Not receiving SMS two factor authentication codes for Facebook, Instagram, others: remove blocked numbers

A friend was not receiving Facebook SMS two factor authentication codes on his iPhone. I removed all his blocked numbers and he received the code. We assume he accidentally blocked the number Facebook uses to send SMS codes.

You can see blocked numbers in Settings:Phone:Blocked Contacts (it's actually a list of blocked numbers, not a list of blocked Contacts). If iCloud sync is working you see the same list in Messages on macOS.

iOS App Update hangs without an error message in infinite download: a general approach

Apple's FairPlay DRM management is notoriously fragile. It can be confused by family sharing, Screen Time controls, payment method changes, and, heaven forfend, mixed Apple IDs on a device.

Once Apple's DRM gets confused there's often no user accessible error message (PS. This is a bug [1]). The app just hangs. So when I realized my (manual) App Store updates were not completing I was not completely surprised. Recently I had:

1. Changed payment methods. I made my Apple Card's award balance (1-2% transaction) the default payment method (so it always gets emptied)
2. Enabled Screen Time account change restrictions to mitigate the harm of Apple's biggest current security issue.

I fixed the problem in the usual way (see Apple's article on this as well):

1. [Switch to manual update if you've been using automatic]
2. Verify Apple ID payment methods look correct
3. Turn off Screen Time [Apple doesn't mention this.]
4. Restart phone (power off/on)
5. Download a new free app from App Store [An old method, still useful]
6. Verify I can now update one of the pending apps.
7. Update All
8. Turn Screen Time back on.
9. [Turn auto update back on if you like that.]

-- 

[1] Failure to generate a user notification of a failed interaction is, of course, a bug. Regardless of whether there's a bug in the interaction processing (which there is, so that's another one).

iPhone Recovery Key attack vector kills your iCloud access: Workarounds pending an Apple fix including Apple ID protection

Someone who has your iPhone passcode can lock you out of your Apple iCloud and Apple ID services -- as well as take control of your iPhone and have access to all passwords stored in Apple's Password Manager (iCloud Keychain).

This can happen when someone steals your phone and obtains your passcode by the simple measure of threatening to kill you. Or they might see you enter your passcode or surreptitiously record entry. In bars drugs can be used to facilitate the process. This is often done as part of "borrowing a phone" for an "emergency call". (Never let anyone you don't trust with your life and wealth touch your phone. If it's an emergency make the call for them but ensure they don't record your passcode and don't let go of the phone.)

Once the thief has your phone and passcode they can change the victim's Apple ID password. This prevents the victim from locking the iPhone. The victim could still do the Apple ID password recovery process, so to get more time with the phone the thief can set a Recovery Key. If a Recovery Key exists they can change it. Setting a Recovery Key this way disables Apple ID password recovery. This gives the thief an unlimited time with the phone. It also locks the user out of all their Apple ID associated services and products including video, music, personal photos, personal documents, family sharing, other Apple devices, and the like. From the thief's perspective the Apple ID lock out is merely a side-effect. They may even feel a tiny qualm of sympathy for their victim. They do it to prevent iPhone lockout.

This is an Apple design problem. They need to fix it. Basically the iPhone passcode has far too much power -- especially since it has to be tapped in far too frequently and thus relatively easy to enter. Secondarily the benefits of the Recovery Key are limited to a few people and the with this technique in common use the risks dwarf the benefits. Apple should disable creation of new Recovery Keys immediately while they come up with a better fix.

TidBITS has one of the best descriptions of the problem following a somewhat confused WSJ article. I suggest also reading TidBITs preceding article on the problems with iCloud Keychain.

I was aware of most of these issues, but the Recovery Key hack is new to me. Again, if an attacker has control of your iPhone they can change your Apple ID password, locking you out of your photos, documents, Apple services, Apple media you've purchased, subscriptions, software, and more. At this point you can ordinarily reset your Apple ID password [1] through a tedious series of authentication steps or with the help of a previously specified Recovery Contact [2]. However, if you have set a Recovery Key you can't use these methods. You have to know the Recovery Key. If a thief sets or changes the Apple ID Recovery Key to prevent locking of the stolen iPhone you are truly screwed. Once you set the Recovery Key yourself Apple no longer stores it [3]; they can't recover your Apple ID even if they wanted to.

Apple has to fix several things here. It's insane that a six digit iPhone passcode allows access to all of the iCloud Keychain (Apple Password Manager) and setting up a Recovery Key. The power and risk of the Recovery Key is a separate problem and creation of new Recovery Keys should be disabled until there's a better fix.

In the meantime we've taken two steps on our our iPhones:

1. Emily and I set each other up as Recovery Contacts to facilitate doing an Apple ID password reset in the absence of an Apple Device.
2. Follow the recommendation of TidBITS to use Apple's Screen Time feature to prevent Account Changes. This requires setting a separate 4 digit ScreenTime code (PIN). When you do this Apple seems to require entry of Apple ID credentials that can be used to reset the ScreenTime PIN, but if you tap "cancel" you can continue without this step. That means an attacker can't use the Apple ID credentials they've stolen to unlock the account settings; they can't change an Apple ID password and they can't set a Recovery Key. (I think this can trigger an Apple Bug with App Updates and mixed Apple ID - see this article.)

I have not yet deleted all of my iCloud Keychain entries. I will go through mine and delete a few key ones. Apple really and truly needs to secure iCloud Keychain with an optional separate credential [4].

I do NOT recommend setting a Recovery Key.  An attacker with your iPhone passcode can change it anyway, and you won't be able to use Apple's standard Apple ID password recovery method.

- fn- 

[1] One time I tried to use login with Apple on a calendar service provider (Stanza). Apple evidently decided that was a bad idea and instantly locked my Apple ID. I had to follow the password recovering steps. If I'd set a Recovery Key and did not know the Key I'd have lost access to my Apple ID content (photos, etc) for all time.

