Last week, Alaska Airlines flight 1282 was forced to land after a “door plug” popped out of the plane. Fortunately, no one was injured, and the lack of tragedy has led to countless jokes about things like extreme exit row seating and the like.
One of the stories that has captured people’s attention is the finding of an iPhone that was sucked out of the plane and fell 16,000 feet to the ground. Twitter user SeanSafyre reported finding the phone. (If you, like me, prefer not to visit that hellsite, the post is also visible on Mastodon – an open-source alternative to Twitter – via a mirror of the SeanSafyre Twitter account.)
Finding the phone
According to Sean, he found the phone on the side of the road, under a bush. It was apparently in extremely good condition despite its lengthy fall. Although folks in the area had been alerted by the NTSB to be on the lookout for debris, he thought it was more likely this was just one that was thrown from a car or something similar.
So how did Sean learn that this was from flight 1282? Because, as he reported, it didn’t have a lock screen. He “opened it up” and found the screen showing an e-mail showing a checked baggage receipt from Alaska Airlines.
How was the phone unlocked?
The photo and Sean’s description don’t shed much light on the question of how the phone was unlocked, but there are two possibilities.
The most likely one, based on the description, is that the phone was simply not secured with a PIN or passcode. It’s not to hard to decline setting a PIN during setup of a new phone. This would mean that anyone finding it would be able to unlock the phone (if indeed you could even refer to it as “unlocking” when there’s no lock in the first place).
The other is that the phone had been set to not lock automatically, which would mean it had been sitting there with the screen on since it landed. This seems less probable, as this setting is hard to find and the battery would likely have run out by the time Sean found it.
Thus, I’m going with the assumption that there was simply no passcode.
Why should I have a passcode?
The iOS setup process encourages you to set a PIN or passcode for a very good reason: to protect your data. Lots of folks assume it’s to protect your phone, by making it unusable to a thief. However, a thief can still sell a locked iPhone for parts, and the phone itself is easily replaced. (Even if the expense means “easily” is a stretch, you’re going to be replacing the phone either way, and the phone is still more replaceable than your data.)
The passcode is actually there to keep a thief from accessing your data. The data stored on your phone is very difficult to get off of a locked phone, because it’s encrypted. A thief would have to crack the passcode in order to access any of your data, and that’s not easy. It’s even harder if you choose a 6-digit rather than a 4-digit PIN, and quite a bit harder if you use a passphrase.
Why should I care about my data?
I can quite literally hear you saying things like, “Nobody’s interested in my data.” (“Quite literally” because I’m hearing that currently from a conversation on Mastodon.) However, you couldn’t be more wrong.
Okay, so maybe you don’t do banking on your phone, and you don’t use Apple Pay, and you don’t buy apps or anything else on the phone, and you don’t have any naughty pix in your photo library. Great! A data thief doesn’t care. I mean, sure, they’d take advantage of any of that in a heartbeat, but even the most boring person in the world still has data on their phone that a thief could use.
First of all, if you use multi-factor authentication (MFA) on any of your online accounts, most likely at least some of them involve either sending you a text or sending some other kind of notification to your phone. With your phone, a thief can gain access to many of your online accounts, and use that access to take over others… including, potentially, accounts connected to you bank, your credit cards, etc.
Okay, you say, but I don’t use MFA at all. To which I’d say, that’s not the flex you think it is, but it also doesn’t mean your phone is uninteresting. What about your e-mail? Mail on your iPhone is likely full of all kinds of data that might be worth something. Further, access to your e-mail would give a thief the ability to gain access to all kinds of other accounts. And this would be a heck of a lot easier since you don’t use MFA!
Messages is also a concern, and not just because of MFA. Apple talks a lot about how secure Messages is, and it’s true… but not if the phone is unlocked in someone else’s hands! How often have you sent sensitive information, such as a credit card or a social security number, to a friend or relative via Messages? Has anyone else sent you that kind of information? Do you even remember? A thief could, for example, simply search your Messages for common credit card prefixes. (For example, Discover card numbers usually start with 6011.)
I hear you… you don’t use Mail on your phone and you’re 100% certain you’ve never sent or received sensitive info through Messages. You’re still not boring enough. Consider just your contacts, for example. Imagine a scammer just cold-calling numbers at random. They’re not likely to have a very high success rate. Such calls can be successful with certain folks – unfortunately, the elderly are one of the most common victims – but many folks these days are highly skeptical of these kinds of calls.
However, imagine what a scammer could do if they knew the names of your parents, your children, your cousin in Maine, etc. If you use the calendar, that adds more information. They know you were in Florida for spring break and that your brother visited in August. And so on. That’s a lot of information that a scammer could use to make their story believable.
If, at this point, you say you don’t use Contacts or the Calendar, along with everything else mentioned above, and that you only use it for phone calls by keying in the numbers manually… well, I’m going to give you quite a flummoxed look and ask you why the hell you have a $1,000 iPhone instead of a cheap flip phone!
So what do I do?
The answer is easy. Use a 4-digit PIN at the very least. Better would be a 6-digit PIN. Even better would be a password or passphrase of some kind. Be sure to choose something that you can remember, but that a thief would never be able to guess, even if they also stole your wallet or other personal documents. (In other words, no birthdays, no names, etc.)
Next, turn on Touch ID or Face ID, whichever your phone has. This makes it much simpler to use your phone with a longer passcode, because you don’t have to enter it as often. Some people are nervous about these technologies, but your biometric data is stored extremely securely, and is never transmitted off the device. It’s definitely not going to wind up in a database somewhere.
Also, if you’re one of the people who said you don’t use MFA… please start using MFA! Even the worst forms of MFA are better than no MFA at all.