I would've preferred that the identifying information of the person had been edited out.
The phone's owner experienced a traumatic incident. Which furthermore is under investigation.
Posting some kind of photo feels OK, however, since finding the phone is arguably newsworthy. And the Twitter poster says that it was open to that email, suggesting that they didn't go snooping through the phone. A little privacy redaction/cropping would've helped.
It's crazy to me that the phone hasn't locked automatically. Do people really walk around with their phones set to never lock and turn the screen off? Mine times out after 5 minutes.
I disable auto-lock. The primary reason for this is that I’m extremely intentional about using my phone. If I have some content open, I don’t want the screen turning off.
This is an atypical choice, but I always lock when I’m done and don’t encounter any issues from this choice.
I do the same. I make sure to use FaceID, though.
I also almost never use apps like dedicated banking apps or social media apps; instead, using Safari.
I know folks that don’t lock, and don’t use Face/Touch ID, because convenience (or paranoia).
I’m not sure that’s a good idea. We have our whole lives in these devices, and they could do a lot of damage.
There’s an old movie, called Taking Care of Business[0], where Jim Belushi finds Charles Grodin’s date planner, and takes over his life.
[0] https://en.m.wikipedia.org/wiki/Taking_Care_of_Business_(fil...
Nearly every bank I know of recommends using apps over their website, since in general they're safer than using their websites. But I'm in The Netherlands and I don't know whether banking apps in different countries have the same security standards.
I solve that, by not doing banking with my phone.
Social media and store loyalty apps are basically just PID harvesters.
In fact, I have a couple of solitaire games that are constantly nagging me to join leaderboards and take community challenges.
All my financial transactions are done with my Mac, which sits behind a fairly robust home network.
I know, for certain, that banking apps are the #1 first target, for hackers.
Where I live having the app for 2FA is mandatory for online banking unless you can convince them to give you a hardware TAN generator. So transferring money is actually much less convenient in the browser because everything I do has to be confirmed with my pin in the app, so I might as well just do it in the app directly and only login on one device instead of two.
Of course this is actually "phone factor authentication" and not two-factor authentication, but I kinda need a bank account.
With a touch login on the phone and (say) google authenticator IMHO it's considerably less inconvenient to login into something online with the desktop than what Chase does to me. The phone is sitting right there anyway, and 6 digits to type in by hand is not that big a deal. I do it all the time.
Basically the phone is the 2FA generator.
Does "the app" mean the site's app?
Ugh. Sorry to hear that. I use 1Password for TFA, and I haven't had to use an app.
When I first run an app, and it asks for access to camera, microphone, photos, calendar, contacts, and location, I tend to immediately plonk it; regardless of its purpose.
I have a PMB, and the store has an app that uses the phone to unlock the door, after hours.
There is a keypad, but that hasn't actually worked, in months, and the store has ignored my reports.
I just go there, during business hours, even though it's inconvenient.
I just recently started a job that uses 1Password, which I've used personally for years, but they also recommend the 2FA built into 1Password. It's incredibly convenient, and I "know" it's as secure or more secure than using my phone, but man I just haven't been able to get over that mental hurdle of putting all my auth eggs in that 1Password basket.
My bank has a similarly unhelpful approach, but at least the SMS code expires, and my phone never sees my bank password at all.
Even though some scum corps like Chase make it a PITA to manage my account from a desktop through firefox, that's the only way I'm going to interact with them.
"Download the app!"
Hard no!
In fact these are the only apps I think that appear regularly on my phone, but only when I'm traveling: AirBnB, Uber/Lyft, and whatever airline I'm currently flying on next. I think if I'm crossing borders I've installed whatever gov spyware makes TSA/Global Entry easier. They're already groping me hard, why not.
LA Fitness gets to stay because it's dumb and silent. I don't see anything else not security related. On mobile I talk to the outside world with K-9, firefox, signal, whatsapp, sms. I'm happy.
I don't use Chase in the US, but I had issues with firefox and some financial websites.
My fix was to create an entirely new profile, with no customization, no cookies restrictions, no add-ons, and use it only for financial sites.
I then exit my current FF, and switch to it, and back again.
All my issues vanished after doing that.
You could also create a different user in Linux, and isolate that way.
Hope it helps.
FWIW, you can also run multiple profiles simultaneously. They are independent processes, sharing no resources or permissions.
This is my model for difficult sites. If I'm really concerned, I use FF network config to allow access only to the domains I think are proper.
Although in the case of banking, I prefer to use the official mobile apps. Some are actually pretty good. Others are awful. But I trust the iOS app sandbox and I trust my banks.
I also block traffic at the network level, so if the bank app attempted something egregious (e.g. tracking via the basket of Internet deplorables), it would fail.
I use Chase on my phone and desktop (Brave, not FF) and have noticed zero issues doing anything on the desktop.
