Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS Privacy: Easily get a user's Apple ID password, just by asking

krausefx.com

Post reply on HN
Print view View original

181–190 of 326 posts

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#181

Post by ptero »

vbezhenar wrote: post #11
vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

There are many solutions. First is requiring un-catchable keyboard shortcut to enter the password. Something like "ctrl-alt-delete" for Windows (I'm not sure if it's un-catchable, but you got an idea) or even better some unused key like pause/break. User will be trained to press this shortcut and app can't replicate it, so user won't be tricked. Second is using fingerprint. iOS should just use fingerprint always inst…

Fingerprint (and other "bio" features like eye retina) scans come with their own problems.

For example, how do you handle compromise (I suspect fingerprint mills / printers are not ubiquitous just because there is no demand for fake fingerprints; technologically they should be easy to make). Also, do you really want a unique match every time you log in from different devices (e.g., work and home); etc., etc.

Sorry, fingerprint solution may be worse than the disease it is trying to cure.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#182

Post by drampelt »

jedberg wrote: post #111
mikeash wrote: post #50

Earlier quoted context omitted.

If someone finds my phone, it'll be locked and they won't be able to install anything. If they can unlock the phone then it's already game over for me.

You’re using the phone and set it down, it hasn’t auto locked yet. They have your lock screen password but not your iTunes password. You thought they were a friend and let them borrow your unlocked phone. Even for a security conscience person there are plenty of situations where someone could get your unlocked phone. And most people aren’t security conscience. It’s to protect them, not you.

I get that prompting for an iCloud password again adds an extra step, but if someone has your unlocked phone they probably have enough (email, SMS, phone) to take over your iCloud account anyway.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#183

Post by pflats »

I think the bigger safety against this isn't that Apple reviews apps, but that submitting an app to the store requires money up front and some way for Apple to identify the person behind the account. It's by no means foolproof, but I imagine it redirects a lot of bad actors to easier attacks.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#184

Post by seanwilson »

I think OAuth and single sign on is great but I always thought OAuth had a similar issue to this. You're on a random website, you click to login via e.g. Google and then enter your Google password into the login dialog that appears. It's asking wayyy too much from regular users to be able to tell if this is safe or not. I'm really surprised there haven't been more phishing attempts where a fake login is shown which saves your password.

It's an even worse issue in e.g. Android apps that use Google or Facebook for logins as you can't tell what domain is serving the login prompt like you can in a desktop browser.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#185

Post by trjordan »

ptero wrote: post #181
vbezhenar wrote: post #11

Earlier quoted context omitted.

There are many solutions. First is requiring un-catchable keyboard shortcut to enter the password. Something like "ctrl-alt-delete" for Windows (I'm not sure if it's un-catchable, but you got an idea) or even better some unused key like pause/break. User will be trained to press this shortcut and app can't replicate it, so user won't be tricked. Second is using fingerprint. iOS should just use fingerprint always inst…

Fingerprint (and other "bio" features like eye retina) scans come with their own problems. For example, how do you handle compromise (I suspect fingerprint mills / printers are not ubiquitous just because there is no demand for fake fingerprints; technologically they should be easy to make). Also, do you really want a unique match every time you log in from different devices (e.g., work and home); etc., etc. Sorry, f…

The point is the OS manages your fingerprint, and even if you have it, you can't easily send a stolen fingerprint to the OS.

If you have access to the hardware, that's a whole different attack vector.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#187

Post by perryprog »

earenndil wrote: post #131
iamben wrote: post #28

Why not ask users to set a unique phrase to identify themselves when you set up the OS? If this phrase isn't in the box that asks for a master password, you know it's phishing. Hell, just put that IN the copy on the master password box. "If the words below do not match your unique phrase, do not enter your password." If I see "Green eggs and ham", I know it's safe to put in my password.

Couldn't an app screenshot the screen after asking you to authenticate, and thus capture the phrase?

AFAIK, it's not possible for a sandboxed app to take a screenshot without user consent.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#188

Post by seanwilson »

zaroth wrote: post #52
UnoriginalGuy wrote: post #49

Earlier quoted context omitted.

TouchID has been removed from the iPhone X.

TouchID is replaced by FaceID which I assume likewise eliminates the vast majority of password prompts?

Doesn't it have a password/pin fallback though?

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#189

Post by asdfaefasdf »

iamben wrote: post #28

Why not ask users to set a unique phrase to identify themselves when you set up the OS? If this phrase isn't in the box that asks for a master password, you know it's phishing. Hell, just put that IN the copy on the master password box. "If the words below do not match your unique phrase, do not enter your password." If I see "Green eggs and ham", I know it's safe to put in my password.

What if my fake popup just doesn't include the warning message. The user just forgets that it's supposed to be there at all.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#190

Post by Gaelan »

vbezhenar wrote: post #11
vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

There are many solutions. First is requiring un-catchable keyboard shortcut to enter the password. Something like "ctrl-alt-delete" for Windows (I'm not sure if it's un-catchable, but you got an idea) or even better some unused key like pause/break. User will be trained to press this shortcut and app can't replicate it, so user won't be tricked. Second is using fingerprint. iOS should just use fingerprint always inst…

Is there any reason you can’t watch for control-alt and assume that delete will be pressed soon and react to that?
Post reply on HN