OK, the April showers of stupidity from Apple continues.
The tl;dr situation is that my iPod uses for its Apple ID a very old email address that has apparently been co-opted by some other person with my name. Even though the Apple ID is itself an email address, the actual email address associated with that account goes elsewhere, making conventional password recovery impossible.
Fine…at some other time we can discuss the stupidity of allowing email addresses to be hijacked by people who don’t own them, or in allowing iPods to set themselves up using an Apple ID for which there is no known password – that’s all idiotic, but it’s not the issue right now.
I finally got sick of endless prompts for an iCloud password I don't actually have and called Apple Support yesterday. I got a woman who could not have been more helpful. She understood the problem, verified my ID, and did whatever esoteric magic was necessary to override the default email address on the account and send me a reset email. But here's where the stupidity becomes unbelievably manifest (and I want to emphasize that this is in no way the Apple Customer support person's fault).
When you ask to reset the password, the software immediately sends you an email saying that you’ve asked to reset the password. Then, at some random time in the next 24 hours or so, they get around to sending you the email with the actual link to be used to reset the password. Why not immediately? Who knows? If I were a less generous person, I’d assume that person responsible is out molesting goats in some unseemly fashion. But I can wait 24 hours.
24 hours later, roughly noon, the email finally arrives. I am, of course, at work. I get home, open the email, and at the bottom, it reads:
**Please note that the link will expire three hours after this email was sent.**.
*What. The. Fuck. * I mean literally, what the fucking fuck? You arrogant bastards can send me an email at any random time within 24 hours and I have exactly three hours to respond or I’m shit out of luck? Note that the preliminary email does not, at any point, specify that there will be a deadline for responding to the actual reset email. Apple has decided to let it be just one wonderful surprise.
Out of curiosity, what kind of security risk would a 24 hour window represent that a three hour window does not? Or rather, how is a 24 hour window any riskier than my having to call Apple yet again and go through the whole ID verification process, including disclosure of credit card numbers and double secret questions that I and only I could know?
TL;DR. Apple sent vital link with a three hour expiration date six hours before I usually get home. Everything’s still broken. I’m mega pissed.