That is probably true because phones are less susceptible to keyloggers or evil browser extensions, but "security standards" have approximately nothing to do with it beyond "using HTTPS".
The security model for US banks is that it's illegal to do crimes to people's bank accounts. It doesn't involve "super secure apps", bank account numbers and credit card numbers are super insecure and there is little reason you should care about this insofar as you're not liable for leaking them.
This might be true for credit cards but for the vast majority of people, even completely irrespective of income, getting your checking account number leaked to a nefarious party can absolutely cause you a hell of a lot of trouble.
Credit cards will give you the benefit of the doubt with a credit while they investigate. Banks (and credit unions) are going to be VERY hesitant to give you a 5-figure advance into a new checking out while they investigate how your account got drained when it initially looks like you did it. Even the most pro-customer policies practicable won't help when now all your automatic payments start failing. It's certainly a recipe for ruining your week and you'll likely spend the next month or two dealing with the fallout, and that's assuming you don't face crippling financial penalties because of it, which the majority of Americans would.
The difference is that with an app, the server can ensure it's running on a safe non-compromised/jailbroken device using remote attestation (Play Integrity, App Attest).
With a web browser, there's no way of doing that by design as the user has full control over their user agent, so you need to trust the end user is following good security practices and hasn't allowed their user agent to become compromised.
However, in the EU, banks are legally liable for financial loss caused by unauthorised transfers, so they are increasingly not willing to trust that the user hasn't just loaded their browser up with malicious extensions and malware.
> as you're not liable for leaking them.
But it's fun when you get your checking account drained, and it takes weeks to get it back.
I've seen that happen to a couple of folks.
That's also why I don't like to link my account to sites like PayPal and Venmo.
If you use email apps, you might as well be using banking apps.
If they have access to the recovery email and your phone then they have the keys to the house anyway.
The idea of our lives being in/on our phones, is an animating plot mechanism in Accelerando( by Charles Stross: a tech executive loses their <device> and is unable to function, most memory and executive functions having been delegated to it; and a kid who finds it, becomes correspondingly empowered.
Precisely. I’ll choose when to lock the screen - what if I’m using it to read a recipe, or looking up documentation, or I have a map on screen? Etc etc.
It seems like you should still have an auto lock to 30 minutes? Events way less drastic than an airplane door blowing off can cause you to not be able to lock your phone, like someone just snatching it out of your hand on the subway (where in theory they could keep it awake indefinitely with a 30 minute timeout but they very probably won't)
I think the phone thieves have figured this out by now and will keep it unlocked even if it's a 30 seconds timeout.
The maximum on iOS is only 5 minutes, and I regularly leave my phone untouched for longer periods than that while cooking.
I hear your point, but everything really important on my phone is behind another wall of passwords/pin protection, and I am meticulous about backups. The physical device doesn’t matter much. I’ll put it on stolen mode remotely, force an email sign out, and just assume it’s dead because they won’t be able to turn off Find My.
I also work from home, so I’m more suited to having it in this mode of operation.
I've had phones for close to a decade now (Moto X 2014) that can detect when I'm looking at the device and extend the timeout. So if I glance at the device every few minutes checking on the recipe or a map or whatever it'll keep the screen on indefinitely.
iOS has “Attention Aware” features but these features don’t account for atypical use cases like when I’m running some persistent app that needs foreground use (like a firmware update on an IoT device) that I can’t be bothered to stare at.
I use Guided Access Mode for this.
Same here. I get irritated when I see people put down their phone without locking it, only to realize theirs will auto-lock.
That said, from now on I'll probably have auto-lock turned on when flying.
If your phone unexpectedly ends up on the ground in the middle of a flight, auto-lock is the least of your problems.
Possibly, given people are (to some level of course) basically fine, having someone walk off with your phone unlocked could have pretty annoying consequences at a time when you'd really rather not deal with them
I hate that the maximum for auto-lock is 5 minutes. I wish you could set it to 10 or even 30. but it's 5 minutes or never.
Guided access should give you some help there.
This seems crazy, from a security point of view, even just basic level, like my kids walking off with it
Hmm, I live alone and I don’t leave my phone unattended. I think it’s important to consider your risk profile before changing any security settings. With kids, I would probably adjust my threat model to prevent accidental changes to things, etc.
Quick data point that Samsung Android phones (at least the ones I've used for the last many years) unlock with fingerprint on the side which is as close to a zero-effort unlock as you can get.
I have Face ID enabled etc, but it doesn’t change the fact that it’s annoying. If I’m alone at home with the door locked, there is an infinitesimally small chance of any security issue that would render my device compromised. So realistically, I’m accounting for my own sanity + convenience here.
I try to avoid modern Boeing aircraft as well.
