federalcto.com The Blog of a Federal CTO

Apple doesn’t like kids (and their iTunes security stinks)

This is the story of why Apple is slowly losing favor in my household, even though both of my kids use Mac Minis, I have 3 MacBook Pros (2 personal, 1 work), a boat load of various iPods, iPhones, iPads, AppleTVs and other Apple devices. It turns out that Apple does not want my daughter, or kids under 13, to use their devices.

It's all about the iTunes store, and their need to put security in blindly, without regard for their end user community, or a serious thought about how people use their products. Below is the entire thread I've had with Apple support, but to make a long story short, Apple recently put in a requirement that all users of the store answer 3 challenge questions. This seems like a great idea, and many other online sites (notably online banks) already use such a mechanism. However, when you think about who Apple sells to, and what they provide, it's very poorly thought out. The bottom line is:

1. I have to answer these 3 questions, or I cannot make any more purchases; that includes free songs, Starbucks 'pick of the week,' my company's apps (which are all free, I believe), and anything that comes via the iTunes store
2. I am not supposed to share my account with anyone else
• This including my wife (who owns an Apple iPhone)
• This includes my 11 year old daughter (who got an iPod Touch for Christmas - the only gift she wanted)
3. I cannot opt out of answering these questions to make any further purchases
4. I cannot create my own questions which I can then share with my family

In the thread, I point out to Apple some other options I'm willing to take, but none of those are possible, according to the last response from support. I also think it's ridiculous for them to suggest that my wife, daughter and I all have to buy the same apps, songs, and other content from the iTunes store, instead of sharing it all under 1 household account. Basically, Apple has said that my daughter cannot use the iPod Touch in the way they intended, and advertise. I wish they had put a warning on it saying, "please do not purchase this device for your children," but their commercials and marketing don't mention a single thing about any of this.

And so, I have to reconsider whether we're going to continue to use the 2 iPhones, 1 iPod Touch, 2 iPads, 4 Mac Minis, 2 AppleTVs, 3 MacBook Pros and other Apple gear we have. All because of a poorly designed feature, meant to enhance security, but one that makes me very uncomfortable.

So here's the entire thread, re-ordered so you can read it from top to bottom. I've removed out identifiable information, such as case numbers, and email addresses, but that shouldn't alter the exchange at all.

-----------------

(This was my first entry on the Apple support site, so it was not an email I sent, but one that the support person initially received)

First Name : Dmitry
Last Name : Kagansky
Email : apple@customdomainname.com
Lang_Country : en_US
Product : iTunes Store
Support Subject : Purchases, Billing & Redemption
Sub Issue : How do I opt out of providing the security questions that are now required?
GCRM Case ID : XXXXXXX
See additional info below
What device did you use to connect to the store?  Mac computer
Which operating system is installed?  Mac OS X v10.7.x
What version of iTunes is installed on your computer?  iTunes 10.6
Choose the iTunes Store or App Store for your country:  United States
Item title:
Order number:
Details:
How do I opt out of providing the security questions that are now required? I share my account with my wife and  11 year old daughter, who both have apple devices. They don't need to know my security questions.

-----------------

Hi Dmitry,

Good day! Thank you for contacting iTunes Store Support. I'm Grace and it's a great pleasure to assist you with your concern.

I understand that you want to remove the security question that you're required to answer in order to continue purchase from the iTunes Store.

Dmitry, from time to time, Apple enhances the security of our valued customer's iTunes Store accounts. I apologize for any frustration this has caused, and I assure you that the recent changes are not meant as an inconvenience, but rather to help safeguard your account details and activity. Apple is pleased to provide this feature and hopes that keeping your safety in mind, will help you to better enjoy the iTunes and App Store.??With this new system in place, when a purchase is attempted from a new device or computer, the store selects, at random, two of the three challenge questions for your Apple ID to verify that you are the account owner. If the questions are answered incorrectly ten times, your account becomes temporarily locked. When your account is locked, you cannot make purchases using any device that has not previously used the Apple ID. It also prevents you from changing your challenge questions. However, you are still able to make purchases using a trusted device.??At this time, in order to add this feature to existing iTunes Store accounts, Apple had to pre-set the questions on your Apple ID. When you are not able to access your account, I can clear the challenge questions for you.??Once I do this, you will be able to sign in and add your own challenge questions. You will also have the option to enter a "rescue" email address. This option will allow you to send a message to the rescue email, should you forget the answers to the challenge/response questions in the future.??Now, in order to clear the questions for you, Apple requires that you provide at least one of the following, for your security:??- the order number of one of your purchases?- the last four digits of the credit card used for your iTunes Store account??And two items from this list:??- your birth date?- the billing address listed on the account?- the phone number on the account??Upon receiving your response, I will verify your information and clear the pre-set challenge questions.??Once again, I apologize for any inconvenience this situation has caused and I look forward to your reply.