[2] Setup a recovery contact NOW.

[3] I presume that when you do a standard password reset, or a Recovery Contact does a password reset for you, that behind the scenes Apple is using the Recovery Key they keep.

Managing sync issues in the Apple Notes app - what I do

I use Apple's Notes app fairly often. It's come a long way from early days but it has its share of bugs. The two I run into most often are formatting bugs and especially sync failures.

Formatting bugs seem to be related to frequent edits to a note using Notes app styles and character formats. Sometimes editing stops working in odd ways. I have to create a new Note and select all/paste into the new Note.

Sync bugs are more common and more serious. There are two kinds of sync bugs - global application sync failure and note specific failure.

Global sync means no notes are synchronizing and perhaps no iCloud content. I've seen that with iCloud password changes. I recommend never changing an iCloud password, Apple really doesn't want it to change. I had to recently because trying to use the Stanza calendar on the Saint Paul Saints web site with Apple integration triggered an instant Apple account lockout and mandated password reset (be afraid).

If iCloud sync doesn't work after a password change and iCloud seems to be properly authenticated first try restarting your iPhone or Mac. Then, on an iPhone, try sending an iCloud email. That last may require you to YET AGAIN enter your iCloud password. With luck the credential problem may resolve for all iCloud functions.

Single note sync failure may be something I see because I'm using Notes across the latest version of iOS and Mojave. I suspect it's actually fairly common even on Monterey/iOS though.

If it's just one note that won't sync between two devices you can check out Apple's web client view of Notes. That will tell you which device is off but it doesn't help with the fix. As far as I can tell there's no sync failure resolution built into Apple Notes. If Apple's sluggish iCloud sync means you have edited one note on two devices when they weren't in full sync then that particular note will no longer sync. No error messages, no offer to sort things out, no creation of two versions, it just quietly sits in isolation.

The workaround is to create a new note and confirm that syncs. Then on each separate device move the content from the now isolated notes into the new syncing note. Then delete the notes that didn't sync on each device.

Synchronization is a problem some seem to have solved (Simplenote for example), but Apple is not among this elite group.

Family member not getting iCloud+ family subscription for 2TB storage - "Use Family Storage" in Settings (Family Sharing)

A family member was seeing only the default 5GB of storage. I prepared to the usual fixes like restart phone, upgrade iOS, leave and restore iCloud and, finally, remove from family and add back in.

Turned out the fix was much simpler as of iOS 16.3.

Settings:Apple ID: iCloud: Manage Account Storage: Use Family Storage.

After I selected this option they got access to our 2TB and the "Use Family Storage" option went away. Instead they had "Change Storage Plan". Tapping that gave the option to leave Family Storage.

Apple's docs mention something about an iMessage going to family members to give them the option to use Family Storage. I suspect that didn't get attention.

Once I'd fixed the problem I used the new keywords to search for Apple documentation. Google found nothing (though it's really bad now) on the Apple site except a post from 2 days ago. So this might be newish.

Update 1/17/2024 

In the 2024 version of iOS and macOS (Sonoma) a friend ran into a similar issue. The family organizer had purchased the 2TB plan but my friend was only seeing the 200GB he paid $1 a month for. This time we found an Apple support document on the problem. If someone is paying for anything beyond the default free storage they have to manually switching into the family plan and end their subscription. This is now found on an iPhone in the newish Settings:Family:Subscriptions.

1. Go to Settings > Family.
2. Tap Subscriptions.
3. Tap iCloud+.
4. Tap Use Family Storage.

Also, when updating this, I discovered a 2017 post I'd done where I ran into a similar problem. That might be worth a look too.

Apple Music subscriptions stop working when I changed my Media & Purchases Apple ID

Apple digital rights management (DRM, FairPlay in this case) is very complex, particularly when one adds Family Sharing or has an atypical Apple ID setup.

In our case, for reasons that made sense 10-15y ago, my iCloud Apple ID is different from my Media & Purchases Apple ID. My iCloud Apple ID is the family organizer and my Media Apple ID is a family member.

Over the past few years I've been trying to migrate to using a single Apple ID on my phone. I have migrated all but one family member.

Migration has been difficult. I don't think Apple has published a transition guide. You can't, of course, transfer purchases or media or subscriptions. There's a risk of losing a lot purchases and Apple is unlikely to help.

I looked at doing a test migration on a macOS Monterey account of mine but it seemed Monterey did not a user to change only their Media Apple ID. [Later I found you can. In Monterey, unlike iOS, it's obscure how you do this; it doesn't show up in an Apple ID. You change the Media Apple ID through the App Store (Sign Out, Sign In).]

Since it seemed couldn't test on Monterey without trying a full Apple ID transition I made the changes on my iPhone.  Let's say my iCloud Apple ID was "Sam" and my Media Apple ID was "Linda". So my device Apple ID configuration was Sam/Linda.  After the change it was Sam/Sam. Sam is the Family Organizer, Linda is a family member. Linda owns our app and media purchases -- at least that's where they show up when I look.

I was particularly curious how Apple Music would work including test playlist sharing. Unfortunately I couldn't test the playlist sharing because Apple Music didn't work at all! As far as iOS was concerned I didn't have an Apple Music subscription. It offered to give me 6 months free. I also didn't have any Playlists or other configuration. Music (iTunes) configuration is tied to the Media Apple ID, not the iCloud Apple ID.

To recap, Sam is family organizer and Sam/Linda purchased the family plan Apple Music subscription. Linda shows up in Family Sharing as a family member. Once I became Sam/Sam I had no access to Apple Music. Reviewing Family Sharing it appeared that Sam should have access to Linda's Apple Music subscription. That doesn't work.

Apple's Family Sharing problem support page says:

... Make sure that you're using the same Apple ID for Family Sharing and Media & Purchases... 

