Apple ID was used.. Message and PHLocation

[MNB]

Of recent last two-three weeks I've been getting hit with "Your Apple ID was used to sign in to iCloud via a web browser" the email contains the following:

Dear Michael Blackwell,
Your Apple ID (XXXXX@XXX.com) was used to sign in to iCloud via a web browser.
Date and Time: December 7, 2017, 6:43 AM PST
Browser: Opera
Operating System: Linux
If the information above looks familiar, you can ignore this message.
If you have not signed in to iCloud recently and believe someone may have accessed your account, go to Apple ID (https://appleid.apple.com) and change your password as soon as possible.
Apple Support

At first I thought someone in the family had done something with their iPads or iPhone (only one) as the message was indicating Operating system and Browser normally used on apple products. So I purged all of the devices browsers pages, turn off all of the devices and was still getting the messages when by accident I noticed in my HS PHLocation iAccount [XXX] status device that it was attempting to connect to iCloud (which it did successfully) and the time stamp matched the subsequent email time stamp.

So my question has anyone else experience this and if so what is the fix? I'm currently using the latest v3.0.1.109 PHLocation PI. Mike

[jlrichar]

My wife started getting that as well. I am a little confused with the Linux part as I run HS3 and PHLocation on windows.


Sent from my iPhone using Tapatalk

[cheeryfool]

We started getting this with our new iPhones. switching on 2FA made them go away. Haven't seen any in a week now. We were getting 3-5 a day each. Sometimes it included a general location, sometimes it included Opera and sometimes Linux. Odd, but gone now. We had already changed our passwords and that didn't fix it.

[Krumpy]

Don’t use pHLocation. I presume that it has some sort of cloud back end? If so, then maybe that cloud back end is triggering Apple’s security mechanisms and the originating host may be a Linux box...

I’ll have to read up on this technology and what it is used for. I personally use native Apple geofencing with a HomeKit backend which ties into HS3. Works well once you get it working. Now, not sure if that can do everything that you guys are doing with PHLocation....

Just wondering how much you’re exposing yourself by passing your AppleId credentials to another non Apple controlled infrastructure. That would concern me. But maybe I am just paranoid and maybe there is no risk at all. Like I said, i am not a user of this technology...

[randy]

Don’t use pHLocation. I presume that it has some sort of cloud back end? If so, then maybe that cloud back end is triggering Apple’s security mechanisms and the originating host may be a Linux box...

I’ll have to read up on this technology and what it is used for. I personally use native Apple geofencing with a HomeKit backend which ties into HS3. Works well once you get it working. Now, not sure if that can do everything that you guys are doing with PHLocation....

Just wondering how much you’re exposing yourself by passing your AppleId credentials to another non Apple controlled infrastructure. That would concern me. But maybe I am just paranoid and maybe there is no risk at all. Like I said, i am not a user of this technology...

"Don’t use pHLocation" - really?

You have to expose your iCloud credentials when you log in to your iCloud account from a browser. This is no different. The limitations to access are the same as if you were using a Windows browser to access your iCloud account.

PHLocation is a wonderful plug-in and it is very safe. It is only accessing iCloud for location services. We couldn't live without PHLocation. We track locations, fences and iBeacons with iCloud and GeoFency with PHLocation. Events triggered by PHLocation set energy, announcements, climate and all sorts of other items. I would estimate that 50% or more of our more useful events are dependent on PHLocation.

Full disclosure: I have worked with Paul (the developer) on this plug-in since he started it. We have worked together to expand functionality, reliability and usefulness. It works with Android or iOS devices.

WRT the iCloud nag emails, I am having them as well over the last few days. Paul is aware and will be looking into it over the weekend. iCloud recognizes PHLocation as Linux, regardless of the host O/S for HomeSeer as he uses his own web server and client in the plug-in. Expect that he will chime in if/when he finds something. I will post as well when we figure out why mine is acting up.

[cheeryfool]

There's no cloud infra for PHLocation. PHL is the plugin that runs on your HS hardware and interacts with various genfencing and position services available on Android/Apple phones. One of those is the native iCloud position service used by the Find My Iphone app. Paul has changed the authentication with iCloud several times as Apple has changed the way it works. We have seen these nagging emails a couple of times historically and he has been able to work around it. As Apple continues to up the authentication it seems that anyone now not using 2FA may be seeing this behavior. It seems 2FA will be mandatory before long. Now that we have switched it on the emails have stopped. I can't explain the odd OS/browser references though.