IMessage password/Apple ID security flaw?

I'm still able to sign into iMessage on my ipad mini using an old password/Apple ID.... Why is this and how do I fix it

Sorry for the old bump.
But my issue similar and a security flaw. If I turn off imessages on my ipad, anyone can turn them on, enter the wrong password, and poof they work.
How is that that I can enter ANY password and imessages works?
Seems not secure at all. If I go on my colleagues iphone, enter my apple id (my email - duh) and the wrong password, it works there too.
How do I restrict this?

Similar Messages

Screen Saver Password Protection - Security Flaw

Although I have always felt OS X has been a solid and secure operating system, there continues to remain one painful, and blatant security flaw. I keep thinking that Apple will address the issue, but they certainly haven't done so thus far.
Explanation:
With any good security policy, and in any secure environment, there will always be a need to "lock" (password protect) a system when not in use. That is, after 'X' period of time, the user interface is password protected so as not to allow access to the system while not in use. This is probably the most common and fundamental security measure in any environment. However, Apple's (GUI) password protection falls short in a number of ways. The only current method of password protecting the user interface is through the Screen Saver. Although at a glance it appears functional, it is a poor design and is easy to disable.
The screen saver configuration lies within two files; the ~/Library/Preferences/com.apple.dock.plist and ~/Library/Preferences/ByHost/com.apple.screensaver.<variable>.plist. It is especially important to note that both of these files are located in the users home folder, which gives them full access to the configuration files. There is absolutely nothing preventing a user from deleting these files, and thus, disabling the only mechanism to password protect the user interface. Giving the user the ability to disable or remove ANY security related configuration is a poor design.
Now initially we thought we had a solution by setting the user immutable flag on the ByHost screen saver plist using chflags. This would still allow user access, but would prohibit them from deleting the ByHost plist. Well, it sounded good in theory. However, if ~/Library/Preferences/com.apple.dock.plist is deleted, you can say goodbye to your password protected screen saver, despite locking the screen saver plist. So naturally the idea occurred to me to set the user immutable flag on ~/Library/Preferences/com.apple.dock.plist. This works, but makes it impossible to modify the Dock. Needless to say, if the Dock can't be modified, there's no point in even having it.
Now that isn't the only thing wrong with the screen saver password protection. You would expect that an administrator could unlock a users (password protected) screen saver, but you would also assume that the user was logged off as a result. Not in this case... If an admin unlocks a password protected screen saver for a user, they are now logged in as that user and have access to everything the user was doing when it was locked (email, spreadsheets, confidential information... anything). This is not the preferred method. If for some reason an admin needs to unlock a password protected screen saver, it should log off that user, not allow access to the user's session.
Finally, the biggest flaw yet. With a recent update, the password protection doesn't even work, as indicated by several people in the following threads.
http://discussions.apple.com/thread.jspa?messageID=2706417&#2706417
http://discussions.apple.com/thread.jspa?messageID=1950444&#1950444
http://discussions.apple.com/thread.jspa?messageID=2648700&#2648700
I have personally seen this issue while developing our corporate OS X image. Despite any fix or workaround, the simple fact that this has occurred is disturbing. ...As if the design wasn't bad enough, it now has the potential to stop working entirely.
Now don't get me wrong, I love OS X and prefer to work on it over any other operating system. Nonetheless, the current design for the "screen lock" is inadequate at best. For a large enterprise environment with stringent security requirements, it's far from sufficient. My hope in posting this is that someone from Apple acknowledges the design flaw and incorporates a more effective solution into the next OS.
MacBook Mac OS X (10.4.6)

