Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS Privacy: Easily get a user's Apple ID password, just by asking

krausefx.com

Post reply on HN
Print view View original

111–120 of 326 posts

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#111

Post by jedberg »

mikeash wrote: post #50
mcphage wrote: post #22

Earlier quoted context omitted.

You need to enter your password when downloading a free app so that if someone finds your phone they can’t install a malicious hacking or key logging app on to your phone. Installing apps is a security risk, not just a financial issue.

If someone finds my phone, it'll be locked and they won't be able to install anything. If they can unlock the phone then it's already game over for me.

You’re using the phone and set it down, it hasn’t auto locked yet.

They have your lock screen password but not your iTunes password.

You thought they were a friend and let them borrow your unlocked phone.

Even for a security conscience person there are plenty of situations where someone could get your unlocked phone.

And most people aren’t security conscience. It’s to protect them, not you.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#112

Post by Aaargh20318 »

zaroth wrote: post #52
UnoriginalGuy wrote: post #49

Earlier quoted context omitted.

TouchID has been removed from the iPhone X.

TouchID is replaced by FaceID which I assume likewise eliminates the vast majority of password prompts?

Everything that uses the TouchID API should seamlessly use FaceID instead on the X

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#113

Post by dx034 »

dingo_bat wrote: post #17

Windows has this sorted, albeit in a super annoying manner: UAC https://en.wikipedia.org/wiki/User_Account_Control#/media/Fi...

In my opinion less annoying than the iOS password popup. I think in one OS they appeared very often (Win 7?) but by now I only see them if I want to execute as admin. And I'm glad how they're designed, it's hard to accidentally click on them.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#114

Post by jsjohnst »

Ajedi32 wrote: post #88
jsjohnst wrote: post #83

Apple does have one mitigation I’m surprised not to see listed. The keyboard changes color when it’s a system dialog asking for your password. That’s not something an App can do to my knowledge, but I could be wrong. Any idea why it wasn’t mentioned?

You sure about that? The screenshots in the article don't show the keyboard being a different color with a legitimate pop-up.

On my iPhone it does. It goes from a light grey (normal keyboard) to a dark grey (system password entry keyboard).

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#115

Post by jclardy »

vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

It is crazy to me that this is an issue on iOS or Android, there is so much they can do to actually make it secure.

For one, on iOS, just "fading out" the app view over the users homescreen wallpaper. There is no way an app can do this, and it is a simple visual indication that the request is coming from the OS. Problem solved.

Also something I don't understand - the OS knows where the request is coming from, yet they don't show an app icon in that view? Why not?

This has been a problem for years with such simple solutions, yet nobody has touched it.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#116

Post by amq »

kminehart wrote: post #95
gruez wrote: post #92

Earlier quoted context omitted.

>You can do this with the Windows admin password prompt doesn't work when UAC is enabled. Even if you were able to phish the administrator password, trying to login as the administrator using that password (such as by using runas), you'll still end up with a restricted access token. You still need to somehow click "yes" on UAC to get administrative access, which is no small feat because that prompt is on the secure d…

> doesn't work when UAC is enabled Which is funny because disabling UAC is one of the first things I (and many many others) have done since Windows 7 to make using Windows a little more tolerable.

I could understand disabling UAC on Vista, but I find it perfectly sensible since Win7. Also blame ancient programs which request administrator access without reason.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#117

Post by amq »

olegkikin wrote: post #56
vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

One solution that seems obvious to me is - the OS itself can detect fake popups such as this. It can even be a fast neural net that checks the screen, say, once a second.

A neural net for what could be a simple string comparison?

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#118

Post by thisisdave »

jsjohnst wrote: post #83

Apple does have one mitigation I’m surprised not to see listed. The keyboard changes color when it’s a system dialog asking for your password. That’s not something an App can do to my knowledge, but I could be wrong. Any idea why it wasn’t mentioned?

That's only if you're using a third-party keyboard, I think.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#119

Post by ballenf »

dawnerd wrote: post #91
hellofunk wrote: post #16

Earlier quoted context omitted.

One solution would be for an OS to never have such a popup that requested credentials to be entered right there. Instead, the popup should just say "Visit System Settings to enter your account password to download whatever." This would be similar to measures companies say in emails, "we never ask for your password, always visit our site directly," etc.

What’s annoying about the iTunes login is they expect you to know your password. I use a password manager, I’m not about to memorize my iTunes pass. Naturally those logins windows don’t work with password managers either. Better solution would be not having login windows at all and make it all in the app and do a sort of oauth type flow if the system needs to share it.

The single biggest point of confusion for newcomers to iOS in my experience is the dichotomy between the iTunes password and the device pass code and internalizing which is needed when.

The iTunes password is needed so rarely these days that most people really struggle to even remember setting it.

IMO, the iTunes password should be eliminated entirely. But I have no idea how to handle the activation lock situation if no authenticated device is on hand.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#120

Post by thisisdave »

iamben wrote: post #28

Why not ask users to set a unique phrase to identify themselves when you set up the OS? If this phrase isn't in the box that asks for a master password, you know it's phishing. Hell, just put that IN the copy on the master password box. "If the words below do not match your unique phrase, do not enter your password." If I see "Green eggs and ham", I know it's safe to put in my password.

Even better, add an indicator light to the hardware that shows the OS is asking and not an app (although this suffers from the same problem that users need to notice something is absent).
Post reply on HN