Sincerely,

Grace
iTunes Store/Mac App Store Customer Support

Please Note: I work Friday-Tuesday, 9am-6pm CT

-----------------

Please clear out the challenge questions.

- A recent order number is:
XXXXXXXX

- the phone number tied to the account is:
770-xxx-xxxx

- the billing address is:
XXXXXXXXX
XXXXX GA XXXXX

Please let me know when this is ready. Thank you.

-----------------

Hi again Dmitry,

Thank you for getting back to and providing the information I have requested.

Dmitry, I wanted to let you know that in an effort to better assist you I have consulted  with a Senior iTunes Store Advisor who has advised me that you have to confirm your account name as "apple@customdomainname.com". Also, you cannot opt out of providing the security question on your account.

Also, we checked your account and found out that the security question have not been set and we cannot reset it.

To set security questions, sign in to http://appleid.apple.com with your Apple ID and follow these steps:

1. Click the "Manage your account" link
2. Enter your Apple ID and password then click "Sign in"
3. Click "Password and Security" on the left
4. Enter your new security questions and answers then click Save
5. Click Sign Out in the upper right-corner of the site

Once you have answer your security questions, you can sign into your iTunes Store account and try your purchase again.

If you have any other questions and concerns regarding this matter, please feel free to email me back. Thank you for choosing the iTunes Store. I hope you have a fantastic day!

-----------------

I'm confused. I don't want to answer the 3 challenge questions you provide. I don't need my daughter needing to know those answers. I don't mind providing my own questions and answers, though. I can also provide a security question. How would you like me to do that?

And what's the problem with my email address?

-----------------

(Note: At this point, I just went ahead, registered 3 bogus questions with Apple, along with a new email address I created at customdomainname.com specifically for this whole adventure, which is why the next email is also from me.)

-----------------

Ok. I've answered your silly challenge questions and have set up a rescue email address (fuck_apple@customdomainname.com). Can you now reset the challenge questions so that I can enter in my own questions and answers as you told me I could do originally? I don't really care for the answers I put in for all 3 and won't remember them on an on-going basis.And, long term, I'd love to know how apple intend on doing this for households that share an apple id. It doesn't look like much thought has been put into how to work with people that own a ton of apple equipment among members of the same family.

-----------------

Hi again Dmitry,

Thank you for getting back to me.

I understand that you want to reset the security question on your account to create questions on your own. Before we could do that, please note that you cannot opt out of the security question and it is not possible to create your own security question after we reset it for you. You have to choose from those questions and provide the answers.

While I understand that this change was not announced, Apple is constantly looking for ways to improve the security of the iTunes Store and help safeguard your account details and activity. The security questions were implemented for your protection and will help ensure that no one other than you can gain access to your account on a new device, without your direct authorization.

Please know that this innovative system is not intended to upset you; it is in place for your peace of mind. I can certainly appreciate that you would like to retain the old sign in format, however, this new format will soon be the same on all iTunes Store accounts and Apple IDs. The following page outlines, in detail, how Apple protects your information:

Apple Privacy Policy
http://www.apple.com/legal/privacy/

While you may never have fallen victim to an account breach, please understand that Apple does not want your account to be in jeopardy at any time and feels that this new security feature will only make your experience safer and more enjoyable.

If you would like to voice your opinion on this new feature, I encourage you to use the iTunes Feedback page to submit your comments about Apple's new security enhancement here:

http://www.apple.com/feedback/itunesapp.html

By taking the time to contact Apple about your concerns, you provide valuable input on how to make iTunes better for everyone. Apple recognizes that no one is better qualified to provide feedback about iTunes than the people who use it. Your email may make the difference.