I'm in the same boat. I disable auto-lock. However, it would be nice to have a setting for 30 minutes or an hour, but thankfully my battery will die before that's needed.
If someone grabs your phone, welcome to issues. Or you drop your phone when distracted by something. Both unlikely, yes but not impossible. Similar to wearing a seat belt.
I found someone’s Apple Watch that had no password. I could have done a ton of nefarious things if I’d been inclined. Had a different person picked it up, they might have had all their accounts hijacked.
I sometimes do it when I have to use my phone with gloves or in the rain (temporarily)
My phone has the fingerprint sensor. I don't use faceid.
Lineage OS has this cool feature called "Caffeine" which is a quick settings button. When tapped, it temporarily increases the lock screen timeout. Pressing it again increases it more. Long pressing it will make it infinite. It will reset once the user manually locks. I find it quite useful in cases like reading
As a rule, if the security feature creates even the slightest bit of inconvenience when using the device, you can bet your bippy that about half the user population will turn said feature off.
Some people install dumny seat belt defeat devices.
Or ride with the damn bell ringing the whole time.
I have a co worker who I won't ride with anymore simply because of that.
Would it help if in addition to the bell ringing, cars would start to let out some very nasty odour? Could help with the deaf and the noise ignorant.
Or maybe a speed limiter. You can’t go over 25mph until the seatbelt is fastened. That would let people move a car in the driveway or something minor, but force them to buckle to get on most roads.
There was a death at 20mph around our area though, because of no seatbelt. It was specifically shown at the course to attain the driver's license.
It was also a choice; life is full of risks, having stuff (or even worse, other people) decide for me which I should prioritize drives me bonkers.
The same person who's super disciplined about seat belts likely takes other risks that another person would deem at least as serious.
Having an optional reminder feature is great; forcing it, not so much.
Unfortunately, not wearing a seat belt isn't a risk borne just by the one in the seat. There have been cases of people flying out of their window and battering someone with their body due to not wearing a seat belt. Of course, everything carries a risk of harm to someone else, its a matter of where to draw the line.
Yeah, but these are people in the same car who are very likely in agreement about whatever risks.
You misunderstand, its the person in the car you hit that would be knocked by the flying driver.
Really, that's the risk you're telling yourself you're preventing by bossing other people around?
We already legally force it in almost every state on public roads because it's not about you, it's about everybody else minding their own business getting killed by your choices.
Doesn't take much FOD on the highway for your unbuckled body to slam into something and now you have a driverless vehicle. Also every else in your car should be bucked too so you're not bumping noggins.
I find this line of reasoning extremely far fetched.
Is this how far you're willing to go to boss other people around to fit your preferences?
How fast was the other car going?
Limiting speed (below highway speeds) can be incredibly dangerous. Not being able to merge at speed is a non starter.
This is a non issue if putting on the seat belt fixes it.
See, now you're using the seat belt as an excuse to not avoid other risks.
Avoiding a car crash in the first place would definitely be the better alternative.
I always put my seatbelt (feel naked without it), but I deactivated the ringing in my car, otherwise it's annoying if you have a bag on the passenger seat.
Sir, mother in laws should be spoken of with more respect.
It’s definitely due to either abject stupidity or a lack of understanding. Some people just can’t technology
A more charitable take: they've decided to risk of theft/loss isn't worth the inconvenience.
I don't keep anything useful on my phone, there's no reason for me to lock it and every reason not to.
The tweet said there was a broken off charging plug still in the phone. Maybe that kept it unlocked?
Unlikely, as plugging in a charger cable without electrical power has no effects on an iPhone.
a ripped cable might sort pins which might confused that logic. it's probably in connected mode but showing something like insufficient amps.
simpler explanation, it's 2023 apple code...
Some of us intentionally disable autolock - I know I have it off because I can’t stand the screen automatically turning off on me when I’m using it for reference material.
Can't you set it to only auto-lock when not on your person, near you or at place X, Y or Z? Seems there are so many options for targets to keep it unlocked (smartwatch, a place, movement, WiFi, ...) that disabling it seems unnecessary?
Most people don’t expect their phones to be sucked out of airplanes.
Most people don't expect a stranger to post photos of their phone's screen on the Internet either.
There are an almost limitless myriad of "Most people don't expect..." which is why security features are important.
Being thoughtful is also important. I can think of no reason for anyone to share an innocent stranger's details on the Internet.
The fact that it was pulled out of the plane (and didn't stay snug in its owners pocket) suggests it was being used at the time, and thus unlocked. And yeah, I tend to set my phone to never lock at times, probably not while traveling I guess, but it absolutely happens.
Although it may well have been reconfigured, by default iPhones will lock up after a short inactivity.
Yes, I know, that's what the second part of my comment was theorising about.
