Apple users are being locked out of their Apple IDs with no explanation

Original Article ↗ Hacker News Discussion ↗

Reports of Apple ID lockouts

  • Many users report sudden sign-outs or forced password resets across iPhone, iPad, Mac, and web, often with no clear trigger.
  • Some accounts were temporarily locked and recoverable; a few report permanent bans or “deleted” accounts with generic legal notices.
  • Lockouts affect both long‑standing mac.com / me.com accounts and newer icloud.com ones; some use Gmail or custom domains.

Speculated causes

  • Credential stuffing / dictionary attacks against leaked email lists, especially @icloud.com addresses, is a common hypothesis.
  • Others suspect over‑aggressive fraud/abuse or AI-driven heuristics, possibly misfiring on unusual locations, VPNs, or “sketchy” TLDs like .xyz.
  • A minority raise more extreme ideas (e.g., hardware backdoors, internal Apple leak) with no confirmation. Root cause remains unclear.

Impact of losing an Apple ID

  • Apple ID underpins App Store access, iCloud sync/backup, Find My, subscriptions, and “Sign in with Apple” logins; some equate loss with partially bricked devices.
  • For users tying email, photos, docs, notes, and 2FA to Apple, lockout is described as potentially life‑disrupting, not just an inconvenience.

Recovery experiences and support

  • Some regain access quickly via another device or standard reset; others endure weeks or months of automated loops, distant callbacks, and opaque denials.
  • Apple’s status page typically shows “all services normal,” reinforcing perceptions of PR‑driven outage reporting.
  • Developer program enrollment/renewals are another pain point: vague errors, long delays, DUNS friction, and support hand‑offs.

Security features and recovery keys

  • 2FA, passkeys, hardware keys, and recovery contacts are praised for preventing extra verification hurdles with other services; some say enabling 2FA reduced Apple lockouts.
  • Apple’s Recovery Key and Stolen Device Protection are seen as double‑edged: more secure but easier to self‑brick, and delays when away from “familiar locations.”
  • Separate thread: macOS FileVault recovery keys silently changing or becoming invalid after updates alarms security‑conscious users.

Ecosystem lock‑in and data portability

  • Strong debate over how “trapped” users are. Some say moving to Android/Linux or other clouds is quite doable; others point to non‑tech users and photo/notes export friction as effective lock‑in.
  • Apple and other vendors’ account‑tied activation, Find My, and app stores are criticized as turning owned hardware into conditional rentals.

Comparisons to other providers

  • Similar arbitrary lockouts and weak support are reported for Google (Gmail, Drive, YouTube) and Microsoft accounts.
  • Many argue large identity providers now wield “government‑like” power without due process or meaningful appeal.

Mitigations and user practices

  • Common advice:
    • Use your own domain for primary email; avoid @icloud.com/@gmail.com lock‑in.
    • Keep independent backups of photos and files (Mac mini, Time Machine, NAS, Immich, iCloud-download tools, other clouds).
    • Don’t rely solely on Apple Keychain; export passwords periodically to an encrypted file or third‑party manager.
    • Avoid using the same Apple ID on employer‑managed devices.

Broader concerns and remedies

  • Many call for stronger consumer protection, antitrust action, and regulated obligations for identity providers (appeals, SLAs, limits on arbitrary bans).
  • Some see self‑hosting or more commoditized personal infrastructure as the long‑term answer, though others doubt its practicality for the average user.