They don't say how to migrate to that idea of course! Obviously it was possible to use a different Apple ID for Family Sharing and Media (Apple Music worked before). I don't know if the changes made to my device impacted any other family members (wish I'd checked!), but it appears for a Family Organizer device to see Apple Music they have to use the same Apple ID used at time of purchase.

Somewhat surprisingly Apple let me revert back to Sam/Linda on my iPhone. (I think there was some time limit/change limit on Apple ID media changes.) After a period of sync I had my old playlist and Apple Music access.

My guess is that to make the change to Sam/Sam and keep Apple Music I'll have to end my current subscription (tied to Linda) then change the Media Apple ID then resubscribe for the family. (In practice I'll end all subscriptions for Linda before the change.)

iMessage not synchronizing - your store ID matters too

Based on some issues I've seen with my daughter's devices I think that Apple Message sync will only work when both Apple ID for "iCloud" and Apple ID for "Media & Purchases" agree on both devices.

There's a dependency on "Media & Purchases" Apple ID for Apple Messages, perhaps because it's descended from the Apple messaging apps that predate iCloud.

How to leave Google Apps / G Suite / Google Workspace

UPDATE: As of early May 2022 Google has relented and will allow continued personal use of legacy G Suite domains. You need to login to your domain and then use this URL. (The option is described, a bit obscurely, in a support page).

<background>

It's hard to remember now, but there was a time that geeks had some affection for both Google and Apple (but, TBH, never Microsoft). Those were the glory days my friend.

This year's bitter resentment is brought to you by Google ending free Google Apps services. Back in the glory days Dreamhost bundled these with domains, I picked up 7-9 of them. Two of these Google App domains have been heavily used by my family. They are the core of a wide range of daily things we do, including email addresses association with numerous logins, credentials, passwords, and so on. (But not with Google OAUTH identity services, that is not supported for Google Apps email addresses.)

A few months ago, in early 2022, Google told us that these services, once as permanent as gmail (*cough*, they're coming for you), would become quite expensive. For us the costs to maintain our current setup would be hundreds to thousands of dollars a year. Shortly after this announcement we were told that there *might* be a reprieve, that non-business services would continue. This false-hope was never officially withdrawn, but in May 2022 it has been replaced by a bizarre offer to maybe continue but, like, without email or domain?

Google's very limited online guidance does not review how to exit Google Suite. In email communications they mention a 'suspended state' but do not describe what that means.

So now I have to spend several lovely days in May sitting at my computer trying to salvage our digital identities. We will clearly have to pay for at least one of our domains - principles be damned. Charges begin Aug 1, 2022. </background>

The following is a rough guide to what I will do. Much of this requires knowledge from decades ago that I'm having to refresh.

Considerations and discoveries

1. It's difficult to move IMAP emails between services. IMAP emails can be copied to a local store. In mail. app I've had success dragging and dropping emails from one IMAP inbox to another, but I believe this is fragile and unreliable. You can also copy, see this iCloud example.
2. Local store email is barely supported any more. Mail.app, for example, 
3. My domains are managed by Dreamhost which does provide some classic web services though fewer than it once did.
4. Domain based email forwarding is fragile -- many services including google will reject it. See DKIM notes below.
5. Modern email is both essential and a river of spam and Google has good spam filtering (though it was better once)
6. The knowledge of how to manage DNS settings is more esoteric now than it once was, and Google Search no longer works.
7. My Dreamhost DNS and mail forwarding has lots of old detritus. That's on me!

References related to closing Google Workspace accounts

1. Microsoft on switching to Office 365 - cancel subscription
2. Fastmail also has switching options, but price not much less that Google Workspace
3. Google has not provided any migration guidance.
4. You close your account by canceling the subscription: https://admin.google.com/ac/billing/subscriptions/ then deleting the account (see below).

References for migrating to Dreamhost email services

1. Dreamhost email client configuration
2. The Dreamhost custom MX config panel has 'uses Gmail' management links that take you to Google admin (so not terribly useful but at least can tell what to change.
3. Dreamhost used to support both a mailbox and a forwarding action but you can't do that any more (still works for old settings). Dreamhost uses Roundcube Webmail but has not enabled forwarding in that app. You can use forwarding directly from a domain but I think Google treats emails forwarded this way as spam. (At one time we were supposed to have had quite large storage caps with Dreamhost, but I think email overwhelmed them. Similar to the days our Gmail storage was to be unlimited.)
4. A comment on this post mentioned imap sync for moving email: "For transferring IMAP email, imapsync works well. There's a free version you can download and run on your computer (or on your hosting provider if you have ssh access). It's well documented and relatively easy to get your head around, and is fast and reliable. I’ve not got any affiliation, but someone pointed me to it a couple of years ago, and I’ve since used imapsync to migrate email hosts for a small organisation. Highly recommended."

References for migrating to Apple iCloud+ email

Apple supports custom domains with iCloud+ email including family sharing.

1. You can assign up to 5 domains to a family group and for each domain each member can have up to 3 email addresses.
2. Apple will instruct on how to do DNS settings (there's a bug in the quotes apparently) - there's also a tech note on DNS settings.
3. Useful twitter stream on migration to iCloud
4. Detailed twitter thread on migration - Google takeout mbox, import into Mail, then drag from local to iCloud.