I agree. I see a lot of comments about “being intentional about using the phone” but in those cases the phone doesn’t lock anyway… using maps or watching something prevents auto lock. It just makes no sense at all to disable it.
It’s not true if you’re looking at sheet music in Safari while playing an instrument for example, or looking at engine assembly diagram while working on an engine with greasy hands.
That's true of video playback, it's not true for other apps I want to keep open without the phone auto-locking. People making those comments aren't like lying or delusional, they're just using different apps.
I set mine to lock and auto-turn off after a short moment.
Nonetheless, I have found that the phone will sometimes get in a state or screen which prevents autolocking. It does this usually at the same state or screen but it's easy to trigger accidentally without noticing.
...just pull down the top bar. That might happen if you're holding your phone and it gets sucked out of your fingers. Or stolen right out of your hand.
The autolocking fails is why I wish I could lock my whole photo library behind an additional layer of unlock instead of just the hidden album.
My auto-lock is set to 30 seconds, and I still manually lock it any time I put it down instead of waiting. I often see people put their phone down or in their pocket with the screen still on, and it just sits there for several minutes. It’s a pet peeve of mine. I have to assume these are the same people who complain about battery life all the time.
my dad does this, and now complain his early-gen oled phone screen has terrible burn-in. it's not like I warned him since day one...
Phone locks are mostly a protection against accidental loss (self inflicted or stolen).
But sometimes that's not worth the hassle. E.g. I disabled locks while my car was running.
The tradeoff is IMHO well worth it as I immediately take the phone from the car should I leave. So the overall risk is minimal. Yet should it ever distract me then that's a big issue.
And not being reachable was also not an option given family circumstances at that time.
It's just a risk vs. benefit tradeoff. And that's a very personal judgment call.
It depends on your settings I guess. I'll put my phone down on an app only to find out half and hour later it's still open.
Maybe they did this to help the phone find it's owner?
I imagine this will end up in an NTSB evidence warehouse for years.
No it won't. They'll log where it landed and that's about it.
What kind of of evidence do you think it has on it?
In prior incidents, I have heard it takes years before belongings left on the plane are returned. Devices sucked out of the aircraft seem like they would be more relevant than other items.
49 CFR § 830.10 appears to be one of the regulations on the subject [1].
[1] https://www.law.cornell.edu/cfr/text/49/830.10
While "that would be stupid" doesn't reliably keep government officials (or companies) from doing that thing, not returning the phone promptly would be a really dumb move. They're not going to learn much from the device, and a phone is something that is incredibly annoying to lose for any amount of time.
If they keep it and it becomes known, people who e.g. took videos of incidents would become reluctant to come forward and share them, worried that the government might want to take the phone that recorded the video. They'd lose a lot of useful evidence in future cases, on top of the terrible PR it'd be.
Edit: The agency also relies a lot on the goodwill of the public. Investigations work a lot better when school teacher Bob, finding an aircraft piece in his back yard, contacts the NTSB and tells them to come get it, rather than deciding to quickly bring it inside and turn it into a coffee table later. And public perception can totally make the difference between "this might help them, let me call them immediately" and "screw those guys, it's mine now, will make a really nice coffee table".
I wouldn’t pretend to know what the NTSB considers potentially useful. I would expect them to prioritize anything that could remotely help an investigation over getting an iPhone quickly back to its owner.
Accelerometer and pressure readings could be useful.
This assumes they are recorded and kept. Which is a wrong assumption.
At best it may have recorded a high number of down steps in an health app because of the fall.
Posting it online to find owner is absolutely unnecessary. The phone could be returned to the owner by contacting the airline.
Or just ask the phone and it will tell you.
The name in the email is a generic Vietnamese origin name, so while I agree with you about privacy, the post didn't expose much information about the owner.
I have to agree with this.
Over 40% of Vietnamese share the same surname, and only about a dozen or so are in common usage.
The name reveals very little about the owner.
But how many on that flight?
Just going by the numbers I’d assume over 40% of the Vietnamese on the flight.
You mean that 40% of the flight was Vietnamese, right? Because I don't think you'd fit 40% of the Vietnamese on a single plane.
Why do you think the Boeing had problems in the first place?
Are you sure? I hear Boeing makes some very big planes...
Especially since they did take the effort to redact the ending numbers of his creditcard number.
As a matter of principle, you should always redact names, at least down to initials; as a matter of practice, I am not sure the name is any more identifying than eg "Mike Johnson". If you had Mike Johnson and the last four digits of a credit card, you might be able to identifying him from a database of leaked PII, although there may be enough of them to get a collision on that.
On the third hand, including the name doesn't really add anything to the story/image.
It looks like they did redact the last 4 digits of the person's credit card number in the email. It seems odd they would have done this and not done the same for the name though.
Me too. But this is a faux pas at worst.