While you will not receive a response from this department, please be assured that the advisors who review all of our patron's concerns do take these matters seriously. The more feedback we gather on these issues, the better and more likely to incite changes. Your efforts to share your feedback are very much appreciated.

Also, please feel free to review the iTunes Store Terms and Conditions which outline Apple's right to enhance features and make changes to your account and the iTunes Store:

http://www.apple.com/legal/itunes/us/sales.html

Thank you for your patience and understanding in this matter, Dmitry. Your experience is very important to us and we truly appreciate your continued devotion to the iTunes Store. Please let me know if there is anything else I can assist you with.

-----------------

1. I want my challenge questions reset. That request still hasn't been satisfied. I answered them with the impression that I'd be able to change them to something of my own choosing later. Even if I can't do that, I don't like the answers I provided. I need to reconsider the answers if I'm actually to share this account with others.

As a final note, I will probably post this thread on www.FederalCTO.com. It is a blog I run and find this to be very interesting content for it.

-----------------

Hi again Dmitry,

I do want to start out by offering my apologies for this situation and assure you that I will do everything I can to help you get this resolved. It is not my intention to frustrate you.

Dmitry, I have reset your security questions for you. To choose new security questions, sign in to http://appleid.apple.com with your Apple ID and follow these steps:

Once you have reset your security questions, you can sign into your iTunes Store account and try your purchase again.

Again, I apologize for any inconvenience this may have caused you, and I thank you for being an iTunes Store customer.

-----------------

I am not frustrated. I just find it interesting that your product group is so short-sighted to not have provided you with an appropriate response to my simple question. Which is, how does apple expect me to share my account with my family members, and without disclosing my challenge questions to them? I've offered several suggestions (opt-out, or create my own Q&A) but it seems neither one is possible. We're at an impasse, as I can't use iTunes in the way it's currently set up and you're not giving me other options.

-----------------

The changes made by Apple is not meant as an inconvenience to it's customer. Apple doesn't expect anyone to share their accounts, technically we expect customer's to each have their own iTunes Store accounts as stated from the iTunes Store Terms and Conditions which outline don’t reveal your Account information to anyone else:

http://www.apple.com/legal/itunes/us/sales.html

Apple is doing this changes to increase the security of our customer. I appreciate your understanding for this changes.

Again, I apologize for the inconvenience this changes may have caused you. Apple cares about it's customers and we want you to continue enjoying  our products and services.

-----------------

How do you reconcile your stance with 11 year old minors? Do you really expect my daughter to have her own email account, credit card, etc? And how do you expect her to answer the challenge questions should she have her own account? Or would you rather minors not own apple devices that use iTunes? When she accepted the EULA of the iTunes store, do you really think that's legally binding?

I should point out that google and others do not allow minors under the age of 13 to have accounts with them.

-----------------

Dear Dmitry,

We appreciate your interest letting your 11 years old daughter using the iTunes Store.

To buy from the iTunes Store, you need to be at least 13 years old.

If you have any questions after she turned 13 and create an account, please don't hesitate to contact us at that time. We will be happy to help you.

Also, a change to the iTunes Store Security Policy now requires you to choose three challenge/response questions. The questions are pre-assembled, and can not be changed, and you can not create your own questions. You need to choose 3 of the pre-assembled questions.

The iTunes Store asks you to answer challenge/response questions when both of the following happen:

You try to make a purchase on the iTunes Store using a device that has not previously used your Apple ID.

You do not have a credit card on file for your iTunes Store account.

You can edit your challenge/response questions at the My Apple ID site: https://appleid.apple.com/.

NOTE : You can optionally enter a "rescue" email address when you choose the challenge/response questions. Apple sends a message to your rescue email address when you forget the answers to the challenge/response questions.

I apologize that there is no other option available, you will need to choose from the list of questions provided.  If you do not wish to provide answers to the questions provided you will be unable to use the iTunes Store.

Thank you for choosing the iTunes Store. I hope you have a fantastic day!

Sincerely,

Grace
iTunes Store/Mac App Store Customer Support

Please Note: I work Friday-Tuesday, 9am-6pm CT