Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS Privacy: Easily get a user's Apple ID password, just by asking

krausefx.com

Post reply on HN
Print view View original

191–200 of 326 posts

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#191

Post by scotu »

seanwilson wrote: post #184

I think OAuth and single sign on is great but I always thought OAuth had a similar issue to this. You're on a random website, you click to login via e.g. Google and then enter your Google password into the login dialog that appears. It's asking wayyy too much from regular users to be able to tell if this is safe or not. I'm really surprised there haven't been more phishing attempts where a fake login is shown which s…

I'm almost ok in a web browser, at least there is a reasonable way of being 80% sure it's safe, but the webview version is my pet peeve... not even a power user could be able to tell...

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#192

Post by e12e »

dx034 wrote: post #100
mcphage wrote: post #22

Earlier quoted context omitted.

You need to enter your password when downloading a free app so that if someone finds your phone they can’t install a malicious hacking or key logging app on to your phone. Installing apps is a security risk, not just a financial issue.

If someone has access to my unlocked phone, there are worse things they can do than installing a malicious app. First of all, apps are generally tested before they appear in the store. I don't think attackers would install an app if they can just steal the data directly.

If the data they want is a recording of your next client meeting, installing an app (possibly one that exploits a not-yet well-known bug, say a root exploit that only works from an app) might be one way to do it.

Remember [1]? Imagine an exploit not targeting safari, but somehow vulnerable via an app, a la [2].

[1] https://citizenlab.ca/2016/08/million-dollar-dissident-iphon...

[2] http://iphone.appleinsider.com/articles/16/08/29/apple-brief...

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#193

Post by rebuilder »

Shouldn't this type of password be stored in the devices keychain, which can be unlocked with the device's auth mechanism, and provides authentication services without exposing the itunes password to app developers? That is, authenticate user on device -> verify recipient of auth info -> send auth message.

I must be missing something since no-one seems to be suggesting this.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#194

Post by ianferrel »

zippergz wrote: post #44
josefresco wrote: post #36

Earlier quoted context omitted.

I have a joke with my family that I am forced to enter iTunes password on at least one iOS device - daily. We share one iTunes account, and when you enter the password on one device, all the others prompt for a password when unlocked. It's mildly frustrating when you have kids, and multiple iOS devices. The scenario goes like this: One of my kids' Messages app stops working (thanks Apple!). I am forced to turn off/on…

An aside, but wouldn’t you be better off with each person having their own Apple ID and using family sharing to share apps and such?

I tried family sharing with my wife, and it resulted in her being unable to purchase any apps, even though she was set up as an adult user.

We ended up turning it off because sharing apps wasn't worth the "Hey, can you buy this app for me?" coordination.

And then there was all manner of nonsense after we turned it off, too.

I assume there are other weird bugs in family sharing.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#195

Post by e12e »

UnoriginalGuy wrote: post #43
dx034 wrote: post #13

Earlier quoted context omitted.

A solution is to only ask for the password when absolutely necessary. I still don't understand why I need to enter a password (or use touchID) to download a free app. Shouldn't it be enough to login when I want to buy something for the first time in-app? AFAIK that's how android handles it.

It is free in cost, not in terms of your privacy. For example let's say you handed your phone to your kid, they downloaded a free app, gave that app your entire contact list, and then that app spammed everyone you know? For the sake of example let's call that app LinkedIn.

That, or logged your gps location to a Web service? Maybe along with wlan ssids and Mac addresses?

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#196

Post by seanwilson »

scotu wrote: post #191
seanwilson wrote: post #184

I think OAuth and single sign on is great but I always thought OAuth had a similar issue to this. You're on a random website, you click to login via e.g. Google and then enter your Google password into the login dialog that appears. It's asking wayyy too much from regular users to be able to tell if this is safe or not. I'm really surprised there haven't been more phishing attempts where a fake login is shown which s…

I'm almost ok in a web browser, at least there is a reasonable way of being 80% sure it's safe, but the webview version is my pet peeve... not even a power user could be able to tell...

> I'm almost ok in a web browser, at least there is a reasonable way of being 80% sure it's safe, but the webview version is my pet peeve

I use a password manager on desktop so when it fills in the password for me I'm confident I'm safe. Asking regular users to be sure a real browser pop-up is being shown and the expected domain is shown is asking too much though in my opinion.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#197

Post by seiferteric »

vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

Ya there are some solutions, like you can prefix a '\' before a command to make sure you are running the real command and not a alias, so in your example running:

    \sudo
would defeat your attack. But few are in the practice of doing that.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#198

Post by e12e »

djrogers wrote: post #148
ballenf wrote: post #119

Earlier quoted context omitted.

The single biggest point of confusion for newcomers to iOS in my experience is the dichotomy between the iTunes password and the device pass code and internalizing which is needed when. The iTunes password is needed so rarely these days that most people really struggle to even remember setting it. IMO, the iTunes password should be eliminated entirely. But I have no idea how to handle the activation lock situation if…

> IMO, the iTunes password should be eliminated entirely. Whoa whoa whoa - hold on there. Your ‘iTunes password’ protects purchases in the App Store and iTunes media stores, access to the iCloud website, your iCloud email, iMessages, app data such as notes and contacts, third party app data, and freaking backups of your entire device. What exactly would you suggest Apple do to eliminate that account? You might as wel…

Some of those could be handled by the device password (although apple might have dug themselves a hole with touch I'd there) - the other with an one time password generator whose secret was available to trusted ios devices? For Apple services, that might even be simplified to a callback system; mail app on desktop shows a token "bushy eyebrows", ios auth app display the token "busy eyebrows" and a login/cancel prompt. The actual auth can be done in a challenge - response fashion between the service and the ios device. Another use for the Apple watch...

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#199

Post by mcast »

abalone wrote: post #174

As the author notes, the App Store provides a measure of defense against this. Apps that do this might get away with it at first but will eventually be discovered and banned. Plus 2FA also protects you from this. iOS has easy-to-use 2FA and is on a good trajectory of mainstreaming it and driving adoption. I'm not sure his proposal for defeating 2FA would work: > even with 2FA enabled accounts, what if the app asked y…

I'm not sure how sophisticated the App Store review process is now, but it would be quite easy to grep the codebase for any UIAlertView with the word "password" or "sign in" inside it (unless it did some sort of real-time decrypting of that message).

Regardless, iOS should have a private alert view for inputting sensitive data, similar to the Touch ID prompt. If the prompt is not even relevant to the app container, it should also completely minimize the app view to prevent confusion.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#200

Post by giobox »

smcl wrote: post #2

For a while iOS would just seemingly randomly ask me to enter my icloud password. I’m so used to this that without reading this article I would have literally fall for this every single time.

Me too. For a while it was truly awful on my Mac as well, constantly requiring a login. Signing out from all my devices and logging in again finally put it to bed, but it's seriously concerning when you consider how much sensitive info is carried by iCloud.
Post reply on HN