My steps to closing an essentially unused account where I didn't worry about forwarding

1. Go to Google admin console for account.
2. Review how many users exist. (typically one)
3. For that user review email to see if there's anything important, sites, docs, etc. Don't forget google  voice!
4. From Google Admin account cancel your subscription. Now pay close attention so you don't miss the next step - delete your account (https://admin.google.com/ac/companyprofile/accountmanagement)

When you choose to delete account you see:

Now return to Dreamhost

1. Go to DNS for domain and delete the Google CNAME records
2. Go Custom MX controls and Choose "make me regular email". It may take hours for this to work.
3. At this point Dreamhost enables webmail. But I wonder if this actually blocks email forwarding even if you set that up! (The lack of warning doesn't give me a happy feeling about Dreamhost TBH.) So disable webmail. Dreamhost also has a control panel for email forwarding that I think is a disabled feature.) - NEED TO TEST MORE HERE
4. Go to Manage Email and set up a forwarding account as needed. This can take a while. Apple picked up the DNS changes within about 15-30 minutes, but Google took 1-2h. (I wonder if DNS propagation in general works as well as it once did.)
5. Enable DKIM if not already enabled.

Universal Clipboard (Handoff, Continuity) not working - Mojave and Monterey, regenerating the authentication token/password

 Recently I've had two issues:

1. Mojave Universal Clipboard stopped working between Mojave and iOS 15.4.1
2. Mojave notes iCloud synced but always showed a spinning activity icon

I found that I could make Universal Clipboard work again by creating or editing a note on my iPhone or on Mojave. Once that synced then UC worked until I rebooted.

If Universal Clipboard isn't working first reboot your devices and confirm connection to WiFi with Bluetooth enabled. Then try toggling Handoff off/on on both devices. Then try:

1. Changing my Mojave location DNS settings from Cloudflare (1.1.1.1) to Google (8.8.8.8). (Based on this post)
2. Toggling Notes iCloud off then on again (restores notes)

Now the spinning is gone, and UC seems to be working.

Update 5/15/2022: UC is back to not working unless I create a note that's synced between iOS and Mojave. Notes doesn't show the skinny activity icon. So this is an open problem.

Update 8/30/2023

Continuity has worked since May 2022 on my Mojave machine, but I'm now switching to a 2023 M2 Air running Monterey. And, of course, the Universal Clipboard didn't work again.

A few hours later my devices notified me that iCloud services would not be available until I reauthenticated. That tedious and annoying process requires entering the iCloud and device passwords; I think it creates a new token/password behind the scenes. After going through this continuity worked again. Signing in and out of iCloud is a common workaround for Continuity issues, I suspect it speeds up regeneration of the new token/password.

It would be nice if Apple improved this process.

PS. Typical things to check when it doesn't work: bluetooth on, devices on same WiFi, etc.

When iCloud Keychain stops working (No more Safari passwords) - Mojave

I'm buying tickets for an event and suddenly there's no password autocomplete in Mojave Safari. Safari Preferences Passwords shows 3-4 entries, but my Apple passwords shows on my iOS devices and my Monterey Air. It's just Mojave that has lost all its iCloud/keychain access.

A good reminder that if you want to use Apple Passwords as a 1Password replacement you need to export a static backup (and this must be automated). The Cloud is where data goes to die.

A found a relevant 2016 Apple Discussion post which would be Mojave era. So I wonder if it's a Mojave bug. The fix there was from "Linc Davis" a "Level 10" with 209K points [1]

Please take these steps to resynchronize the iCloud keychain. Your keychain on iCloud and your other Apple devices won't be affected. Take Step 2 only if Step 1 doesn't solve the problem.

Step 1

Back up all data.

Open the iCloud pane in System Preferences and uncheck the Keychain box. You'll be prompted to delete the local iCloud keychain. Confirm—the data will remain on the servers. Then re-check the box. Follow one of the procedures described in this support article to set up iCloud Keychain on an additional device. Test.

Step 2

If you still have problems, uncheck the Keychain box again and continue.

Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination  command-C: 

~/Library/Keychains

In the Finder, select

          Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return.

A folder named "Keychains" should open. Inside it is a subfolder with a long name similar to (but not the same as) this:

           421DE5CA-D745-3AC1-91B0-CE5FC0ABA128

The above is only an example; yours will have a different name of the same general form. Drag the subfolder (not the Keychains folder) to the Trash.

Restart the computer, empty the Trash, and re-enable iCloud Keychain.

Toggling Keychain off and on didn't seem to do anything so I figured I'd check in the morning. Before I checked though I did review my passwords in Monterey. For *reasons* (this happens way too often) I had to reenter my iCloud credentials there but I was also asked the usual iCloud keychain questions -- provide passcodes for my other machines.

Then I looked at my Mojave machine and Safari had my passwords again.

Maybe the fix was toggling Keychain and waiting a bit, but I'm suspicious that something happened somewhere in iCloud that required me to do the iCloud Keychain authentication dance from a Mac -- and Mojave couldn't do it.

Again, if you use Apple Passwords as your sole repository you need a non-iCloud backup.

- fn -

[1] No profile info, has participated in 97K threads. Either insane or an Apple staff pseudonym.

What happens when you have an Apple ID without an email address and you change it? (And much more about Apple ID hell.)

I'll provide some back story below, but it's tedious and a bit ranty so I'll put the most useful stuff up front.

For *reasons* (see below) I have had an Apple ID associated with iTunes, App Store, physical Apple Store, hardware and other purchases for about 20 years. For other *reasons* almost lost to memory the username has not been a valid email address for most of those years. Until recently it had an associated email address it would forward to but Apple changed things sometime in the past two years and that stopped working.

I'm simplifying.

We will call this Apple ID username "bob@mac.com". I will use alice@icloud.com and dan@me.com for my new Store Apple ID ("Media & Purchases") and my longstanding iCloud Apple ID respectively.

Once bob@mac.com stopped forwarding I no longer received notifications related to Apple Discussions or emails related to charges. Since bob@mac.com was the store Apple ID for my family (this was the practice in early iTunes days) our children (now adult) used it for purchases. Simplifying a lot and omitting family details the lack of email meant no monthly statements -- so I didn't spot a scam subscription - among other things.

I knew I had to fix this but I dreaded the side-effects. I'd already tried undoing the shared store Apple ID and ran into disaster; I had to reverse that attempt. I had to fix the Apple ID invalid email problem first.

