Skip to main content

How Apple’s tight ecosystem of products can undermine its own security

There’s an old belief that you can’t have both security and convenience, and that’s seen as especially true in your digital life. I’m sure Apple would dispute that assertion, pointing to things like Face ID as evidence it can do both.

Yet, as we’ve seen in recent months, there are actually times when Apple’s ecosystem, so tightly linked across its platforms, can actually undermine its own security. If your dwelling only has one locked door, it only takes one key to have access to the whole house.

Face ID, the iPhone, and the Apple Watch

Face ID is the best example of the security catch-22 a company like Apple can end up in. By itself, it’s superb, far outstripping anything Apple’s Android rivals can come up with, at least when it comes to facial recognition. It is fast, easy to learn, available on many of your devices, and yes, both secure and convenient. It’s exactly what you imagine when you think of Apple innovation.

Under normal circumstances, it works great. But I don’t think anyone can claim the last 18 months qualify as “normal circumstances,” and for all the disruption the pandemic has caused, it has also exposed the weak point of Apple’s tightly bound ecosystem.

That’s seen in Face ID’s tie-in with the iPhone’s Unlock with Apple Watch feature. If you have an unlocked Apple Watch on your wrist, you can use it to open up your iPhone when Face ID doesn’t recognize you. It’s specifically designed for times when wearing a mask obscures your visage such that Face ID cannot identify you properly. It’s a slice of convenience for a pandemic world.

It’s a slice of convenience for a pandemic world.

The problem is that it seems incredibly forgiving. I have both an Apple Watch and an iPhone, so I end up using Unlock with Apple Watch on an almost daily basis. And nearly every day, there will be at least one time when my Apple Watch unlocks my iPhone when I haven’t even looked at it. It’s not like my face was obscured by a mask — I’m often facing another direction entirely. Face ID on my iPhone is set to “require attention” — in other words, I have to look at my iPhone to unlock it. Yet Unlock with Apple Watch apparently completely bypasses that requirement.

And with one weakness in the system, the whole ecosystem is at risk.

Sidestepping Face ID

Andy Boxall/Digital Trends

What’s worse is that this feature simply requires an unlocked Apple Watch to work — and unlocking an Apple Watch is child’s play. Instead of the complex security layers of Face ID or Touch ID, all that’s required to get into an Apple Watch is a simple four-digit passcode. Given how many of us use memorable, identifiable dates and numbers for this kind of lock-up mechanism, prying open an Apple Watch is beyond easy.

And that’s a problem because of how permissive Unlock with Apple Watch is at unbolting an iPhone. Apple claims the chances of someone fooling Face ID are one in a million. But when a simple four-digit passcode is enough to get into an Apple Watch, Face ID’s apparently watertight security becomes totally irrelevant.

All that’s required to get into an Apple Watch is a simple four-digit passcode.

It’s not just your iPhone that this affects. You can do the same thing with a Mac. An unlocked Apple Watch can log you into a connected Mac provided you’ve set up Unlock with Apple Watch. Once again, all you need is a four-digit passcode for the Watch and suddenly the Mac’s contents are all yours.

The security ecosystem implications

Ultimately, this wouldn’t be happening if Apple’s ecosystem were not so tightly bound. It’s only by having devices that closely interact and communicate with each other that an Apple Watch is able to unlock an iPhone when your face is obscured. But in giving users that extra step of convenience, the company is undermining its famous security.

That’s not to say Apple can’t work out a way to have both — to let users have their cake and eat it. But right now, anyone who steals an iPhone and an Apple Watch only have a trivial obstacle to surmount to gain access to all your personal files and info. That’s far from the security-conscious Apple I thought I knew.

Editors' Recommendations

Alex Blake
In ancient times, people like Alex would have been shunned for their nerdy ways and strange opinions on cheese. Today, he…
I hope Apple brings this Vision Pro feature to the iPhone
A concept of spatial FaceTime from Apple Vision Pro mixed reality headset running on iPhone.

Digitally crafted alternative realities can be exciting or discomforting, based on how you envision them. But Apple, among other companies invested in AR- and VR-dominant future, clearly wants you to focus on the bright side. That's why Apple spent a substantial chunk of time at its WWDC 2023 developer conference to highlight the various features of the Apple Vision Pro — Apple's extravagant new mixed reality headset.

As per Apple's surefooted narrative at the event, the Vision Pro delivers us into a new era in computing and pushes beyond the boundaries of fixed displays. The promotional walkthroughs easily convince us the headset is both visually and functionally unique in many ways.

Read more
iMac 27-inch: Everything we know about Apple’s larger, more powerful iMac
Apple iMac Pro News

When Apple killed off the iMac Pro and then completely removed the 27-inch iMac from its online store, we thought that was the end of the road for the larger all-in-one computer. Right now, Apple only sells one size of iMac: the smaller 24-inch version. But what about that gaping hole in the iMac lineup previously occupied by the 27-inch model?

It could be that Apple decides to leave this device dead and buried and instead hopes that the Mac Studio and Studio Display scratch that itch -- that's certainly what sources at 9to5Mac have contended. But there are tantalizing clues that Apple is considering offering a larger iMac with a greater level of performance than the 24-inch iMac. Regardless of whether this is branded an iMac Pro or an iMac, here's everything we know about the next high-end all-in-one from Apple.
Price and release date

Read more
Have an iPhone, iPad, or Apple Watch? You need to update it right now
iPhone 14 Pro Max against a red background.

If you own an Apple product — be in the iPhone, iPad, Apple Watch, or a Mac — you should update it immediately. Why? Apple has begun rolling out updates to all of its devices with fixes for a serious security vulnerability.

The security vulnerability is known as CVE-2023-32434, and it has to do with the kernel privileges of Apple devices. Per Apple's website, the vulnerability allows third-party apps to "execute arbitrary code." In other words, if a bad actor knows how to exploit this vulnerability, they could potentially gain access to your Apple device and wreck havoc.

Read more