Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS Privacy: Easily get a user's Apple ID password, just by asking

krausefx.com

Post reply on HN
Print view View original

101–110 of 326 posts

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#101

Post by josefresco »

zippergz wrote: post #44
josefresco wrote: post #36

Earlier quoted context omitted.

I have a joke with my family that I am forced to enter iTunes password on at least one iOS device - daily. We share one iTunes account, and when you enter the password on one device, all the others prompt for a password when unlocked. It's mildly frustrating when you have kids, and multiple iOS devices. The scenario goes like this: One of my kids' Messages app stops working (thanks Apple!). I am forced to turn off/on…

An aside, but wouldn’t you be better off with each person having their own Apple ID and using family sharing to share apps and such?

I'm sure there is a better way, but it would probably require a "weekends worth" of time to convert my entire iOS empire. When we started with Apple, "family sharing" and "ask to buy" wasn't a thing (so I'm not locked into the shared model) but I will definitely check it out - I didn't know I could create an Apple ID for my child AND share apps among all family members.

For those interested: https://support.apple.com/en-us/HT201084

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#102

Post by vortico »

gruez wrote: post #92
vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

>You can do this with the Windows admin password prompt doesn't work when UAC is enabled. Even if you were able to phish the administrator password, trying to login as the administrator using that password (such as by using runas), you'll still end up with a restricted access token. You still need to somehow click "yes" on UAC to get administrative access, which is no small feat because that prompt is on the secure d…

That's interesting. I haven't used Windows since UAC came out. Is a Windows password useless to an application then?

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#103

Post by adamlett »

pilif wrote: post #14

Yes. This is the most horrible UX I have ever seen, especially from a company as security-sensitive as Apple is. In my experience, none of the mitigations given by the article are actually helping in some of the cases: > Hit the home button, and see if the app quits: if the prompt was caused by some in-app purchase related framework having to re-check something, then the app will quit and the prompt will go away. > D…

This is the most horrible UX I have ever seen

You must lead a very sheltered existence then ;-)

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#104

Post by zimpenfish »

mikestew wrote: post #96
mikeash wrote: post #50

Earlier quoted context omitted.

If someone finds my phone, it'll be locked and they won't be able to install anything. If they can unlock the phone then it's already game over for me.

If someone finds my phone, it'll be locked and they won't be able to install anything “Does your phone have a calculator? Mine’s in my bag and I need to add these values real quick.”

"Then get yours out, you ain't touching my phone."

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#105

Post by vortico »

mikestew wrote: post #96
mikeash wrote: post #50

Earlier quoted context omitted.

If someone finds my phone, it'll be locked and they won't be able to install anything. If they can unlock the phone then it's already game over for me.

If someone finds my phone, it'll be locked and they won't be able to install anything “Does your phone have a calculator? Mine’s in my bag and I need to add these values real quick.”

"Yes, but no, use your own."

No one has touched my phone while it was unlocked since middle school.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#106

Post by yodon »

IgorPartola wrote: post #75

I remember seeing a research group that was working on creating an out of band password prompt for desktop computers at NC State. Basically the OS had a syscall to pause everything the kennel included and a separate module would basically dim the screen and show the password prompt over what was currently on the screen. I forget the exact details but it was neat.

Perhaps you're referring to Windows? (I'm not trying to be snarky, a lot of people here genuinely don't use Windows)

System security related prompts have worked essentually as you describe on Windows since 2001.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#107

Post by dx034 »

marindez wrote: post #58
Luc wrote: post #31

Earlier quoted context omitted.

Ok, but that's hardly the point...

I know Apple uses curly quotes for EVERYTHING so that raises an instant alarm in my head.

In that case you're probably more secure than 99% of apple users. I don't think more than 1% of iphone users would've noticed the difference.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#108

Post by dx034 »

hellofunk wrote: post #71

The reactions I have regarding the urgency of this are: 1) Have there in fact been any known phishing attacks in Apple's App Store using this method? 2) Wouldn't Apple's app review usually notice something like this before allowing it into the store?

It wasn't used as a widespread attack but could've been used in the past for targeted attacks.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#109

Post by twobyfour »

mcphage wrote: post #25

Once an OS trains it’s users to enter their password without thinking about it, because of random (seeming) password prompts, they’re already fucked. Apple screwed this up on iOS years ago.

Yup. And if you develop apps and test in-app purchases in their iTunes sandbox, you will get these CONSTANTLY. Like, every time you change what network your device is connected to.
Post reply on HN