Can you update an iPhone without unlocking it?

In theory you can by connecting it to a Mac or PC and running recovery/DFU mode. I say "in theory" because Apple these days seems to have moved off the 'reliably boring" step onto the "break things" step. If the user hasn't got a Mac or PC then they ought to be able to get it sorted out in an Apple shop.

It's hard to understand how this change survived any sort of requirements review or design review but the good old reliable Upsilon testing picked it up.

But the phone would need to be unlocked before responding to the PC or Mac. Otherwise anyone could break in to any old locked iPhone.

No - the phone will recover but Activation Lock means it can only be activated by the owner logging in with their Apple ID.

I would imagine that the user unlocked their phone with the password on the working version of iOS then updated it to the broken one.

Since the update process reboots the device, it will disable Face/Touch ID and require the PIN or password to be entered to re-enable it. This was now an impossible task because of the missing character.

Plugging in to a computer would not work either because that requires the PIN/Password too.

The only way out is a factory reset and then restore from backup.

Back up your data folks.

>> Back up your data folks.

That must be the lesson to learn. He could equally well have: lost it; had it stolen; had it run over by a car; ...

But he didn't, he lost access to the phone he STILL had in his possession, solely because Apple pushed an update rendering useless certain previously valid passwords...

Yes, as several of us pointed out in the comments for the original article, it's not unreasonable to use this as another real world example of where having good backups would have helped, but please let's not continue falling into the trap so many others did in those comments of focussing *solely* on the lack of any backups and ignoring the rather significant part Apple played in this user losing access to their data. Because this is a rather salient point - even if you ARE performing good backup policy, there's a good chance access to your data will STILL be at the mercy of the manufacturer of whatever system is required to access the backup.

So unless your backups are being made in a form that you can guarantee will remain readable no matter how badly someone else might mess things up, then are they actually backups at all?

> The only way out is a factory reset and then restore from backup.

It said in the original story that he deliberately didn't enable cloud backups

Yes, put it into DFU mode, connect it to a PC with iTunes or a Mac, it will be detected and you get the choice of updating without erasing anything or a full factory reset (but it doesn't remove the activation lock)

As always, FFS people, back up your data, especially from easily damaged, lost or nickable gear like a phone

After an update iPhones go into a locked down "first boot" mode that requires unlocking.

As per other comment - how is a new iOS release going to fix this, when the user is locked out of their iPhone, and they can't upgrade the OS when they can't get into the phone to install the update?

Czechmate

Here we are with another perfect example of how people are powerless against corporations unless they are lucky enough to get the press interested.

Well it did affect customers from an entire country, not just one person.

"Well it did affect customers from an entire country, not just one person."

Only those Czechs who didn't use the four or six digit pin and did include the Czech há č ek in their passcode. Probably the one in a million chance that is a certainty. It's only the unlock screen that is affected - the Czech keyboard is fine once unlocked.

Apple is a bit buggered here. If they can break into this phone they have been lying for years to one party or other. If they cannot (or wiil not) then they get slammed for a fairly foolish breaking change.

I guess the world is still ASCII - Make Ascii Great Again.

That would be like confidently asserting that some other bug only affects the apostrophe on the English lock screen keyboard and who uses that. So what - it can still screw people who log in with a password and used that character and it shouldn't have happened.

Broken software localisation by US software developers (stupid dumb drooling puzzle.jpg) is precisely why it's still an ASCII world.

Its been several years since I last had to do this with an iPhone but using the official camera adapter allowed you to plugin a a USB keyboard so you could enter the pin to enable it to talk to a connected computer.

Had to do it a few times when people broke their iPhone screens so much that they couldn't enter the pin that was required to connect to a PC or Mac to back it up, prior to it been taken to a genius bar for repair.

But the phone will ignore the character typed on any keyboard, because the Czech character no longer exists in that version of iOS.

Oh I must have misunderstood, as I though in the earlier report it mentioned it was still on the main keyboard in iOS once logged in but not available on the lock screen keyboard.

Link: https://tech.yahoo.com/cybersecurity/articles/fbi-just-recovered-disappearing-signal-152709903.html

Maybe the unlucky user should have enlisted the FBI?

Would be mighty embarrassing if a 3LA can fix a obscure yet monumental fuckup on Apple's part, and at the same time, point out more security flaws.

Though I'd bet the agencies in question would really prefer to keep those known software loopholes for juicier targets.

” Maybe the unlucky user should have enlisted the FBI?”

Those juicy and expensive local exploits are hoarded by 3LA/Cellebrite to use against terrorists, political opponents and the like…

So maybe if the guy makes public shaming trump comments and really piss him off, the fbi would be willing to engage 3LA? Worth a shot. It does seem trivial to piss off the orange clown. Just have him take out an ad about epstein/trump at the NYT.

Back in2021, when MS were fucking around with their printer privilege problem, their "fix" borked every computer in our network.

"Don't worry" said the support agent "You just need to log into each machine, apply this fix, and good as gold. There is no other way".

"That's nice" I said. "And seeing as you paid to support us, when will you be doing that ?"

48 hours later it was all fixed.

Blessed are the paranoid for they shall find the world is truly against them.

No.

This was a deliberately taken out. That's a choice, not a bug.