Passkey and unlocking 1Password with it (biometrics) in iPhones

Like prime, I'm less worried for myself than for others. I'm also less concerned about violent theft, as there's only so much I can expect from Apple. A duress/honeypot passcode would be nice, but would confuse the masses. And Apple doesn't like offering options for advanced users.

That said, just for @steven1, theft rings have surveilled victims. So I'd add to your warnings that you should turn in a circle as you enter the passcode, so they can't catch the entire thing.

It's wild to me that Apple doesn't even confirm on your connected Watch when someone within BT range tries to change your password! This could all easily be fixed, but they choose not to. So I'll use 1Password to store my passkeys and use the old method to access 1Password.

Would be prompted for appleid email (assume they know this and enter it)

All the person has to do is open the email app and look for emails sent by Apple.

I’m not as worried, my passcode is over 15 characters long and if Face ID fails and I have to put it in, I do it so no one can see me.

I’m more worried about my parents, in-laws, kids, and others who just use a 6 digit PIN for their iPhone password after I tell them it’s not a good idea.

Hi prime

First, if the thief/assailant has both your phone and device passcode, it is pretty much game over.
* This can happen if the passcode is not long and entered in public and you are shoulder surfed. Hence, I would suggest always to use a very long and tedious alpha-numeric passcode and use FaceID/TouchID for unlock as a general use case. In case your phone gets locked, go to a toilet to enter the passcode. Yes, you need to be paranoid.
* If the assailant forces you to reveal your passcode by threatening bodily harm, gunpoijt, etc., same thing, game over (btw, give it to them).
* Given the promiment space most third pary password managers are likely to be on the home screen, the assailant could even ask you to unlock your password manager. One has to expect they will get savvy too...

So...our defense is limited to making it hard for the grab-and-run type of theft to completely upend your life.

In this regard, the ScreenTime passcode does add enough friction to give you some time to prevent total digital loss (remember in this scenario the thief does not have access to your iPhone passcode, at most an unlocked phone). In this unlocked state before the lock kicks in, ScreenTime passcode does the following:
* It prevents them by default being able to view / remove other devices from your iCloud account
* the reddit thread you mentioned is interesting, in that the thief could choose to change the screentime passcode rather than entering it.
* To do this, the thief would
* Choose change Screen time passcode
* Choose forgot passcode
* Would be prompted for appleid email (assume they know this and enter it)
* would choose forgot appleid password
* be prompted to type in the trusted phone number (I wish Apple allowed us to remove trusted phone #s, but atm you need at least one)
* Hopefully, you are using a # that is not the # on the phone, but say a Google Voice number. However, this too is just a speed bump, but not a restriction, because you probably have GV on the phone too, right? (of course, I do as well)
* Once the thief enters the correct trusted number after digging around looking for the trusted #, they then need to approve the apple id password change on another device or using a hardware security key assuming you have the latter set up (you should).

Hopefully, they don't have access to another device as well and you can rush to put the phone in Lost Mode. So in a nutshell, the reddit thread is not quite correct...you can go through the flow yourself without actually changing the password to test it out.

Its tough, given how much of our digital lives are on our phones...

If you want to add another, paranoid layer, carry two phones, ideally connected to different apple IDs. One would not have 1Password and other sensitive apps or email accounts, but it could have some cards added to apple pay to pay for things. If on a different apple id, you won't get the same iMessages, but you can add this phone to your primary # for WhatsApp. Basically, give this phone to an assailant and provide the passcode too. Hopefully they don't search you for the other phone. Your primary phone could be in your backpack while the 'disposable' one is in your hand. If you do this, you could even just leave the primary phone at home if you are out on the town.

Lots to think about...we should each think of our threat model, guess.

@steven1 i just read a post on Reddit how this Screen Time passcode can be bypassed and your Apple ID password can still be changed.
https://www.reddit.com/r/ios/comments/13vtehk/psa_tips_for_hardening_your_idevice_against_theft/?utm_source=share&utm_medium=ios_app&utm_name=ioscss&utm_content=2&utm_term=1

Screen Time Passcode

As has been mentioned here and a few other places, an additional layer of 'passcode' can be added to iPhone in the form of the Screen Time Passcode. Enable Screen Time, set a 4 digt passcode, and set restriction to prevent Account Changes and Passcode Changes.

With this enabled, someone would need to additionally enter this 4 digit passcode to change your iCloud password, even if they have your iPhone and iPhone passcode.

Yes, it is only 4 digits, but it is enforced by the secure enclave, with increasing timeouts for wrong entry. I like to leave it with intentionally entering the wrong passcode, thus triggering the first timeout of 1 minute before retrying (after 6 failed attempts). Each successive incorrect entry with increase the timeout, but of course, at any time you can enter the correct Screen Time passcode to make the restricted changes.

I wish we could enter longer passcodes for Screen Time, but 4-digits it is for now, and may buy you enough time to reset your iCloud Password and remove the device from another trusted device, before the thieves completely lock you out.

Hope this helps.

Was gonna comment, but changed my mine.

I was about to email mailto:passwordless@1password.com about this. Glad prime brought it up. I've been following 1Password's passkeys blog/emails since last year, and throughout that time, this issue was not clear to me. I concur with @luisneto's suggestion to 1P_Dave that 1Password should highlight this shortcoming in Apple's security envelope, as it related to securing our vaults.

1P_Dave, is there no way for 1Password to serve as the "hardware" on Apple devices, rather than simply the storage for the passkey? I trust 1Password any day over Apple's "masses over security" approach.

I've been telling people to refrain from using passkeys until there's clarification on this, so it's good to know. Apple's glib responses to WSJ articles have been concerning. Their most recent security additions show where their focus lies (with careless rather than responsible users):

1. "Recovery Key," like passwords, can also be changed (and enabled) with the passcode and makes it nearly impossible for theft victims to access their accounts.
2. "Account Recovery Contact," helps people who forget their password and passcode, by allowing them to request a code from a trusted contact.

If this is at all unclear to us, the beta-using technophiles on your forums, I think it's unlikely that everyday users will spare 1Password blame when Apple's poor policies get them locked out of their account, and suddenly they lose everything in their 1Password vault also.

bugwhat, based on reading this thread, it appears that the use of a hardware key is unsuccessful in preventing a malicious person from taking control of your Apple account, if that person is in possession of your iPhone and its passcode.

@luisneto

Just a minor correction to avoid confusion: the correct word here is "passcode" 🙂
Indeed, we all know that we shouldn't be using the same password across services, so that if a password is leaked, the attacker can't get into other services/apps.
And yet, unfortunately, nowadays the iPhone Passcode is like a password reused in various places.

To me, passcode is all digits/numbers only. I have alphanumeric, 15ish character long passcode on my phone, so this is why I said password.

You can configure a passcode to be a custom alphanumeric code.

That’s more like a password
I know, but the correct term is still "Passcode" and we should use it to avoid confusion (with the 1Password password, for example).

and you don’t have to reuse it anywhere else.
It looks like I didn't quite get my point across in my analogy. It's not about reusing the Passcode intentionally.
It's about the fact that authentication of Apple passkeys on iOS fall back to the passcode and because of that, the passcode is like a password that, besides unlocking your iPhone, is also reused across all your services for which you have passkeys configured.