One thing I forgot to mention is that "Workgroup Manager.app" is a part of the "Server Admin Tools" which can be downloaded free from Apple. Although it seems to be primarily intended to be used to configure OS X Server from an OS X Client machine, many of its functions can be used to configure the OS X Client machine itself, in the complete absence of OS X Server. Unfortunately, the 'mcx_settings' aren't really "image friendly" - as far as using them on OS X client is concerned, they are something that seem to need to be applied to user accounts individually (although it is possible to copy all of the settings at once so it isn't necessary to go through the whole configuration process for each setting for each user). I have tried tinkering and applying them to groups, but group members don't seem to automatically be restricted (I may be missing something). The "tools" are available here:
http://www.apple.com/support/downloads/serveradmintools104.html
I don't know if it would be any better than the screen saver "hot corner", but there is an option to lock the screen from the "Keychain Access" menu extra, which can normally be enabled through "/Applications" > "Utilities" > "Keychain Access.app", from its "Preferences". This setting is then stored in the "com.apple.systemuiserver.plist" file (ie independent of the "Dock"), but could in principle be controlled from 'mcx_settings' as well. The level of control seems to be incomplete - the user can still drag the item off of the menu bar, but it returns during the next login. However, it does provide convenient access to a method to lock the screen and keychains, and has a nice "padlock" icon so that its function is obvious. It is also potentially possible to assign a two-step keyboard shortcut to the "Lock Screen" item, but it would be somewhat less convenient than a direct key combo...
One other note regarding the "admin" user's ability to unlock the screensaver. The configuration file allowing the "admin" user to do this is "/etc/authorization", under 'system.login.screensaver'. Currently, the "rule" is set to 'authenticate-session-owner-or-admin'. Changing it to 'authenticate-session-owner' would be expected to remove the "admin" user's ability to unlock the screensaver, and if "Fast user switching" is available, the "admin", being unable to authenticate, should be able to switch to the "login window" from the authentication dialogue. I haven't tested this at all in "Tiger", but in "Panther", there was apparently a problem with it (which is why it had slipped my mind since at the time it was rejected as a viable option) - the person who posts here as "LittleSaint" had mentioned some problem with user logins when set up that way but I don't remember what it was, and so can't test if it has been fixed in "Tiger" (not very reassuring, and I apologize). And again, this is a setting that an "admin" would be able to reverse for themselves. Also, should "Fast user switching" become disabled for some reason, and the screen saver kicks in and the user isn't available, it might be a hassle to get back into the machine (it might be possible to do something over ssh). Nevertheless, it might be something to look in to.

I can't change my apple id password because my security answers don't match. It won't give me any other options and just keeps asking for the answers. What do I do?

I can't change my apple id password because my security answers don't match. It won't give me any other options and just keeps asking for the answers. What do I do?

Contact the Apple ID Security site from http://support.apple.com/kb/HT5699 or call the AppleCare support number from http://support.apple.com/kb/HE57 and ask to speak with the Account security Team.

I can't remember my Apple ID password or my security question answers. When I try to reset my password it wants to send it to my e-mail address but I can't get the e-mail because I don't have security answers or the password. How do I reset password?

I can't remember my Apple ID password or my security question answers. When I try to reset my password it wants to send it to my e-mail address but I can't get the e-mail because I don't know my security answers or the password. How do I reset password?

Alternatives for Help Resetting Security Questions and/or Rescue Mail
     1. If you have a rescue email address or a Security Questions issue, then see:
         If you forgot the answers to your Apple ID security questions - Apple Support.
         Manage your Apple ID primary, rescue, alternate, and notification email addresses - Apple Support
     2. Fill out and submit this form. Select the topic, Account Security. You must
         have a Rescue Email to use this option.
     3. This is the only option if you do not already have a valid Rescue Email.
         These are telephone numbers for contacting Apple Support in your country.
         Apple ID- Contacting Apple for help with Apple ID account security. Select
         the appropriate country and call. Ask to speak to the Account Security Team.
     4. Account security issues almost always require you to speak directly to an
         Apple representative to securely establish your identity as the account holder.
         You can set it up so that Apple calls you, either immediately or at a time
         convenient to you.
            1. Go to www.apple.com/support.
            2. Choose Contact Support and click Contact Us.
            3. Choose Other Apple ID Topics and choose the appropriate topic for
                your issue.
            4. Follow the onscreen instructions.
         Note: If you have already forgotten your security questions, then you cannot
         set up a rescue email address in order to reset them. You must set up
         the rescue email address beforehand.
Your Apple ID: Manage My Apple ID.
                        Apple ID- All about Apple ID security questions.

I want to play music bought from itunes on my new computer but apple id is old email address no longer accessible and password forgotten. Security information date of birth also not accepted

I want to play music bought from itunes on my new computer but apple id is old email address no longer accessible and password forgotten. Security information date of birth also not accepted. No good apple sending reset information to old email address as I cannot access it

Welcome to the Apple Community.
The following article(s) may help you.
Moving your iTunes library to a new computer

HT201303 The Itunes store constantly asks me to Improve Apple ID Security by adding three secret questions but won't accept my valid password. I have tried to reset the password, update the billing info and it still won't let me make any purchases.

The Itunes store constantly asks me to Improve Apple ID Security by adding three secret questions but won't accept my valid password. I have tried to reset the password, update the billing info and it still won't let me make any purchases.

