Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS Privacy: Easily get a user's Apple ID password, just by asking

krausefx.com

Post reply on HN
Print view View original

91–100 of 326 posts

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#91

Post by dawnerd »

hellofunk wrote: post #16
vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

One solution would be for an OS to never have such a popup that requested credentials to be entered right there. Instead, the popup should just say "Visit System Settings to enter your account password to download whatever." This would be similar to measures companies say in emails, "we never ask for your password, always visit our site directly," etc.

What’s annoying about the iTunes login is they expect you to know your password. I use a password manager, I’m not about to memorize my iTunes pass. Naturally those logins windows don’t work with password managers either.

Better solution would be not having login windows at all and make it all in the app and do a sort of oauth type flow if the system needs to share it.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#92

Post by gruez »

vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

>You can do this with the Windows admin password prompt

doesn't work when UAC is enabled. Even if you were able to phish the administrator password, trying to login as the administrator using that password (such as by using runas), you'll still end up with a restricted access token. You still need to somehow click "yes" on UAC to get administrative access, which is no small feat because that prompt is on the secure desktop.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#93

Post by ballenf »

zippergz wrote: post #44
josefresco wrote: post #36

Earlier quoted context omitted.

I have a joke with my family that I am forced to enter iTunes password on at least one iOS device - daily. We share one iTunes account, and when you enter the password on one device, all the others prompt for a password when unlocked. It's mildly frustrating when you have kids, and multiple iOS devices. The scenario goes like this: One of my kids' Messages app stops working (thanks Apple!). I am forced to turn off/on…

An aside, but wouldn’t you be better off with each person having their own Apple ID and using family sharing to share apps and such?

There's one annoying omission from family sharing: no IAP are included. And almost every kids game has one. Not talking freemium but just ones with one free level that gets kids hooked.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#94

Post by jaclaz »

vbezhenar wrote: post #11
vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

There are many solutions. First is requiring un-catchable keyboard shortcut to enter the password. Something like "ctrl-alt-delete" for Windows (I'm not sure if it's un-catchable, but you got an idea) or even better some unused key like pause/break. User will be trained to press this shortcut and app can't replicate it, so user won't be tricked. Second is using fingerprint. iOS should just use fingerprint always inst…

>Something like "ctrl-alt-delete" for Windows (I'm not sure if it's un-catchable, but you got an idea) or even better some unused key like pause/break.

I think that even that is catchable (if needed), at least on old Windows XP Embedded, if you used minlogon (which happened very often) you lost ctrl+alt+del access to Task Manager, but there was a third-party service to restore the "hook":

http://www.mp3car.com/forum/mp3car-technical-software/softwa...

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#95

Post by kminehart »

gruez wrote: post #92
vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

>You can do this with the Windows admin password prompt doesn't work when UAC is enabled. Even if you were able to phish the administrator password, trying to login as the administrator using that password (such as by using runas), you'll still end up with a restricted access token. You still need to somehow click "yes" on UAC to get administrative access, which is no small feat because that prompt is on the secure d…

> doesn't work when UAC is enabled

Which is funny because disabling UAC is one of the first things I (and many many others) have done since Windows 7 to make using Windows a little more tolerable.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#96

Post by mikestew »

mikeash wrote: post #50
mcphage wrote: post #22

Earlier quoted context omitted.

You need to enter your password when downloading a free app so that if someone finds your phone they can’t install a malicious hacking or key logging app on to your phone. Installing apps is a security risk, not just a financial issue.

If someone finds my phone, it'll be locked and they won't be able to install anything. If they can unlock the phone then it's already game over for me.

If someone finds my phone, it'll be locked and they won't be able to install anything

“Does your phone have a calculator? Mine’s in my bag and I need to add these values real quick.”

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#97

Post by golergka »

vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

> A perfect solution on iOS is to "minimize" the application so that the home screen is shown and then show the password prompt. The user would immediately recognize the wallpaper and icons to be theirs, which are two pieces of information unavailable to the application. However, the application could still fool the user by displaying the box over the application anyway.

Isn't it exactly what happens on windows anyway?

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#98

Post by vortico »

amelius wrote: post #72
simias wrote: post #40

Earlier quoted context omitted.

That's slightly different though, in order to do this you need to have shell access on the target's computer. TFA is about displaying a password dialog from an unprivileged app or website. The equivalent scenario with sudo would be to have a website display a mock terminal asking for sudo password, although that would be a lot harder to do inconspicuously because I don't expect terminal windows to pop out of the blue…

> That's slightly different though, in order to do this you need to have shell access on the target's computer. But I suppose any application can write to the current user's .bashrc file right? Then it can also set the alias whenever the user opens a terminal.

That's what shell access means. Running a program = access to system() and thus shell access.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#99

Post by yellow_postit »

adamlett wrote: post #73
ascagnel_ wrote: post #51

Earlier quoted context omitted.

Not entirely -- keyboard apps can intercept keystrokes and send them to a remote server.

As far as I can remember, 3rd party keyboards are not allowed for password prompts.

Only when those fields are appropriately annotated, which anecdotally I've run into plenty that are not tagged correctly.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#100

Post by dx034 »

mcphage wrote: post #22
dx034 wrote: post #13

Earlier quoted context omitted.

A solution is to only ask for the password when absolutely necessary. I still don't understand why I need to enter a password (or use touchID) to download a free app. Shouldn't it be enough to login when I want to buy something for the first time in-app? AFAIK that's how android handles it.

You need to enter your password when downloading a free app so that if someone finds your phone they can’t install a malicious hacking or key logging app on to your phone. Installing apps is a security risk, not just a financial issue.

If someone has access to my unlocked phone, there are worse things they can do than installing a malicious app. First of all, apps are generally tested before they appear in the store. I don't think attackers would install an app if they can just steal the data directly.
Post reply on HN