2nd hand device: iCloud syncs to previous owners account

[TheSangoma]

A few months ago, I bought a second hand ipad mini.
The seller reset it, and I did as well.

Been going OK, used as a spare when other batteries go flat, so used by all in the house.

This morning my daughter was watching movies, when suddenly it started constantly coming up with the icloud log on every few seconds. Couldn't do anything with it, took ages even to get into settings with the log on popping up continuously.

The log on email I recognised as that of the person I bought it from. Nobody in the house would have ever seen the address before.

Then I looked at the photos, as my daughter said she had some photos she wanted, and I should not reset it.

In the photos was all the previous owners photos, from September last year, up to and including yesterday!

I contacted the previous owner, and he could not remove the device from his account, so I asked him to temporarily change his password and give it to me so that I could log out of his icloud (could not even log out without a password)

Turns out that my daughters photos had also been uploaded to his icloud!!

Fortunately I knew how to contact him, also the photos were respectable, and didn't contain sensitive information.

It was also wanting to sync emails etc. so there is a good chance that it would have downloaded his emails as well, I didn't allow it to, so I don't know..

As the ipad had been reset at least twice, the only information it could have used would be the serial number.

Under different circumstances, this could have been a very distressing and probably expensive experience.

 

[bwana]

As the ipad had been reset at least twice, the only information it could have used would be the serial number.

No, it was still linked to the old owners iCloud account - you said so yourself.

 

[vinodh]

No, it was still linked to the old owners iCloud account - you said so yourself.

Exactly. Resetting the iPad without removing it from the previous owners account is not a good idea.

 

[SauRoNZA]

Hardly seems like an iCloud Security risk and more like an uneducated user risk to me.

 

[TheSangoma]

Hardly seems like an iCloud Security risk and more like an uneducated user risk to me.

Fully agree, considering the technical abilities of the average ipad/iphone user (that would not apply on a forum of this nature obviously) that is exactly why there is a risk.

The person who sold it has above average user computer skills, although not near to being an expert, certainly not a total fool.

 

[MagicDude4Eva]

The previous owner should have just gone to General > Reset > Erase All Content and Settings - this would have reset the device to factory defaults. Looks to me that the previous owner did not do that - or?

 

[krycor]

The previous owner should have just gone to General > Reset > Erase All Content and Settings - this would have reset the device to factory defaults. Looks to me that the previous owner did not do that - or?

Yup, i done that and it reset the device to be like new besides removing the backup etc after new device converts it.

 

[TheSangoma]

The previous owner should have just gone to General > Reset > Erase All Content and Settings - this would have reset the device to factory defaults. Looks to me that the previous owner did not do that - or?

The previous owner did that, so did I before adding it to my Meraki

 

[MagicDude4Eva]

The previous owner did that, so did I before adding it to my Meraki

So how can it sync to the previous owners iCloud account? Whenever I reset the device, I had to enter iCloud credentials. I did this recently when I gave an iPad to my son. The tablet asked for new iCloud credentials during setup.

 

[TheSangoma]

So how can it sync to the previous owners iCloud account? Whenever I reset the device, I had to enter iCloud credentials. I did this recently when I gave an iPad to my son. The tablet asked for new iCloud credentials during setup.

The only thing that was not reset was the serial number of the ipad.
The serial number is what is used to authorise it on the account it seems.