Before Apple broke forwarding for the Apple ID "bob@mac.com" I had used "alice@icloud.com" as a forwarding address. Although there was no clue in the Apple ID online configuration tool, I knew alice@icloud.com was still entangled with bob@mac.com (see below, this post goes on for a long time but still omits much).

Ok, so far? I gets a bit simpler then you can skip the back story.

Anyhow ... when Apple broke forwarding they seem to have introduced the ability to change an Apple ID userid - such as bob@mac.com. I believe, though I can't find any documentation, that the visible username with the form of an email address (ex: bob@mac.com) is an alias for an unchanging hidden identifier (maybe a GUID). 

After some thought I decided the cleanest approach would be to change my Store Apple ID visible username from bob@mac.com to alice@icloud.com (I knew the two were entangled, see below). It's easy to make this change from appleid.apple.com. When I did this I was not asked to confirm that alice@icloud.com was a valid email address I owned. All I got was an email sent to to alice@icloud.com saying the change had been made.

After I made the change I found the following. I expect other changes as Apple's different systems synchronize and update (I will update this as I learn more, I expect to learn of problems from family members later today):

1. I cannot login to the Apple ID or anywhere using bob@mac.com but the two factor notification dialog still says bob@mac.com (this may change).
2. I think I may have more control over Apple ID two-factor, I can add/remove trusted devices, remove from account, and I can add a second trusted phone number. I still can't add a backup email address; that is available on some other Apple IDs I have
3. Apple Discussions is intact. When I login with alice@icloud.com I show as "member since June 23, 2003".
4. Mail sent to bob@mac.com still fails, there's no redirect.
5.  iTunes on Mojave: asks me to sign in and displays new alice@icloud.com. Says session expired, asks again. Purchase history intact.
6. Media & Purchases on iPhone showed new iCloud address and I had no trouble with updating apps.

In addition, Messages in my personal dan@me.com iCloud stopped working! It turns out "Messages" has legacy associations with the old Apple Store ID used with iMessage before Apple implemented iCloud. I got this error message

Messages in iCloud not available as iCloud and iMessage accounts do not match. (Messages in iCloud is not available because iCloud and iMessage accounts are different.)

There's a fix here but it's not the one I needed. When I looked at Messages on my iPhone it showed only my Phone number, the Apple IDs were all absent. When I tried to enter an Apple ID it showed my store Apple ID; I chose "use other Apple ID" and entered my personal iCloud Apple ID. That worked and it immediately restored all my send/receive message list. I could then reenable messages in iCloud.

It didn't fully work on Mojave iMessages though. I reenabled using iCloud Messages in preferences there and about an hour or two later it seemed to start working (though uploading messages to iCloud is still ongoing.)

That concludes the current record of changes to date. So far it has been less of a problem than anticipated, but it's early days. I will add other issues as they emerge. Then I can return to the herculean tasks of moving family members off of a shared Media & Purchases account.

Below are details for the benefit of someone searching who finds this post. They are related older items that I will summarize in outline.

----------- additional details ---------------

As noted above years ago I had alice@icloud.com as forwarding email for the Apple ID bob@mac.com. The address bob@mac.com had no associated email because of complex changes Apple made in migrating from free iTools to not-free .Mac to MobileMe. [1][2]

When I finally realized I wasn't getting Apple media purchase statements for bob@mac.com I began investigating what had happened to the old alice@icloud.com iCloud account. I found it was deactivated. I was able to reenable it. That's when things got weird. Remember (if you read above) that there was no longer anything I the Apple ID settings for bob@mac.com that showed alice@icloud.com.

Once I reenabled alice@icloud.com with a new password I found that:

• Both alice@icloud.com and bob@mac.com worked as usernames for the same bob@mac.com Apple ID.
• The password for the bob@mac.com Apple ID had changed to match the alice@icloud.com password. [This actually took a day to propagate to iTunes purchases]
• Both alice@icloud.com and bob@mac.com showed the same iCloud services (mail, etc).
• bob@mac.com was still not a valid email address. 

fn -

[1] https://en.wikipedia.org/wiki/MobileMe#.Mac

Originally launched on January 5, 2000, as iTools, a free collection of Internet-based services for Mac OS 9 users, Apple relaunched it as .Mac on July 17, 2002, when it became a paid subscription service primarily designed for Mac OS X users. Apple relaunched the service again as MobileMe on July 9, 2008, now targeting Mac OS X, Microsoft Windows, iPhone, and iPod Touch users.

On February 24, 2011, Apple discontinued offering MobileMe at its retail stores, and later from resellers.[2] New subscriptions were also stopped. On October 12, 2011, Apple launched iCloud to replace MobileMe for new users, with current users having access until June 30, 2012, when the service was to cease.

... The original collection of Internet software and services now known as iCloud was first called iTools, released on January 5, 2000, and made available free of charge for Mac users.

Services offered by iTools included the first availability of @mac.com email addresses, which could only be accessed through an email client (e.g. the Mail app); iCards, a free greeting card service; iReview, a collection of reviews of popular web sites; HomePage, a free web page publishing service; the first version of iDisk, an online data storage system; and KidSafe, a directory of family-friendly web sites.

.Mac[edit]
As costs rose, most particularly due to iDisk storage space, the wide demand for @mac.com email accounts, and increasing support needs, iTools was renamed .Mac on July 17, 2002, as a subscription-based suite of services with a dedicated technical support team.[25]

... Existing iTools accounts were transitioned to .Mac accounts during a free trial period that ended on September 30, 2002. This move generated a mixed reaction among Mac users, some believing .Mac was overpriced...

[2] eWorld https://en.wikipedia.org/wiki/EWorld

. Yesterday the password for App Store was different from password for Apple ID but today they seem to be same. I think they are two different systems that update every few hours...

