iOS Privacy: Easily get a user's Apple ID password, just by asking • Hacker News Board

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#41

Post by UnoriginalGuy » Tue, Oct 10, 2017, 2:09 PM UTC

vbezhenar wrote: post #11

vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

There are many solutions. First is requiring un-catchable keyboard shortcut to enter the password. Something like "ctrl-alt-delete" for Windows (I'm not sure if it's un-catchable, but you got an idea) or even better some unused key like pause/break. User will be trained to press this shortcut and app can't replicate it, so user won't be tricked. Second is using fingerprint. iOS should just use fingerprint always inst…

You're right about CTRL-ALT-Delete, the problem is that users are terrible at remembering to do so without being prompted. I created a Windows XP phish-login box back in the day, that simply took you right to the login box without prompting for the key-combination, and nobody found it (and happily entered their credentials).

Any system that relies on humans to do the right thing is doomed to failure. Even something as trivial as hitting three keys each and every time they login; part of the problem with it is that it is so inconsistent (i.e. different Windows machines either do or do not prompt for the key-combination based on their configuration, so users have a mental model of skipping it).

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#42

Post by zwily » Tue, Oct 10, 2017, 2:09 PM UTC

blowski wrote: post #35

eli wrote: post #30

Earlier quoted context omitted.

It's a good idea, but a security solution that relies on users noticing when something is absent is not exactly airtight.

No solution is airtight, but if it makes it better for 10% of users without making it worse for the other 90%, it seems like a good idea.

My guess is that a large % of unsavvy users would put their password in that field, making things much, much worse.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#43

Post by UnoriginalGuy » Tue, Oct 10, 2017, 2:11 PM UTC

dx034 wrote: post #13

vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

A solution is to only ask for the password when absolutely necessary. I still don't understand why I need to enter a password (or use touchID) to download a free app. Shouldn't it be enough to login when I want to buy something for the first time in-app? AFAIK that's how android handles it.

It is free in cost, not in terms of your privacy.

For example let's say you handed your phone to your kid, they downloaded a free app, gave that app your entire contact list, and then that app spammed everyone you know? For the sake of example let's call that app LinkedIn.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#44

Post by zippergz » Tue, Oct 10, 2017, 2:11 PM UTC

josefresco wrote: post #36

smcl wrote: post #2

For a while iOS would just seemingly randomly ask me to enter my icloud password. I’m so used to this that without reading this article I would have literally fall for this every single time.

I have a joke with my family that I am forced to enter iTunes password on at least one iOS device - daily. We share one iTunes account, and when you enter the password on one device, all the others prompt for a password when unlocked. It's mildly frustrating when you have kids, and multiple iOS devices. The scenario goes like this: One of my kids' Messages app stops working (thanks Apple!). I am forced to turn off/on…

An aside, but wouldn’t you be better off with each person having their own Apple ID and using family sharing to share apps and such?

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#45

Post by throwaway613834 » Tue, Oct 10, 2017, 2:12 PM UTC

> But, but, but, why is the . symbol within the ", is this all fake?

Fun fact for those who (like me) didn't know for a long time... technically "gmail.com." is actually the domain name for Gmail. It's called the fully qualified domain name (FQDN), akin to an absolute domain name (as opposed to relative to the current subnet).

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#46

Post by UnoriginalGuy » Tue, Oct 10, 2017, 2:16 PM UTC

blowski wrote: post #35

eli wrote: post #30

Earlier quoted context omitted.

It's a good idea, but a security solution that relies on users noticing when something is absent is not exactly airtight.

No solution is airtight, but if it makes it better for 10% of users without making it worse for the other 90%, it seems like a good idea.

It will just be used for blame shifting.

"You didn't notice one of the dozen popups asking for credentials lacked your magical hidden phase YOUR FAULT!"

If Apple were going to explore a strategy to fix this, they would likely be better off redirecting the user out of the app before asking for credentials, or prompting them in notifications/home screen only.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#47

Post by calvinbhai » Tue, Oct 10, 2017, 2:16 PM UTC

krausefx: the warrior dev who unleashed his weapons on evils iOS app signing and app store submission processes, now trains his guns on iOS privacy gotchas :)

Thanks Felix for these works! Hopefully your work on pointing these issues get the necessary attention from Apple soon!

I have hated those alerts for iTunes passwords so much, and always entered password from Settings app. But never realized what a security nightmare it can be for those who are not iOS/Devs.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#48

Post by andrewla » Tue, Oct 10, 2017, 2:16 PM UTC

mcphage wrote: post #25

Once an OS trains it’s users to enter their password without thinking about it, because of random (seeming) password prompts, they’re already fucked. Apple screwed this up on iOS years ago.

This is the key here; immunity to phishing is something you have to fight for. Even if Apply changes to no longer prompt like this, or to make the "official" prompt significantly different, the damage has already been done. 75.3% of users will see the "old-fashioned" prompt and just assume it's kosher because some subcomponent hasn't updated or something and that's game over.

It was a mistake to ever have these prompts -- the most they should have said is "go to the settings app and re-enter this information" or something similar. Now we're stuck relying on Apple's App Store screening to shield people from this vector. I'll continue my policy of always ignoring these popups, so hopefully I'll be safe.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#49

Post by UnoriginalGuy » Tue, Oct 10, 2017, 2:17 PM UTC

zaroth wrote: post #19

At least with TouchID I think I've stopped having to ever type my iCloud password into random popups anymore. I'm sure there are still corner cases where it would want the literal iCloud password but I don't remember the last time I saw the prompt, versus before TouchID the random password prompts were pervasive and discomforting.

TouchID has been removed from the iPhone X.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#50

Post by mikeash » Tue, Oct 10, 2017, 2:17 PM UTC

mcphage wrote: post #22

dx034 wrote: post #13

Earlier quoted context omitted.

A solution is to only ask for the password when absolutely necessary. I still don't understand why I need to enter a password (or use touchID) to download a free app. Shouldn't it be enough to login when I want to buy something for the first time in-app? AFAIK that's how android handles it.

You need to enter your password when downloading a free app so that if someone finds your phone they can’t install a malicious hacking or key logging app on to your phone. Installing apps is a security risk, not just a financial issue.

If someone finds my phone, it'll be locked and they won't be able to install anything. If they can unlock the phone then it's already game over for me.