121–130 of 326 posts
Earlier quoted context omitted.
If someone finds my phone, it'll be locked and they won't be able to install anything. If they can unlock the phone then it's already game over for me.
If someone finds my phone, it'll be locked and they won't be able to install anything “Does your phone have a calculator? Mine’s in my bag and I need to add these values real quick.”
Earlier quoted context omitted.
I wrote this email to sjobs@apple.com back in 2011. Never heard back :-/ Dear Steve, There's one thing that's always bothered me about MacOS security. When a MacOS dialog pops up (e.g. to ask you for your password), there'sno way to tell for sure that it's MacOS that owns the dialog. A similar problem exists on the iPhone when I am asked for my iTunes password. I wanted to write and suggest an easy fix, that would ma…
Prescient of you! Although I’m skeptical that users will really be alerted by the absence of a thing. The users I work with wouldn’t. But I would prefer it. The inability to use the home button on the dialogues has become second nature to me out of healthy distrust/ paranoia.
Yeah, some people wouldn't, but that isn't a reason to leave it with the terrible implementation they have now. This has annoyed me since forever on iOS.
I believe it is because my email address is a relatively common firstname@gmail.com, and people are trying to recover or guess the password. Perhaps there's some misguided attempt on Apple's side to increase the security if there's lots of failed attempts. I also get constant Facebook recovery attempts (at least they have a "Didn't request this change?" link), mortgage emails, bills, appointments, intra-family email threads, etc. I don't think they're malicious, tons of people are just fundamentally unable to type their email address correctly into a field.
Earlier quoted context omitted.
>You can do this with the Windows admin password prompt doesn't work when UAC is enabled. Even if you were able to phish the administrator password, trying to login as the administrator using that password (such as by using runas), you'll still end up with a restricted access token. You still need to somehow click "yes" on UAC to get administrative access, which is no small feat because that prompt is on the secure d…
> doesn't work when UAC is enabled Which is funny because disabling UAC is one of the first things I (and many many others) have done since Windows 7 to make using Windows a little more tolerable.
Earlier quoted context omitted.
That's slightly different though, in order to do this you need to have shell access on the target's computer. TFA is about displaying a password dialog from an unprivileged app or website. The equivalent scenario with sudo would be to have a website display a mock terminal asking for sudo password, although that would be a lot harder to do inconspicuously because I don't expect terminal windows to pop out of the blue…
> That's slightly different though, in order to do this you need to have shell access on the target's computer. But I suppose any application can write to the current user's .bashrc file right? Then it can also set the alias whenever the user opens a terminal.
Once an OS trains it’s users to enter their password without thinking about it, because of random (seeming) password prompts, they’re already fucked. Apple screwed this up on iOS years ago.
Yup. And if you develop apps and test in-app purchases in their iTunes sandbox, you will get these CONSTANTLY. Like, every time you change what network your device is connected to.
Earlier quoted context omitted.
>You can do this with the Windows admin password prompt doesn't work when UAC is enabled. Even if you were able to phish the administrator password, trying to login as the administrator using that password (such as by using runas), you'll still end up with a restricted access token. You still need to somehow click "yes" on UAC to get administrative access, which is no small feat because that prompt is on the secure d…
That's interesting. I haven't used Windows since UAC came out. Is a Windows password useless to an application then?
Earlier quoted context omitted.
One solution would be for an OS to never have such a popup that requested credentials to be entered right there. Instead, the popup should just say "Visit System Settings to enter your account password to download whatever." This would be similar to measures companies say in emails, "we never ask for your password, always visit our site directly," etc.
What’s annoying about the iTunes login is they expect you to know your password. I use a password manager, I’m not about to memorize my iTunes pass. Naturally those logins windows don’t work with password managers either. Better solution would be not having login windows at all and make it all in the app and do a sort of oauth type flow if the system needs to share it.
Earlier quoted context omitted.
No solution is airtight, but if it makes it better for 10% of users without making it worse for the other 90%, it seems like a good idea.
My guess is that a large % of unsavvy users would put their password in that field, making things much, much worse.
Adding a visual indication of a secure dialog can at least help the power users, while not changing anything for the ones that don't know the difference.
EDIT: Oh sorry, I seen what you are saying now - entering password into the phrase field. Instead, just make it an image that the user selects, or even creates.
On iOS the test of pressing the home button and see if the app goes in background seems a pretty strong one. Perhaps in a future Apple can make you press the home button as part of the verification, so it’s kind of implicit.