divorce and separation). For now, all authorization decisions seem to be motivated more by rights management than day-to-day practicalities. This new policy indicates that Apple continues to be a little tone-deaf when it comes to human relationships and how people really use their iOS devices. Think about the Duggars or the children of divorce; when newly-single Dad buys the kids an iPod, whose account do they get to use? It may seem tangential to drag all this into a write-up about a new Apple DRM protection policy, but these are the real world challenges that make these policies more than a minor annoyance.
Customers with multiple Apple IDs frustrated by Apple's "no consolidation" policy
Since Apple's iCloud announcement, we have received a steady stream of messages from people with the same problem: multiple Apple IDs. Some readers have been managing two Apple IDs on purpose and are now frustrated about the fact that Apple is restricting logins for automatic downloads. Others have only just discovered that they have two IDs. Most of them have already contacted Apple, only to be given the same answer without exception: Apple will not consolidate Apple ID accounts. One of the Frequently Asked Questions About Apple IDs is "I have multiple Apple IDs. Is there a way for me to consolidate them into a single Apple ID?" The answer: "At this time, Apple IDs cannot be consolidated." The optimists will interpret "at this time" as meaning that this could change in the future. The word "cannot" is also open to interpretation. I suspect Apple's intended meaning is "there is no mechanism in place to do this" rather than "it would be impossible for us to do this if we really wanted to." After all, assuming that the apps are still available, it seems like it would be a relatively straightforward matter of "gifting" the apps from one account to the other. However, if that has to be done manually for each person facing this issue, it could be quite time-consuming. I discovered that I had inadvertently created two Apple IDs not long after the iOS App Store appeared. One of the nice things about the App Store has always been that you could re-download purchases free of charge. While checking my email one day, I realized that I had been billed twice for the same application. I contacted Apple's usually excellent iTunes support (since the App Store was brand new, there was no separate App Store support channel yet), and I informed them of the mistake. The customer service person replied that she could not see a duplicate charge and asked me to forward both receipts to her. That was when I realized what had happened. The usernames were identical, except that one ended in "@gmail.com" and the other was the same username, but without a domain name. (You may recall Marco Arment wrote about this problem regarding Instapaper accounts, indicating it was responsible for "[m]any of Instapaper's top support issues.") When I realized what had happened, I contacted Apple support again, asking if they could merge my accounts. The answer I was given was not just "no" but 'absolutely not, under any circumstances ever.' While I am paraphrasing the support rep's response, that captures the spirit of it. I asked nicely, I complained, I sent separate requests hoping to get someone else, and I have asked again periodically whenever it occurred to me to do so. The answer remains a resolute and unwavering "no." Apple has no obligation to take any steps to correct my stupidity. Regardless of how much money the company has made or how much cash it's sitting on, at the end of the day, I am a grownup and responsible for my own actions. Because I did not pay close enough attention to what I was doing, I brought this on myself. [Users with MobileMe accounts that conflict with their Apple IDs may have created them completely without realizing it; see threads here and here. –Ed.] Music purchases through iTunes were easy enough to solve: I upgraded to "iTunes Plus" whenever possible, which removed the DRM. Unfortunately there is no equivalent for App Store purchases. Since I realized this shortly after the App Store opened, I have been able to avoid repeating the mistake and only had to repurchase a few apps. However, my Apple Support Profile shows almost all of my Mac/iOS hardware as belonging to one Apple ID, and all of my App Store purchases belong to the other Apple ID. It is a minor annoyance, at most, for me. Others have not been so fortunate, and with the advent of iCloud, the problem seems to be looming ever larger for some people. Obviously, we have no way of knowing how many people are faced with it, but given the size of the iTunes and App Store customer base, even a small percentage represents a significant number of people. Could Apple change this policy? It would seem so. From the outside looking in, it does not appear to be an insurmountable technological problem, but more one of record-keeping; addressing it would clearly help a small-but-not-negligible number of Apple customers. Do I expect Apple to change this policy? No, I don't. The company seems to have dug in its heels on this issue early on, and I have no reason to think that the policy will change now. We can only speculate as to why Apple enforces this hard-and-fast rule; a strong suspicion voiced by Mike Rose on this topic is that Apple's licensing agreements with content owners (music labels and movie studios in particular) have some sand in the gears when it comes to merging or splitting content libraries. [It's also possible that Apple cannot afford to get bogged down in exception handling and legal vagaries across 50 states and scores of countries when, for instance, a brace of divorce lawyers call and request that a 20,000-song iTunes library be split up between their clients' accounts. Much simpler to have a consistent answer of "We can't do that, sorry." –Ed.] On the other hand, I did not expect Apple to intervene in the Lodsys issue or back down on subscription pricing, and the unveiling of iCloud would probably be the best time for Apple to change this policy--if it ever will. If you think Apple should change this policy, you might be inclined to send a politely-worded message through the proper channels. And, no, emailing Steve Jobs directly is not proper channels. On the other hand, I cannot tell you exactly what the proper channel is. I looked at Apple's Feedback Page, but there is no feedback channel for the App Store, which seems very odd. I also looked at the links for iTunes, iPad, and iPhone/iPod touch feedback, but none of them lend themselves to giving App Store feedback. The Apple ID FAQ does not offer any way to contact Apple about your Apple ID. Nor does the Apple ID support page. Nor does the Apple ID site or the Apple ID recovery page. Finally I found the iTunes Support page, which has a section titled "iTunes Store Account and Billing." If you select that, and then "Managing your Account," that may be the most appropriate route to give feedback. And remember: the person who will read your message will not be in a position to change the policy (even if you did hear that your best friend's sister's boyfriend's brother's girlfriend heard from this guy who knows this kid who's going with a girl who did get her Apple IDs consolidated), so state your case politely and succinctly in order to let your voice be heard, and then move on. If Apple changes the policy, great. If not, well, then you're no worse off than you are today.
