Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS Privacy: Easily get a user's Apple ID password, just by asking

krausefx.com

Post reply on HN
Print view View original

171–180 of 326 posts

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#171

Post by j45 »

vbezhenar wrote: post #11
vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

There are many solutions. First is requiring un-catchable keyboard shortcut to enter the password. Something like "ctrl-alt-delete" for Windows (I'm not sure if it's un-catchable, but you got an idea) or even better some unused key like pause/break. User will be trained to press this shortcut and app can't replicate it, so user won't be tricked. Second is using fingerprint. iOS should just use fingerprint always inst…

Biometrics (fingerprint, face id, etc) are a poor use for authentication (password) because they can be copied and compromised.

Biometrics have value for identity verification (username) when used in conjunction with a password

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#173

Post by hyperpape »

jlgaddis wrote: post #149
vbezhenar wrote: post #11

Earlier quoted context omitted.

There are many solutions. First is requiring un-catchable keyboard shortcut to enter the password. Something like "ctrl-alt-delete" for Windows (I'm not sure if it's un-catchable, but you got an idea) or even better some unused key like pause/break. User will be trained to press this shortcut and app can't replicate it, so user won't be tricked. Second is using fingerprint. iOS should just use fingerprint always inst…

> iOS should just use fingerprint always ... Some of us don't want to use TouchID so, no, it shouldn't.

True, but the parent can just modify that to say "use touchID for users who have it enabled".

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#174

Post by abalone »

As the author notes, the App Store provides a measure of defense against this. Apps that do this might get away with it at first but will eventually be discovered and banned.

Plus 2FA also protects you from this. iOS has easy-to-use 2FA and is on a good trajectory of mainstreaming it and driving adoption. I'm not sure his proposal for defeating 2FA would work:

> even with 2FA enabled accounts, what if the app asked you for your 2 step code? Most users would gladly request a 2FA-token and ask for it, and directly pipe it over to a remote server.

I wouldn't give this much credence without a proof of concept. iOS throws up a dialog when there's a pending 2FA request which consumes the code or cancels the request, so that would prevent the app UI from intercepting it.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#176

Post by ksk »

vortico wrote: post #102
gruez wrote: post #92

Earlier quoted context omitted.

>You can do this with the Windows admin password prompt doesn't work when UAC is enabled. Even if you were able to phish the administrator password, trying to login as the administrator using that password (such as by using runas), you'll still end up with a restricted access token. You still need to somehow click "yes" on UAC to get administrative access, which is no small feat because that prompt is on the secure d…

That's interesting. I haven't used Windows since UAC came out. Is a Windows password useless to an application then?

UAC came out over 10 years ago! In any case, NT is structured quite differently than the typical UNIX variants. When you log in, NT creates two access tokens for you. One with all your privileges, and one with admin rights masked out. When a process is launched it uses the non-admin one by default, even if you are the admin user.

When a thread requires admin privileges, NT will first check if your unmasked token already has those rights, in which case, it will prompt you (UAC) for permission to use the token. This is unlike traditional UNIX where the 'effective user' changes to root on a global level, not just per-thread. So you get 10 minutes (or w/e) as root to do your thing.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#178

Post by breatheoften »

vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

I really like the solution that includes the iOS background — the os password dialogues should adopt this approach immediately. Zoom out to a view that includes springboard and your background image, and maybe include a preview of the app in a little window that the user can tap to return to the app rather than a non-contextual “cancel” button if the password prompt is related to the app context for some reason.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#179

Post by perlgeek »

iamben wrote: post #28

Why not ask users to set a unique phrase to identify themselves when you set up the OS? If this phrase isn't in the box that asks for a master password, you know it's phishing. Hell, just put that IN the copy on the master password box. "If the words below do not match your unique phrase, do not enter your password." If I see "Green eggs and ham", I know it's safe to put in my password.

Yahoo used that, except with an image, not a phrase. And then one day yahoo.com didn't show that image anymore.

What do I do then, as a user?

At this time, I didn't care much about my yahoo account, so I simply didn't log in anymore; but in general, this solution leaves the user alone. You need to give them a potential remedy when that happens.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#180

Post by hyperpape »

ballenf wrote: post #119
dawnerd wrote: post #91

Earlier quoted context omitted.

What’s annoying about the iTunes login is they expect you to know your password. I use a password manager, I’m not about to memorize my iTunes pass. Naturally those logins windows don’t work with password managers either. Better solution would be not having login windows at all and make it all in the app and do a sort of oauth type flow if the system needs to share it.

The single biggest point of confusion for newcomers to iOS in my experience is the dichotomy between the iTunes password and the device pass code and internalizing which is needed when. The iTunes password is needed so rarely these days that most people really struggle to even remember setting it. IMO, the iTunes password should be eliminated entirely. But I have no idea how to handle the activation lock situation if…

People with kids need two levels of access.
Post reply on HN