Siri will let anyone make calls or send text messages and e-mails from a locked iPhone 4S, even without knowing the passcode, Macworld reports.
The lock feature still prevents unauthorized users from doing anything that involves keystrokes, but it does not disable the voice-activated Siri, so any task that can be done through Siri is fair game for a hacker.
Elinor Mills of CNet reported that she was able to send a text message, make a call and send an e-mail, all without knowing my friend's passcode. Another colleague confirmed that she could get an address and a phone number out of the phone and even see the calendar.
That's right -- you can pick up a friend's locked iPhone, ask Siri, What's on my calendar tomorrow? and see all the events your friend has scheduled.
Or worse: We had a PCWorld editor pick up my locked iPhone 4S, activate Siri and compose a resignation letter that was sent to my Macworld email address, Roman Loyola of Macworld wrote. He quipped, We didn't send it to my boss, just in case he decided to actually accept my resignation.
Although this seems like a huge oversight on Apple's part, the company was clearly aware of it, because there is an option in the iPhone 4S's Passcode Lock settings to disable Siri when the phone is locked. But for some reason, the default setting is to enable Siri when the phone is locked, and many iPhone 4S owners don't know that.
What's disappointing to me ... is that Apple had a clear choice here, Graham Cluley wrote in a blog post on the tech Web site Sophos. They could have chosen to implement Siri securely, but instead they decided to default to a mode which is more about impressing your buddies than securing your calendar and email system.
On the iPhone 3GS, which was released in 2009, some voice-activated features were available on locked phones, but not as many as Siri allows.
Never fear, though: as Loyola reminds us, if you go into your Passcode Lock settings and disable Siri, When you hold down the Home button, nothing happens. No fake resignation letters are sent to your boss, no demands for a divorce are texted to your spouse.