Why Stolen Device Protection makes Passwords safer

Scott, a reader, questioned whether directing users towards Apple's Passwords, Wallet, and Safari ecosystem could lead to weaker security if their device is stolen. He noted that a thief with access to the device and its passcode could gain control over the content stored in Apple Passwords. While this may seem plausible, it's not as likely as it appears.

The theft must follow a sequence of events: the device must be stolen, the thief must obtain the passcode or coerce the user to reveal it, and the thief must have enough time to exploit the stolen device before the user remotely wipes it. This is less likely with iPhones due to their constant presence and the Activation Lock feature that prevents thieves from reselling the device.

Moreover, thieves are more likely to use phishing tactics to obtain the passcode after they have the device. To address this concern, Apple introduced Stolen Device Protection in iOS 26.4, which is designed to deter thieves by adding delays and biometric authentication to protect user data and accounts. Stolen Device Protection locks actions like changing the Apple Account password and viewing passwords in Apple's Password system for an hour, requiring biometric authentication such as Touch ID or Face ID.

This feature aims to keep secrets safe, although it may leave users under duress for an hour if they are forced to use biometrics. However, the likelihood of such a scenario occurring is extremely low.