I have the same problem - it is maddening. I rely on this iPad for work so this is not just an annoyance! The above solutions of changing the appleid on the device or on the website do not work.
The old email address no longer exists - I haven't used it in a year probably and I no longer have the account. I logged into the appleid website and there is no trace of the old email address so there is nothing that can be deleted or changed there. On the iPad there is no trace of the old email address so nothing can be deleted there either. I have updated the iPad software and the same problem comes right back. Every 2 seconds I am asked to log in using the old non-existent email. The device is currently useless.
The only recent change to anything was the addition of an Apple TV device, which was set up using the correct login and password.
Does anyone have any ideas? The iPad has been backed up to the iCloud so presumably it now won't recognize the current iCloud account? So restoring may notbe an option?

Would like to recover my old Apple File Security password

Hi,
Here is a continuation of a prior problem. Several years ago I encrypted some Appleworks WP files using Apple File Security while using OS 9. I now have a fully functional Classic available on an iMac G5 (OS10.4.4) (thanx to forum respondants) and I have discovered that I must have used a different password to encrypt them than I thought I have always used for everything. Initially I didn’t care but actually they do represent some legal issues of the past that if it was feasible to recover the password for I would appreciate the opportunity. If this requires advanced skills forget it, I don’t have them and if there is illegality involved forget it since I have no desire to do that either. I have seen them in their encrypted format so I know they are there. Just obviously not readable. Thanx.
iMac G5 Mac OS X (10.4.3)

Spock,
Unfortunately, I don't know of any crack for resolving this. Files that come out of Apple File Security are actually encrypted and compressed. I have a feeling that the password used is actually used as the encryption key. This is rather than just a simple security barrier in the Mac OS to prevent access by Mac applications.
I'd even hoped that as the documents are WP docs, a disk scanning program - or Terminal in Mac OSX - could rescue the contents, but as they're compressed, you've had it.
If it was me and my files, I'd try to find out more about the compression and encryption algorithms used by Apple File Security in Mac OS 9 (and maybe Mac OS 8) documentation. And then try to force decryption using Unix tools on your whizzy new iMac, ie. trying every word in a dictionary between 5 and 8 letters as the password would take a few hours of CPU.
A moot point if you know that your password choices are designed to specifically not appear in a dictionary, ie. contain numbers, etc.

How can I reset the apple Id security passwords?

How can I reset the apple Id security passwords?

The Three Best Alternatives for Security Questions and Rescue Mail
    1. Use Apple's Express Lane.
          Go to https://expresslane.apple.com ; click 'See all products and services' at the
          bottom of the page. In the next page click 'More Products and Services, then
          'Apple ID'. In the next page select 'Other Apple ID Topics' then 'Forgotten Apple
          ID security questions' and click 'Continue'.
     2. Call Apple Support in your country: Customer Service: Contact Apple support.
     3. Rescue email address and how to reset Apple ID security questions.
A substitute for using the security questions is to use 2-step verification:
Two-step verification FAQ Get answers to frequently asked questions about two-step verification for Apple ID.

I am trying to change the apple id password and the security questions don't seem to be right. How can I get by the security questions?

I am trying to change my apple password and it asks me 2 security questions. The answer I gave are apparently not correct. How do I get past this step?

For Forgotten Security Questions / Answers...
See Here > Apple ID: Contacting Apple for help with Apple ID account security
Ask to speak with the Account Security Team...
Or Email Here > Apple Support iTunes Store Contact
More Info > Apple ID: All about Apple ID security questions
Note:
You can only set up and/or change a Rescue Email Before you forget the questions/answers.

I want to reset my Apple ID security questions because it is old Apple ID. I know all of the passwords, but I do not know the security questions.

I want to reset my Apple ID security questions because it is old Apple ID. I know all of the passwords, but I do not know the security questions.

See Kappy's great User Tips.
See my User Tip for some help: Some Solutions for Resetting Forgotten Security Questions: Apple Support Communities https://discussions.apple.com/docs/DOC-4551
Rescue email address and how to reset Apple ID security questions
http://support.apple.com/kb/HT5312
Send Apple an email request for help at: Apple - Support - iTunes Store - Contact Us http://www.apple.com/emea/support/itunes/contact.html
Call Apple Support in your country: Customer Service: Contacting Apple for support and service http://support.apple.com/kb/HE57
 Cheers, Tom

Reset my apple id security password

Hi,
I havent used my apple ID for a long time and now i tried to purchase apps and after that it asked me the security password and I dont remember the aswer is there any way to reset this?

