14

A notification about resetting my Apple ID password appeared randomly on my iPhone:

Reset password notification

I'm alarmed that this means somebody is attempting to break into my Apple account.

If I follow the notification, it just gives me an option to "Don't Allow" or "Allow":

Reset password allow or dont allow

I didn't select either option, and instead reset my phone - which made the notification go away.

To be safe, I updated my Apple ID password (on appleid.apple.com).

What prompted this notification, and do I need to be concerned about the security of my Apple ID?

Improve this question
1
  • Just wanted to note that I received this this morning as well. Looks like someone trying it with leaked data or something.
    – Tom A
    Commented Jan 4, 2020 at 15:17

1 Answer 1

Reset to default
12

What happened?

This is actually a widespread issue that was reported by others on macrumors' forums yesterday. Likely we'll see this happen to more and more iPhone users.

This Twitter Thread explains that there is a security flaw in Apple's password reset process which gives explicit confirmation once a correct phone number is inputted for a given Apple ID.

It shows a failure for an incorrect number:

enter image description here

And triggers a notification to your devices for a correct number:

enter image description here

This notification is what caused your iPhone to prompt you to reset your Apple ID password.

What does this mean?

  • Your Apple ID was not broken into.
    • It's good practice to update your passwords periodically anyway.
  • An attacker now knows your Apple ID and corresponding phone number.
    • I'm not certain what they'll do with this information, but it's valuable.
Improve this answer
5
  • 1
    This vulnerability still exists as of 2021-04-23
    – nine9ths
    Commented Apr 23, 2021 at 23:21
  • If an attacker knows my Apple ID and phone number combination, then he/she can trigger this notification at anytime. Changing my password will not prevent this.
    – Ely
    Commented Nov 17, 2021 at 10:47
  • @Ely correct. Do you think this needs to be clarified? Are you experiencing an issue where you get this notification repeatedly and you’re looking for a way to stop it?
    – JBallin
    Commented Nov 17, 2021 at 14:42
  • @JBallin Happily I'm currently not receiving this spooky notification repeatedly (knocking on wood), but I was wondering what I could do to prevent this. It seems that only changing your phone number or Apple ID email address (both are possible) will get you (temporarily?) from the 'attackers list'. It would be great when Apple gives more info about the origin of a particular password reset trial, instead of only advising to change your password as a precaution, which is a very time consuming job if you have a lot of Apple devices and services.
    – Ely
    Commented Nov 18, 2021 at 16:20
  • 1
    @Ely there’s no reason for attackers to run this repeatedly after they confirmed your info. IMO Apple needs to stop confirming which info is correct.
    – JBallin
    Commented Nov 18, 2021 at 17:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .