> In an earlier attempt on Tuesday to change an AppleID password (which is the same password used to log into iCloud and iTunes), Apple customer service offered up a different response, saying that passwords could only be changed over the phone if we were able to supply a serial number for a device linked to the AppleID in question — for example, an iPhone, iPad or MacBook computer.
Adding (or worse, substituting) a serial number helps, but seems insecure in the event of a lost/stolen phone. A device serial number, plus all the already mentioned info: name, address, last 4 characters of a credit card, are all reasonably easy to extract from a stolen phone. Would be nice if some piece of info not usually stored on a phone were required. I suppose that a lost phone is already a security breach, but any containment would be an improvement.
On many Apple devices, the only way to access the serial is to actually log into the device and open Settings or About this Mac. If the attacker's able to do that then – in the majority of cases – they likely already have access to your mail and probably many other accounts as well. At that point, it's pretty much game over for you; containment's impossible.
(Two big loopholes on the Mac side are guest accounts and the recovery partition. Both of those offer ways to get your machine's serial number which do not require the attacker to log into your account.)
Giving out that sort of information would change some amount of people from just buying now to waiting for the new product. That's nice from a customer standpoint but bad for Apple.
Consider:
1) Less outdated inventory moved.
2) More problems keeping up with new product demand, which Apple already can't do.
3) More customers think about the question of buy now or wait when making a purchase. This doesn't sound like a lot, but Apple strives for the simplest possible buying experience.
"Please don't post on HN to ask or tell us something (e.g. to ask us questions about Y Combinator, or to ask or complain about moderation). If you want to say something to us, please send it to info@ycombinator.com."
Adding (or worse, substituting) a serial number helps, but seems insecure in the event of a lost/stolen phone. A device serial number, plus all the already mentioned info: name, address, last 4 characters of a credit card, are all reasonably easy to extract from a stolen phone. Would be nice if some piece of info not usually stored on a phone were required. I suppose that a lost phone is already a security breach, but any containment would be an improvement.