I finally stopped ignoring the little red "1" on Settings > General > Software Update this week and let iOS 7.0.2 install on my old 4S last night while I brushed my teeth. Wasn't planning on writing about it, but then I actually read what it patches and got kind of annoyed on Apple's behalf. Or maybe at Apple's expense. Hard to say which.
If you missed it: on the 26th, Apple pushed 7.0.2 mainly to close a lockscreen bypass that let anyone holding your phone get into your photos, contacts, Twitter and Facebook, even make phone calls, without ever touching your passcode. No jailbreak, no cable, nothing fancy. Just a sequence of swipes, pull up Control Center from the lockscreen, open the Clock app, hold the power button until the slide-to-power-off screen shows up, cancel it, double tap home to bring up the app switcher, and you're just in. Someone in Spain worked this out and posted a video days after iOS 7 shipped, and it spread fast because it's a two-hand, fifteen-second trick, not some obscure lab-only exploit.
What gets me is this isn't even the first lockscreen hole iOS 7 has had. There was already one involving the Greek keyboard that let you dial out or poke around Photos without unlocking. 7.0.2 patches both of them in one go. Two lockscreen bypasses inside the first ten days of a major release isn't a great look for a company whose whole pitch is "it just works."
I get that iOS 7 was a total rebuild of the interface, not a new coat of paint on the old one, so there's more surface area for stuff like this to slip through during testing. Doesn't make it any less annoying when the thing getting bypassed is the one security feature most people actually understand and rely on every single day.
Small tangent, since I'm already complaining: the redesign itself still isn't sitting right with me two weeks in. Not the icons, I genuinely don't care about the icons. It's the zoom and parallax animation when you unlock or open an app, the way the wallpaper shifts underneath the icons when you tilt the phone. My stomach did a real "nope" the first three or four times I used it on the bus into work. Apple buried a Reduce Motion toggle way down in Accessibility settings that turns most of that off, and I've had it flipped on since about day two. If your own phone is making you queasy, it's under Settings, General, Accessibility, Reduce Motion. Worth the thirty seconds to find it.
Anyway, the actual fix works. I tried the Control Center trick on my own phone before updating, just to see if it was real, and it absolutely was (took me maybe four attempts to get the timing right). Couldn't reproduce it after installing 7.0.2. If you've got an iPhone or iPad on iOS 7 and haven't updated yet, do it before you leave your phone face-up on a bar table. That's really the whole security model for most of us: whoever's hands the phone lands in next.
I don't think this is some huge scandal. Software ships with bugs, that's just how it goes when a few hundred million devices update to a new OS inside the same three weeks. But a lockscreen bypass is a different category of bug than a laggy animation or a battery drain complaint, because the entire point of a lockscreen is that it doesn't have exceptions. An exception is the bug.
If you want to check what's fixed, 7.0.2 should be sitting in Settings, General, Software Update right now. Small download, took mine under two minutes over wifi at home. No new features tucked in as far as I can tell, just the two lockscreen fixes and something about enterprise account setup I skimmed past without reading closely.
Worth doing tonight rather than next week is my only real advice here.