Why is Apple telling me to change my password after receiving a password reset email?

Question

I received an email telling me that someone requested a password reset for my Apple ID.

Dear ___,

You recently made a request to reset your password or unlock your Apple ID. Please click the link below to continue.

Reset Password or Unlock Apple ID >

If you did not make this change or you believe an unauthorised person has accessed your account, go to iforgot.apple.com to reset your password without delay. Following this, sign into your Apple ID account page at https://appleid.apple.com/gb to review and update your security settings.

Sincerely,

Apple Support

The part highlighted in bold seems to be saying that I should reset my password. Why?

Here is my general understanding of password reset procedures:

1. Someone requests a password reset (any person can do this for any account)

2. An email containing next steps is sent to the account holder's email

3. The email from step 2 is required to actually perform the password reset

Therefore, unless my email is compromised (which I have no reason to believe), there is no reason to think my Apple ID is at risk, based on the information provided so far. Right?

I also asked @AppleSupport about it on Twitter:

And so they said:

If you did not request this change, for security reasons, update your password.

Given that anyone on the internet can request a password reset for any account, and given that to do so is futile without access to the account holder's email, what security reasons could Apple possibly talking about?

An example of why I think this could be a silly suggestion, let us suppose somebody wanted to annoy somebody else: all he would need to do is send repeated password reset requests. Should the recipient then feel obligated to change his password each time, "for security reasons"?

So, why is Apple saying that I should change my password? And if the answer is "security reasons", what are some examples?

Answer 1

I'm not sure this question is actually on-topic here because you're effectively asking why Apple does something? That said, I offer this answer in the event it is kept open, and because I have worked in the IT Security field.

At the outset, I'm assuming that the email you received was a genuine email from Apple and not a phishing attempt.

The reality is that if someone other than you has requested a password reset, then you should assume they are up to no good. And, if that is the case, how many of your other online services are they also trying to access/reset?

Unfortunately, many online users use the same password for many accounts. And this vulnerability is the number one way that hackers (etc) breach accounts. For example, you would have heard of the iCloud leaks of celebrity photos (known as The Fappening) that occurred in August 2014. While at first it appeared that the fault was somehow related to Apple's iCloud services, after an investigation Apple stated:

The leaked images were the result of compromised accounts, using "a very targeted attack on user names, passwords and security questions, a practice that has become all too common on the Internet". None of the cases we have investigated has resulted from any breach in any of Apple’s systems including iCloud® or Find my iPhone.

Source: Apple Media Advisory

This highlights why Apple would want you to change your password. Say you were being targeted by someone, by obtaining your password from one site they know there's a good chance you've used the same password on another. And if someone has deliberately tried to reset your Apple ID password, then from a risk management perspective you have to assume they've also tried accessing some of your other online services.

So, by Apple telling you reset your password on their service, they are trying to help you manage that risk.

Unfortunately, it's often not just the same password people use on their accounts, but the same security questions, the same recovery emails, etc. So, resetting your password is an excellent precautionary measure to take.

Finally, by Apple stating in their email to reset your password without delay, they are exercising their duty of care and this would be very important in the event of a breach and/or subsequent legal action.

Answer 2

The thinking is that most likely this isn't a prank and that it means somebody is trying to gain access to your account. While I agree it's unlikely somebody will get into your account I can see why Apple recommends this for the masses.

I would assume this happens mostly because of typos (especially if you have a common name) such as using @gmail instead of @hotmail etc. but you can't be too careful these days.

This could also be hackers trying to confirm active accounts.

Assuming you have a strong password and 2 step verification on, you should be ok. It's advised to change your password periodically anyway, so if you haven't done that in the past few months I would.

It's a personal decision but for the masses (who mostly have weak passwords) I would recommend they change their password (just like Apple has).