Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS Privacy: Easily get a user's Apple ID password, just by asking

krausefx.com

Post reply on HN
Print view View original

61–70 of 326 posts

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#61

Post by krausefx »

calvinbhai wrote: post #47

krausefx: the warrior dev who unleashed his weapons on evils iOS app signing and app store submission processes, now trains his guns on iOS privacy gotchas :) Thanks Felix for these works! Hopefully your work on pointing these issues get the necessary attention from Apple soon! I have hated those alerts for iTunes passwords so much, and always entered password from Settings app. But never realized what a security nig…

Thanks, really appreciate your comment. I'm trying my best to raise awareness, and help Apple protect the user's privacy

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#62

Post by jsjohnst »

UnoriginalGuy wrote: post #43
dx034 wrote: post #13

Earlier quoted context omitted.

A solution is to only ask for the password when absolutely necessary. I still don't understand why I need to enter a password (or use touchID) to download a free app. Shouldn't it be enough to login when I want to buy something for the first time in-app? AFAIK that's how android handles it.

It is free in cost, not in terms of your privacy. For example let's say you handed your phone to your kid, they downloaded a free app, gave that app your entire contact list, and then that app spammed everyone you know? For the sake of example let's call that app LinkedIn.

> For the sake of example let's call that app LinkedIn.

It’s bad that LinkedIn has such a reputation that I automatically assume they likely did just as you alluded that they might’ve done.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#63

Post by BCM43 »

throwaway613834 wrote: post #45

> But, but, but, why is the . symbol within the ", is this all fake? Fun fact for those who (like me) didn't know for a long time... technically "gmail.com." is actually the domain name for Gmail. It's called the fully qualified domain name (FQDN), akin to an absolute domain name (as opposed to relative to the current subnet).

Do you have a source for this? I've not heard this before. The Wikipedia article on FQDN doesn't mention ti.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#64

Post by pilif »

Sir_Cmpwn wrote: post #33

Dialogs owned by the OS should probably pull the drawer down and display in there. The simplest way is not allowing the application to access some sacred part of the UI, and putting system stuff there. Same thing web browsers do.

A phishing dialog could fake the drawer. Apps can and do regularly use the full screen which is something web pages don't do and which will require extra user confirmation for precisely this reason.

Denying apps full screen access is very detrimental to the overall UX so that's not going to happen.

The other solution is to have apple never prompt for that password aside of during the initial setup process after installing an update.

Then you could at least give the advice to never enter your Apple ID-Password anywhere unless you've just re-installed the OS.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#65

Post by skykooler »

iamben wrote: post #28

Why not ask users to set a unique phrase to identify themselves when you set up the OS? If this phrase isn't in the box that asks for a master password, you know it's phishing. Hell, just put that IN the copy on the master password box. "If the words below do not match your unique phrase, do not enter your password." If I see "Green eggs and ham", I know it's safe to put in my password.

This is the approach my bank's login uses.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#66

Post by have_faith »

Isn't this one of the oldest tricks in the book? the following story is completely made up...

When I was in college me and a friend re-made the win2000 login sequence in visual basic to play pranks on people. After typing username and password it pretended to load and then just quit itself so the desktop would show so it looked like everything was fine. We'd then go in and do the classic "take a screenshot of your desktop, set it as you wallpaper and hide the icons".

Could apple just make a dialog style unique to OS level prompts? not foolproof, but you can't customise os blocking dialogs from apps so you couldn't replicate the behaviour if you tried to fake it.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#68

Post by LeoNatan25 »

jtbayly wrote: post #32
wll wrote: post #10

detect.location: https://github.com/KrauseFx/detect.location watch.user: https://github.com/KrauseFx/watch.user

Without clicking, I have no idea what these links are or why you included them in this conversation. Care to elaborate?

Other projects by the same person, demonstrating additional potential security issues.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#69

Post by throwaway613834 »

BCM43 wrote: post #63
throwaway613834 wrote: post #45

> But, but, but, why is the . symbol within the ", is this all fake? Fun fact for those who (like me) didn't know for a long time... technically "gmail.com." is actually the domain name for Gmail. It's called the fully qualified domain name (FQDN), akin to an absolute domain name (as opposed to relative to the current subnet).

Do you have a source for this? I've not heard this before. The Wikipedia article on FQDN doesn't mention ti.

> Do you have a source for this? I've not heard this before. The Wikipedia article on FQDN doesn't mention it.

Actually it's right there in the Wikipedia article [1]...

The DNS root is unnamed, expressed as the empty label terminated by the dot. This is most notable in DNS zone files in which a fully qualified domain name must be specified with a trailing dot. For example, somehost.example.com. explicitly specifies an absolute domain name that ends with the empty top level domain label.

[1] https://en.wikipedia.org/wiki/Fully_qualified_domain_name#Sy...

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#70

Post by jsjohnst »

EGreg wrote: post #23
vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

I wrote this email to sjobs@apple.com back in 2011. Never heard back :-/ Dear Steve, There's one thing that's always bothered me about MacOS security. When a MacOS dialog pops up (e.g. to ask you for your password), there'sno way to tell for sure that it's MacOS that owns the dialog. A similar problem exists on the iPhone when I am asked for my iTunes password. I wanted to write and suggest an easy fix, that would ma…

Man I wish this had been seen and acted on! Would be an excellent feature (and one I’ve thought of myself before).
Post reply on HN