Easily? First you have to get your malicious app through the review.
iOS Privacy: Easily get a user's Apple ID password, just by asking
141–150 of 326 posts
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#142For a while iOS would just seemingly randomly ask me to enter my icloud password. I’m so used to this that without reading this article I would have literally fall for this every single time.
I've experienced this as well. I seem to be able to just cancel out of it but I'd like to know what's triggering it. It would be nice if the password box had some text to explain the context of the request.
So why does iCloud(?) randomly ask for credentials?
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#143Yes. This is the most horrible UX I have ever seen, especially from a company as security-sensitive as Apple is. In my experience, none of the mitigations given by the article are actually helping in some of the cases: > Hit the home button, and see if the app quits: if the prompt was caused by some in-app purchase related framework having to re-check something, then the app will quit and the prompt will go away. > D…
> his is the most horrible UX I have ever seen
Enjoy your bank logins https://twitter.com/lukew/status/908729507086950400
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#144No, it's usually a Touch ID prompt these days.
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#145> But, I have 2-factor enabled, I'm safe, right?
Apple really pushes you to do this in iCloud. For the better.
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#146Earlier quoted context omitted.
A phishing dialog could fake the drawer. Apps can and do regularly use the full screen which is something web pages don't do and which will require extra user confirmation for precisely this reason. Denying apps full screen access is very detrimental to the overall UX so that's not going to happen. The other solution is to have apple never prompt for that password aside of during the initial setup process after insta…
There are other visual solutions: show the app switcher, or go to the home screen and return when the modal is dismissed. I agree apps can fake some things, but it's not an unsolvable problem.
Show the app switcher is a good idea. It could make sense visually and would have information that the phishing app couldn't get (the surfaces of other apps).
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#147This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…
I think you don't hear about the sudo variant because it's almost never used (though I'll be honest, I never considered impersonating sudo, going to have to add that to my bag of red team tricks). I think impersonating UI's is pretty common though, tons of ads/malware made themselves to look like windows alerts.
There's little reason to actually impersonate sudo, IMO. Just add a malicious PAM module[1] and log the credentials entered for the real sudo (as well as password-based logon, etc.).
[1] e.g. https://github.com/ONsec-Lab/scripts/tree/master/pam_steal
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#148Earlier quoted context omitted.
What’s annoying about the iTunes login is they expect you to know your password. I use a password manager, I’m not about to memorize my iTunes pass. Naturally those logins windows don’t work with password managers either. Better solution would be not having login windows at all and make it all in the app and do a sort of oauth type flow if the system needs to share it.
The single biggest point of confusion for newcomers to iOS in my experience is the dichotomy between the iTunes password and the device pass code and internalizing which is needed when. The iTunes password is needed so rarely these days that most people really struggle to even remember setting it. IMO, the iTunes password should be eliminated entirely. But I have no idea how to handle the activation lock situation if…
> IMO, the iTunes password should be eliminated entirely.
Whoa whoa whoa - hold on there. Your ‘iTunes password’ protects purchases in the App Store and iTunes media stores, access to the iCloud website, your iCloud email, iMessages, app data such as notes and contacts, third party app data, and freaking backups of your entire device.
What exactly would you suggest Apple do to eliminate that account? You might as well say that google should eliminate their gmail passwords, or that Dropbox should eliminate the account password.
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#149This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…
There are many solutions. First is requiring un-catchable keyboard shortcut to enter the password. Something like "ctrl-alt-delete" for Windows (I'm not sure if it's un-catchable, but you got an idea) or even better some unused key like pause/break. User will be trained to press this shortcut and app can't replicate it, so user won't be tricked. Second is using fingerprint. iOS should just use fingerprint always inst…
> iOS should just use fingerprint always ...
Some of us don't want to use TouchID so, no, it shouldn't.
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#150For a while iOS would just seemingly randomly ask me to enter my icloud password. I’m so used to this that without reading this article I would have literally fall for this every single time.
I have a joke with my family that I am forced to enter iTunes password on at least one iOS device - daily. We share one iTunes account, and when you enter the password on one device, all the others prompt for a password when unlocked. It's mildly frustrating when you have kids, and multiple iOS devices. The scenario goes like this: One of my kids' Messages app stops working (thanks Apple!). I am forced to turn off/on…
I’m not sure if something is screwed up with your account or your devices or what, but I do t have that wacky experience amongst all my devices that share an account (~7-8 of them).