Apple ID security issues -
Call Apple Care for your country and ask for the Account Security Team. They can assist you with your issue.
http://support.apple.com/kb/HT5699

My mom forgot her apple id password and also security

my mom forgot her apple id password and also security questions , the mail is the same as the icloud *********@icloud.com so even when we are trying to reset password we cant log into the mail

Alternatives for Help Resetting Security Questions and/or Rescue Mail
     1. If you have a valid rescue email address, then use this procedure:
         Rescue email address and how to reset Apple ID security questions.
     2. Fill out and submit this form. Select the topic, Account Security. You must
         have a Rescue Email to use this option.
     3. This is the only option if you do not already have a valid Rescue Email.
         These are telephone numbers for contacting Apple Support in your country.
         Apple ID- Contacting Apple for help with Apple ID account security. Select
         the appropriate country and call. Ask to speak to the Account Security Team.
     4. Account security issues almost always require you to speak directly to an
         Apple representative to securely establish your identity as the account holder.
         You can set it up so that Apple calls you, either immediately or at a time
         convenient to you.
            1. Go to www.apple.com/support.
            2. Choose Contact Support and click Contact Us.
            3. Choose Other Apple ID Topics and choose the appropriate topic for
                your issue.
            4. Follow the onscreen instructions.
         Note: If you have already forgotten your security questions, then you cannot
         set up a rescue email address in order to reset them. You must set up
         the rescue email address beforehand.
Your Apple ID: Manage My Apple ID.
                        Apple ID- All about Apple ID security questions.

HT5787 I forget my apple ID security Questions ,how can I change ID password ?

I Forget my apple ID security Questions, How can I change ID password ?

See Kappy's great User Tips.
See my User Tip for some help: Some Solutions for Resetting Forgotten Security Questions: Apple Support Communities https://discussions.apple.com/docs/DOC-4551
Rescue email address and how to reset Apple ID security questions
http://support.apple.com/kb/HT5312
Send Apple an email request for help at: Apple - Support - iTunes Store - Contact Us http://www.apple.com/emea/support/itunes/contact.html
Call Apple Support in your country: Customer Service: Contacting Apple for support and service http://support.apple.com/kb/HE57
 Cheers, Tom

HT4623 I started the iOs 7 update in my mini iPad yesterday and it froze the screen at the area "Create a Password" at the Apple ID Security area where it asked to add a security question. It just stopped and I can't go anywhere else. What's up with tha

I started to do the latest update to iOS7 in my iPad mini and it froze the screen at the area Apple ID security where it asks for "Add Security Question". I press the next icon, and nothing happens. The screen is frozen there and I can't get out. I can go no further forward nor can I be back. It's just stuck. This has rendered my mini iPad useless. What can I do?

rvalezin wrote:
If I need to back-up every hour of my life in order to be able to save everything from something like this I won´t do anything else.....at least we should be able to trust that Apple tests this updates so situations like this won´t happen.
That's exactly what Time Machine does for you. It backs up every hour, so you don't have to. While it is backing up, you keep on working. Time Macvhine came with your Mac and you chose not to use it.
The 10.7.4 update did not cause your hard disk to fail. Hard disk fail due to mechanical causes. They are extremely reliable, but that doesn't mean every hard disk will last a long time. Your mileage WILL vary!
If you are dependent on your computer and the data stored on it, then you should make sure you have AT LEAST two copies of all data and probably three or four. You should use at least two means of backing up in case the backup software has a problem. And you should consider having a backup computer if you live in an area where replacement takes too long (whatever too long is for your business).
Apple hardware and software is very, very good. You have documented your experience of this. But NO hardware or software is perfect. You also have experience of this.
It is YOUR responsibility to ensure that your system is set up to protect your data and availability of computing resources.

HT204161 I have forgotten everything about my apple ID, password, answers to security questions, etc... WHAT DO I DO????

I used my apple ID to activate my iPod, but I no longer can access that apple ID... And as long as I don't get my apple ID, I can't access my iPod... What do I do??? and I don't want to pay 35$ to call Apple Support......

Forgotten Security Questions/Answers
You need to contact Apple by:
1 - Using this form
Apple - Support -form iTunes Store - Contact Us
2 - Call Apple in your country by getting the number from here:
http://support.apple.com/kb/HE57
3. Contact Apple by:
Apple ID: Contacting Apple for help with Apple ID account security
For general information see:
Apple ID: All about Apple ID security questions
And maybe:
Is there a way to find my Apple ID Name if I can't remember it?
Yes. Visit My Apple ID and click Find your Apple ID. See Finding your Apple ID if you'd like more information.

IMessage password/Apple ID security flaw?

Similar Messages

Maybe you are looking for