 · Feb 19

Today it appears there is a single Apple ID with two usernames and one password. One username has iCloud services but is nowhere displayed in Apple ID information. twitter.com/jgordonshare/s…

... If you change a phone's Store ID to match the phone's iCloud ID  you cannot update all their apps with their iCloud ID password. You need to use the old Store ID password. Even when family sharing is in play...

... I have a hunch that Apple has an internal ID for users separate from the username (email form) displayed with their Apple IDs and Store IDs and iCloud IDs and that is what they use in FairPlay. 

Family sharing screen time bug: a fix for ghost apps

I'm happy to say I actually fixed a bug in the buggiest apple product ever - family sharing screen time.

The "always allowed" app list showed "ghost apps" -- left over apps from old versions of iOS like Find Friend. They appeared with a generic icon.

Removing my son from the family then adding him back in removed the ghost apps.

One bug down, dozens remain.

Update: Nope, the fix was transitory. Ghost apps back again. Screen Time is such a cluster.

Update: Ok, this might be the real fix. His Apple ID had 3 associated devices -- and iPad, and iPhone and a macOS user account on an old machine running maybe Sierra.  I removed the obsolete macOS relationship from his Apple ID on the web site, but it had to be remove again on his iPad.

Getting photos from iPhone (iCloud) Photos.app to Lightroom, Aperture and other non-Photos products

(Original 1/31/2021, updated 7/25/2021)

Apple's approach to photography is to keep everything in iCloud and to view or edit the images from a macOS or iOS device running Photos.app (there's also some limited web browser access). There's some limited ability to share albums between family members and other groups, but this has been a mess for years and I'm not sure what parts of it are available in which versions of macOS.

This approach doesn't work very well if you want to mange your photo Library outside of Photos.app. How do you keep track of what you've have reviewed and exported within Photos.app? Photos.app no longer tracks what's on the iPhone vs. what's in iCloud; there's no easy way to know what's not been imported if you don't delete all iCloud images.

This is what I do now:

In Mojave Photos.app create smart folder for all photos that lack keyword of “Exported”

In Photos.app on iOS or macOS

1. Clean up bursts

In Photos. app on macOS (Mojave for me)

1. Start Photos.app from my macOS account

2. First pass cleanup in Photos

3. Select all images in Unexported and export as original (I export IPTC as XMP but not sure that’s useful)

4. Assign all images keyword of Exported

In Finder

1. Remove all the small .mov files that come with Apple’s live images.

Now Import into Aperture. Every so often I purge what's in iCloud, the real home is Aperture and its many backups.

Unable to update date of birth associated with an Apple ID: "... could not be changed because of a server error"

You can't change the date of birth or family relationship of an Apple ID with a calculated age of less than 13 years old. Otherwise it's supposed to be possible to change the date of birth associated with an Apple ID. I've done it before (for good reasons).

Recently I decided to get #2 child an Apple credit card. Since banks take birth dates seriously I decided I needed to correct his before applying. It didn't work!

This is what his birthday looks like on his Apple ID web page (same as in his iOS devices):

When I edit it to 4/2/1999 I get this message as expected:

The next step is an email sent to the me.com (we're old customers, pre-icloud) associated with my Apple ID:

Can you see what's weird in this email? It says the change will convert his account to a child account. But the current date makes him 17, the correction makes him 22. The email should say it's being converted to an adult account.

When I click on "approve request" I get:

Cannot change date of birth.

The date of birth for ___ could not be changed because of a server error. Try again.

I started an Apple Chat Support ticket on this a week ago. After the usual back and forth I was escalated twice and ended up with a senior advisor (not sure of his title).  After a bit of work and repetition I was told a ticket had been sent to engineering to fix the birth date and I'd hear back the next day.

It's been a week. I've not heard back. I'll try a chat again tomorrow. Fortunately I have my original ticket number.

I suspect his account entry is somehow corrupted and possibly mixed with another account. Otherwise I wonder if this is a side-effect of Apple introducing family credit cards; maybe once I got an Apple credit card all the family birth dates were locked as a side-effect.

It's not a common problem though, I found one similar report from someone trying to convert an adult to child account.

This is going to be a painful slog with no certainty of success.

UPDATE 7/13/2021: After hearing nothing back I called again and was again escalated from chat support to phone support to "senior advisor". Senior advisor said engineering had responded and said it was not actually possible to change date of birth on a child account. I believe that is wrong, it contradicts Apple's documentation saying it should be possible to change for over 13. I have asked that it be reescalated and attach the tech support ref: HT204164.

I reserved a time to call back in 3 days and was told I'd get a link to enable a direct call to a senior advisor.

PS. Related Apple Discussion.

Update 7/24/2021: Support didn't call back on the date they'd promised. There's still a server error. As noted above Support seemed unaware of the contents of HT204164. 

I'm going to have to give up on fixing this for now. I'll try again in a few months, maybe by then Apple will know how to fix the problem. I suspect it's something in their database design that will require serious work to fix. I also suspect their support team is dealing with post-COVID stress syndrome.

Update 1/1/2023: Today I was able to change his birth date without issues. Based on the original birth date he would be 19yo now, so an adult.

iCloud backup and my lost authenticator codes

When my local Apple store tech was unable to remove the battery from my iPhone 8 they gave me a new device -- which was SIM locked to AT&T.

Well, everyone has to start somewhere, including Apple techs. Hope they improve soon.

Anyway, between the initial restore and the factory reset to clear the SIM lock I've been through two iCloud restores in the past week.

iCloud restores kind of suck now. I think they worked better a few years ago. The good news is that my photos were restored (I don't use Apple Photos/iCloud so I needed that backup). The bad news is that so many apps needed credentials reentered or new certificates generated -- especially when doing a restore after a hardware change.

The worst news is that Google Authenticator lost my authenticator codes. As near as I can tell they are restored from iCloud if the hardware is unchanged, but not if the hardware changes. Or maybe it's a bug. Whatever the reason, I lost 'em. 

