0

Simply put, I want to stay signed in to Apple ID on my iPhone 8, but I don't want the contents of my iCloud Drive to be accessible on the phone. At the very least, I would like there to be an additional security barrier to access the iCloud Drive, something more than just having to enter my passcode to get past the lock screen.

At present, it seems like anyone who knows my phone's passcode can open the phone and go directly to Files, then tap "iCloud Drive," and then have direct access to my entire iCloud Drive contents.

The issue is that one other person does have access to my phone's passcode, and I want to keep it that way, but I don't want that person to have access to my iCloud Drive. Touch ID doesn't seem to be available for blocking access.

Have I missed something? Is there nothing I can do to keep my Drive more private? I don't want to stay signed out of Apple ID, that would be inconvenient and disadvantageous for multiple reasons.

Thanks to anyone who knows.

6
  • Why wouldn’t you have the other person sign in to this phone with their Apple ID? You’re giving away too much control here for reasons that aren’t yet clear. I’m sure you have a goal but Apple has likely considered all the advantages to you not sharing your Apple ID / iCloud data with anyone.
    – bmike
    Aug 5, 2022 at 14:20
  • For anything that requires TouchID, you can force the phone to accept your passcode instead [or indeed to add another fingerprint without your knowledge] - so you are not protecting anything if someone else knows your passcode.
    – Tetsujin
    Aug 5, 2022 at 14:35
  • @Tetsujin I don't think that's true, there are several apps I use that have the option to specifically require only Touch ID to open them. Whatsapp is one of them, for example. I go to Settings->Account->Privacy->Screen Lock and there I can toggle it to require Touch ID. I don't see any way to get past that with passcode when I have that option turned on, and if I'm wrong I'd like to see how Aug 5, 2022 at 14:49
  • 1
    @AlbertHolmes - hmm… maybe not for everything. You can do it to unlock the phone - I use this all the time when I've got mine in its 'OverBoard' waterproof case & you can definitely do it to add a new fingerprint. In fact, the passcode is the only way to get into TouchID Settings - so it's still insecure to let someone know your passcode. Would you give the same person your bank details & PIN?
    – Tetsujin
    Aug 5, 2022 at 15:00
  • Knowing the device passcode will be game over when PassKeys ship. developer.apple.com/passkeys It’s already all you need to examine the iCloud Keychain for secrets and make purchases with Apple Wallet and Apple Cash.
    – bmike
    Aug 5, 2022 at 17:01

3 Answers 3

2

The purpose of iCloud is to allow you to access all your files from any device signed-in with the same Apple ID.

What you're asking for would go against the very purpose of iCloud and, therefore, isn't possible.

One option is to use a different service, like Dropbox or OneDrive, to store your files. This allows you to add an additional level of security in order to access these files and it doesn't impact the functionality of iCloud.

The other option is to use iCloud Family Sharing and keep your iCloud Keychain and iCloud files private. Put your second iCloud account on this shared device and it will have different security keys and different files. It will still be locatable and managed and share purchases with your more private “owner” iCloud account.

5
  • Thanks. As I said, I don't necessarily want the iCloud Drive to be inaccessible on the phone. I just want there to be another security barrier beyond just the passcode of my phone. Aug 5, 2022 at 14:19
  • 1
    There isn’t any barrier @AlbertHolmes - your passcode is the key to those files in the Apple ecosystem. You can’t give them the passcode to your device with how TFA and other services are engineered from the platform security design.
    – bmike
    Aug 5, 2022 at 14:22
  • Thanks, not the answer I was hoping for, but it seems to be true. I just don't understand why Touch ID can't be available for iCloud on the phone since I already have the option to require it for several email and messaging apps I use, and I would think iCloud is at least as important/private as those Aug 5, 2022 at 14:28
  • 1
    The solution here is going to be family sharing to make a second account on the limited access phone. Still can use all the purchased apps, has a different iCloud Keychain and iCloud files bucket. By not locking the files, Apple is ensuring you know that the shared iCloud Keychain, medical records, health data, files are all exposed in your “scenario” of sharing a device with your personal data and your passcode with another. Let me know @fsb is I should make a new answer and not pile on yours.
    – bmike
    Aug 5, 2022 at 16:06
  • That's a great point, @bmike, thanks for editing my answer. I personally haven't tried doing this, nor do I know anyone doing it, so it didn't occur to me.
    – fsb
    Aug 5, 2022 at 16:12
0

Well, in the meanwhile, I think I did find a solution to this particular issue with the iCloud Drive. My solution is simply to delete the Files app entirely, which appears to be the only app-based route to iCloud on the phone. Next, I have to put a one-minute limit on the App Store using the Screen Time function. I just have to open the App Store for at least a minute every day, and then after that it will be impossible to open the App Store without inputting my Screen Time code, not the passcode. This will prevent the other person from re-downloading the Files app onto my phone.

This Screen Time function with a separate code, which can set a time limit for any app on the phone, is really the sort of barrier I was looking for -- but it's not ideal, because it cannot be set for 0 hours 0 minutes. One minute is the lowest it can set for. So, if I protect an app with this function, it's not really protected until I've used the app for at least one minute within the same day. Two minutes, actually, because Screen Time allows you to cheat just once, for an extra minute. So, this is a step in the direction of what I wanted, but not that great.

I simply don't see why it would be so hard for Apple to allow iPhones to have a secondary passcode, like the Screen Time code but without the limitations described above, with which the owner of the phone could lock any particular apps they chose. This would give the phone's owner complete flexibility and confidence with regard to sharing the phone with others.

2
  • Apple does not want you to share an iPhone. They want each person to have their own.
    – mmmmmm
    Aug 6, 2022 at 11:03
  • That must be it Aug 6, 2022 at 12:03
0

Apple allows you to manage your devices with MDM. This would be easiest if you disable the App Store or block it before you hand off the device. A free to get started hosted MDM is JAMF now.

You could start with blocking the files app or use the iCloud Documents block feature and then evaluate if you need to also block App Store app.

This would let you still use iCloud and other apps that sync via iCloud would still work and protect your segment of iCloud data by locking the door. If you needed to get at that data, use the MDM to remove the restriction and it will change over the air until you add the restriction back again over the air.


This is less effective than using a different Apple ID for iCloud on that device but if you don’t care about mixing and exposing personal health data, PassKey and iCloud Keychain being exposed on this device and just the files are of concern for your setup. MDM will help you block some of these as well, but I would encourage both the MDM so you can control your devices and possibly mitigate other issues as you discover then or your needs change over time.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .