July 18, 2018: iOS 12 beta 4 closes USB Restricted Mode one-hour window
Security is perpetually at war with convenience. In the last version of iOS, Apple kept USB Restricted Mode from activating for one hour after an iPhone or iPad was last unlocked. As of iOS 12 beta 4, that one hour window is gone, and a passcode is required any time an iPhone is locked and a USB accessory is plugged in.
This is my personal preference, as mentioned in the original article below, but it may cause some complaints about passcode fatigure for people who care more about ease of use than data protection.
We'll also have to wait and see what behavior the final version of iOS 12.0 ships with this fall.
There's some FUD — Fear Uncertainty and Doubt — going around about the new USB Restricted Mode Apple shipped as part of iOS 11.4.1 and the iOS 12 beta. USB Restricted Mode is a new security system that's meant to prevent third parties from trying to connect your iPhone and iPad over USB and extract your data.
Here's how Apple says it works:
There are some exceptions and overrides, of course:
That's because security perpetually has to be balanced against convenience.
Which brings us to the FUD:
First, there's no such thing as "untrusted USB accessories". There are "untrusted devices", namely devices like computers capable of pairing with and extracting data from an iOS device, but not "untrusted USB accessory". By itself, that statement sets off all kinds of alarms.
Second, Apple itself outlined why some devices, like accessibility devices, can override the lockout. That's because the daily usage of those devices requires an element of convenience that Apple believes supersedes the need for security.
Here's the process for how that article should have been developed, if it cared more about getting to the facts and less about stealing attention through sensationalism:
- Discover behavior.
- Disclose it to Apple.
- If it's a bug, work with Apple to get it patched prior to disclosure.
- If it's not a bug, disclose the behavior along with cogent arguments about why you agree or disagree with the choice of behaviors.
In this case, it's not an oversight. It's a choice to balance convenience and security. Personally, I'd prefer Apple biased a little more towards security in this case, but I also understand I'm not everyone and it's tough to juggle things like accessibility devices and persistent accessories.
Increasingly, it's not the bits that are the exploit or the malware, it's the coverage of the bits. That's terrible for everyone from media to customers.
Master your iPhone in minutes
iMore offers spot-on advice and guidance from our team of experts, with decades of Apple device experience to lean on. Learn more with iMore!
Rene Ritchie is one of the most respected Apple analysts in the business, reaching a combined audience of over 40 million readers a month. His YouTube channel, Vector, has over 90 thousand subscribers and 14 million views and his podcasts, including Debug, have been downloaded over 20 million times. He also regularly co-hosts MacBreak Weekly for the TWiT network and co-hosted CES Live! and Talk Mobile. Based in Montreal, Rene is a former director of product marketing, web developer, and graphic designer. He's authored several books and appeared on numerous television and radio segments to discuss Apple and the technology industry. When not working, he likes to cook, grapple, and spend time with his friends and family.