It was suspiciously easy to regenerate Authenticator codes for my Microsoft account. Not too hard for Google either, because  they've moved to preferring an Apple-like proprietary two factor authentication mechanism. It is a bummer for Dreamhost though -- so now I'm going through support to try to recover access to my domains and web content.

It's hard to reconcile security and backup/restore. For example, Google Wallet and your biometrics (finger/face) aren't backed up either. On the other hand your Keychain credentials are in iCloud, and anyone who can get into your iPhone can read all of your passwords (try: "Hey Siri, Show me my passwords" or see Apple's hidden password manager). So your 4 digit Apple device passcode is not a great idea.

PS. I'm storing Authenticator codes in 1Password now. Which, like most small company software, has its own security concerns, not least that it would be relatively easy for China, say, to acquire the company or insert a backdoor into the source code.

Apple's Family: The many surprises of creating an Apple ID with age 13 or under

(You can skip the rant to get to the tech details)

<rant>I frequently berate Apple for the radioactive-feces-infested-dumpster-fire that they’ve built out of Family Sharing and Parental Controls / Screen Time / Restrictions [1] … but my latest experience has added a note of sympathy for the engineers who offend Tim Cook and are HR assigned to work on this prior to leaving Apple.

Apple has built something insanely complicated. The intersection of user interfaces, regional rules and restrictions, content licensing, DRM, functional requirements, iOS, macOS, iCloud, sync, multiple OS versions … heck, there probably time zones in there too. At this point they might as well give up and throw a neural network at it.

Whatever your day job, be grateful this isn’t what you work on.

Things are almost as bad on the consumer side. There’s a reason I seem to be the only person alive trying to make remote Screen Time work. (It’s a book project, I don’t have a choice.) With some effort I’ve come up with practical recommendations for caregivers (example) — but they assume the software actually functions. In practice I have run into a wide range of bugs and weirdness, particularly since iOS 13 was released.<rant>

Among the many complications Apple contends with into are rules about how many devices and how many users can be a part of a Family for the purposes of both DRM management and remote Screen Time. These are poorly documented, but as best I can tell the limit is 5 family members and somewhere around 10 devices (it’s not clear how multi-user accounts on macOS are treated or Apple TV). Our family has five members so we’re pretty much at the limit and I think we’re at the absolute device limit as well.

I say “think” because it’s not clear that there are error messages, I think things simply break.

So the baseline situation is pretty bad, even before one runs into bugs with handing down devices between family members.

I made things worse though. For a book project I added a test account — sphone4all@icloud.com. That pushed us up to six family members and probably hit or exceeded our device limit. Since my test phone is an iPhone 6 [2] it can’t upgrade to iOS 13 and is no longer useful for the book project. So I decided to try to remove it.

That’s where my next set of problems began. I’d make the mistake of creating the book account with an “age” less than 13. Ages are important in Apple’s Screen Time world. Basically:

Age 18 or more: independence, controls stop working, can purchase ad lib, can be Organizer. (Basically at age 18 you need to remove children from Family.)

Age 13: non-vulnerable status but subject to controls, cannot be Organizer. Age 13-18 is the range for Screen Time and content sharing. If you are the caregiver for a vulnerable adult (ex: cognitive disability) and need Screen Time support you need to periodically adjust their birthdate so they are over 13 and under 18. (We need legislation so Apple supports cognitive disabilities they way they support visual disabilities.)

Age 12 or less: vulnerable status. See below for the special rules.

I’d blundered by creating an iCloud ID for a “child” account with a current age of < 13. These vulnerable user accounts are special:

• They cannot be deleted by users. Only Apple can remove them. They can only be shifted between Family Organizers (supports divorce, parental death remarriage, etc). If a child should die, the grieving parents will need to work with Apple support.
• The birthdates cannot be changed. (Of course.)
• Since they cannot be deleted the Organizer iCloud ID they are associated with cannot become a non-Family ID.
• Since the Organizer ID must stay a Family ID the payment method cannot be removed from it.

That last bullet point is important. It’s a bit weird, but Apple documents how to create an Apple ID that doesn’t have a payment method. You can use it to buy free apps and tunes.

You can’t, however, turn that Apple ID into a family organizer:

If you're the family organizer for a Family Sharing group and want to share purchases with your family, you're required to have at least one payment method on file. A payment method is also required to set up accounts for children.

If you have an Apple ID like that, and you try to make it a Family Organizer in macOS Mojave iCloud despite the warning, you’ll get this helpful error message:

“There was an unexpected error”. Yeah, Apple was serious about that “requires a credit card” warning, they just didn’t code the error handler response for those who ignored it. I figured given the kludgy workaround Apple documented that the warning was obsolete. Wrong.

Why does Family Sharing require a payment method? I suspect Apple’s hacked together back ends can’t prevent some purchases even when there’s no payment method — and Apple doesn't want to get stuck with the tab. Another possibility is that it’s needed as part of Organizer identity tracing in case a vulnerable child family member is at risk.

So, what do you do when you have too many kids and you need to dump one that’s under 13?

The only recourse, short of phoning Apple support, is create another full Apple ID (age over 18), make it a Family Organizer, and transfer the sub-13 to that “Organizer”. You need hardware to create a full Apple ID, but if you have a Mac you can do it just by adding a system user. I did that to upgrade a limited Apple ID I’d created long ago to a full Apple ID. I then tried to use this fake parent/Organizer without a payment method, which is how I got the “unexpected error”.

After I added a real payment method and confirmed iTunes could see the account change I tried to again make that Apple ID the Organizer for a new family. This took a while. At first the macOS Mojave iCloud Preference Pane would simply display a blank window. After about five minutes it worked. I presume a back end system got updated.

