The article does it right: test@test.com
and other similar things (e.g: a@a.com
) will throw an error the first time you put in a password and it’ll proceed to create an offline account.
The people that go through the steps like commands and disabling internet are making too much work for themselves.
Lockdown mode was released as a countermeasure specifically against Pegasus the first time it made the rounds as it disables many ways that are commonly exploited as the initial vector point - mainly attachments, links and previews in texts, as well as certain complex web browsing technologies.
I’ve had Lockdown mode on since it’s been released. I miss having 2FA code autofilled from text messages, and there’s the occasional website that’ll need to be whitelisted as it may display an emoji instead of a custom font… but aside from that, it’s barely an inconvenience.
Your telco is always going to be a weak point in a scenario like this, but better that than your phone because a hostile actor sent you a text message that embedded silent persistent spyware.