Automatic Downloads now live for iOS devices
WWDC has just kicked off for 2011, but you can get a little bit of the Apple iCloud newness right now in the form of automatic Application, Music and Book downloads. Launch Settings on your iPhone, iPod touch or iPad, scroll down to Store and wait for the new options to load (you'll need to be connected to the internet to see them). Once you've checked them, the next time you purchase or download an app, a music track or a book, it'll automatically be pushed out to any device you've activated Automatic Downloads on. Brilliant. Be warned though, if you activate Automatic Downloads for one Apple ID on a device and then attempt to activate another Apple ID on the same device (US and UK iTunes accounts for instance), you'll get a pop-up notification saying: This Device Is Already Associated With an Apple ID. If you turn on Automatic Downloads with your Apple ID, you cannot auto-download or download past purchases with a different Apple ID for 90 days. A screenshot of said warning is past the break. You have been warned.
iOS 4.3 spotlight: iTunes Home Sharing
iOS 4.3 is now available for download, and along with it comes iTunes Home Sharing -- the ability to stream your entire iTunes library to your iDevice over Wi-Fi. Previously, you could use Apple's Remote app to control and play an iTunes installation on another computer, but this is different. With iTunes Home Sharing, the audio from files stored elsewhere actually comes out of your iOS device, so you can listen to iTunes while on your treadmill, or stream a movie to your iPad on the couch. Note that Home Sharing requires an Apple ID, and all of the standard license requirements apply. One fun way to use this: try streaming music out to your dock in the bedroom. Your complete iTunes library is now available anywhere in the house! Home Sharing is found in the iPod settings on your iOS devices.
iOS 4.2 goes gold, available now to developers (updated)
The iPad's ticket to multitasking freedom -- better known as iOS 4.2 -- has moves past the beta phase and onto GM, which means retail units should be seeing it soon. Besides the iPad, Apple is also providing builds for the second, third, and fourth generations of the iPod touch, along with the iPhone 3G, 3GS, and 4... so if you've got a friend with an iPhone Developer Program subscription, now would be a great time to get cozy. Update: Apple made some last minute tweaks that give fast access to brightness, volume, and AirPlay controls right in the multitasking bar (pictured after the break). Apple's also on the verge of allowing MobileMe service logins using an Apple ID. [Thanks to everyone who sent this in]
PSA: FaceTime beta endangers your Apple ID password and security questions
Worried about local hackers? Like leaving your laptop behind in the coffee shop while you take long, leisurely trips to the bathroom? We wouldn't be so self-assured. Turns out there's a gaping security hole in the FaceTime beta, which allows anyone with access to your computer to change your password without knowing it to begin with, as well as peep and edit your security questions and answers. It would be nice if signing out of FaceTime would protect you, but unfortunately the app seems to have a lock-tight memory on your password, so it's easy for anyone to open the app and sign-in again. Hopefully Apple will fix these holes quickly, and until then we recommend uninstalling FaceTime or choosing your friends very wisely.
Apple updates Apple ID site, finally allows editing
Apple has updated their My Info site to allow more Apple ID editing goodness. It's been a while since I've taken a crack at changing any of this information, but last I remember, it wasn't possible to change the actual email correspondence address of one's Apple ID. The My Info site offers a slim, effective UI for adjusting your contact and shipping info, as well as setting your Apple communication preferences (do you want email/mail/phone calls, etc.). Too bad there isn't a new option called "alert me the next time you're about to rev one of your products 15 days after I buy the old 'n busted model."Thanks Brandon M