From there I hopped through the transfer process between the macOS account for my new Organizer Apple ID and my iPhone that currently managed my faux 11yo. Some of the screens i saw are illustrative:

I got an error message during the process saying the request had expired, but it went through anyway. I think I got that errant error message because I backed up a screen to do a screenshot. Yeah, this stuff is fragile.

So it appears for now that I’ve moved my fake 11yo from my true Family to a new fake Family where it will sit for another 2 years. Then it will turn 13 and I can vaporize it (I’ve created a future task :-) and then I can remove the payment method for the fake Organizer.

Once I get my strength up I may try to contact Support about some of the other problems with our Family Screen Time, like that handed down device still stuck to my daughters account (or I can just wait until she’s 18 and exits).

Now I need some Scotch, but it’s still a bit early here ...

- fn-

[1] Extending the existing Family Sharing to enable remote Screen Time management was a fatal error.

[2] The iPhone 6 can’t move beyond iOS 12, but Apple is still supporting iOS 12 on it, and since iOS 12 is superior to 13 in several ways the 6 is arguably now a better phone than the 6s.

See also:

• Two new discoveries in iOS Screen Time (parental controls): Age 13 and Apple ID incompatible with Screen Time
• Screen Time old device bug: Dev used device ID as key, forgot Apple ID
• iOS 12: "family sharing" is still for children only -- ask to buy disabled at age 18 in US

How to create a file system reference to an iCloud Note

My daughter wanted us to use a shared Apple Note for trip planning. That's fine, but I wanted a way to reference it from the macOS folder that held other trip documents.

This worked:

1. Open Safari and view the specific Note.
2. Drag the URL ref to desktop creating a .webloc file, name it as desired
3. Store .webloc file in folder

Funny bit: If you double-click the .webloc file it doesn't open Safari. It opens Mojave Notes.app with the specific Note selected and contents displayed.

This is the actual webloc content (I tweaked the GUID just in case it allows global access):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>URL</key>
<string>https://www.icloud.com/notes/0HxBnHC0QgNjaCyxlsPXOLLvw</string>
</dict>
</plist>

Getting Emily's iCloud photos -- you can multi-select in Photos.web (again)

As recently as 2018, Apple had stopped supporting multi-select in iCloud Photos.web. It was really annoying.

Today it works. I don’t know when this was fixed. It didn’t get a lot of attention in my streams.

It’s a big feature for me.  Now if I want to add photos from my wife or daughter I can browse to their iCloud accounts, select from Photos.web, and download. Much easier than switching to a user account, running Photos.mac, waiting for it to sync, exporting to a shared account, etc, etc.

One odd thing, the file “Modified” date is “Tomorrow at 12:15am”. Presumably a server time zone problem….

Screen Time old device bug: Dev used device ID as key, forgot Apple ID

There’s a well known old-device bug with Screen Time. Once you’ve setup up Screen Time for a child’s device it will always show up under their Apple ID — even after you wipe the device.

So my daughter’s old iPhone 6 showed up under her Screen Time Apple ID — even after it had been wiped.

Today I changed the Apple ID for that device and enrolled it in Screen Time under a new Apple ID. Then I went to look at her Screen Time device list. Lo and behold — the old device was still there, but now its device name changed to match the device name it had when I reenrolled it with the new Apple ID.

So now one device shows twice in my remote Family Screen Time, once under my daughter’s device list, once under the new Apple ID.

I’ve read that Apple’s Screen Time was a “rush job”. Looks like the dev is doing Screen Time by storing a device identifier — maybe a Serial Number and the device name used at enrollment time. They should have used a combination of Apple ID and device identifier but they used device identifier alone.

Two new discoveries in iOS Screen Time (parental controls): Age 13 and Apple ID incompatible with Screen Time

A reputable Twitter source recently wrote that “Screen Time” was "a rush job".

It feels that way. As part of a book project I’ve spent way too much time experimenting with Screen Time. It needs a top to bottom rewrite. Also needs an API so other vendors can extend what Apple offers. 

Anyway, I’ve learned two new things about Screen Time — two special ages and a hint about why one iPhone could not be enrolled in remote Screen Time.

First the ages. US Screen Time has two special ages: 13 and 18. We know about 18, but the 13 is new to me. 

If a Family Member's Apple ID birthdate means their current age is over 18 then remote screen time blocks are turned off. It’s an 18th birthday gift from Apple! This is a problem for special needs adults — chronologically 18 but very vulnerable. The workaround for a special needs adult is to set their AppleID birthdate so they are 14 (write down the birthdate you used, you may need it).

Note I wrote 14, not, say, 10. That’s because 13 is another special age. If a Family Organizer creates an Apple ID birthdate such that a family member’s age is under 13 they will see, after it’s been created, the message "Children under 13 cannot be removed from Family Sharing.” Not only can they not be removed, their birthdate cannot be changed either. You will need to call Apple Support to have changes made, and you may need to work with a supervisor.  Meanwhile any devices with that Apple ID will count against your sharing cap.

What else did I learn?

I learned that some Apple IDs won’t work with Screen Time. It’s not clear why; I assume it’s a obscure bug somewhere in Apple’s creaky identity management infrastructure. When I set up a test phone for my book project I used an old Apple ID of mine. Without going into the convoluted history, that Apple ID is descended from an old mac.com/MobileMe email account and it’s all way too complex to describe. In any case, even though I'd changed the birthdate so age was 14, remote Screen Time settings didn’t “stick”. I’d enable them, they’d flip back to off. I changed the device Apple ID to a fresh one created from my Family Organizer account (which is how I discovered the 13 yo bit) and now it works.

Since my test iPhone doesn’t have a SIM card I wondered if that was part of my remote Screen Time problem. It wasn’t — my setup worked fine. Interestingly when I set the Apple ID this way both FaceTime and iMessage also worked without a SIM card — no ‘waiting for activation’ issues.