Have you ever bought a second-hand electric device like Mac computer? Be careful when you plan to buy a second-hand Mac, as an iCloud bug (not sure if it is fixed now) may cause you to suffer great losses. Here’s tip for selling or buying a Mac: disassociate the device from any iCloud account that should not be able to access it.

Brenden Mulligan, a Google product manager, shared his experience about how he unknowingly had access to the location of an iMac he sold three years ago on Craigslist. Recently he found that a Mac he has sold long ago was still on his Find My iPhone device list, and he could see the computer showing up on a map about 100miles north of his house. The odd thing is that he did erase the device and performed a clean install of macOS before selling it. So how could this happen?

Brenden tried to contact the owner of the Mac, and concluded that it was quite likely because the buyer did not log into an iCloud account on the Mac. His account was still associated with the hardware, which allowed him to track the location of the Mac. He added that he still had the ability to play sound, lock and erase the Mac via iCloud. That sounds terrible as if so, the buyer would not be able to do anything on the Mac.

In this case there is not much security risk for the seller, but the buyer is in the risk of exposing his location privacy and may even lose the control of his device. Luckily the solution to this issue could be rather simple: the buyer just need to sign into his own iCloud account on the device, and turn on Find My Mac. or instead, the seller can disassociate the device from the iCloud account to cut off the access to it.

Also, the seller is supposed to turn off Find My Mac before wiping the device. Otherwise, the seller can still track down the device even after erasing the device.

Many other users also reported that they encountered this case. Unlike on a iPhone, logging out of the iCloud account on a Mac computer will not automatically turn off Find My Mac. It is not sure if this bug has been patched in the recent updates of Mac OS X/macOS. After all, this case is not so common, as most users would choose to sign into iCloud with their own accounts when they get a second-hand Mac.