Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS Privacy: Easily get a user's Apple ID password, just by asking

krausefx.com

Post reply on HN
Print view View original

211–220 of 326 posts

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#211

Post by recursive »

Gaelan wrote: post #190
vbezhenar wrote: post #11

Earlier quoted context omitted.

There are many solutions. First is requiring un-catchable keyboard shortcut to enter the password. Something like "ctrl-alt-delete" for Windows (I'm not sure if it's un-catchable, but you got an idea) or even better some unused key like pause/break. User will be trained to press this shortcut and app can't replicate it, so user won't be tricked. Second is using fingerprint. iOS should just use fingerprint always inst…

Is there any reason you can’t watch for control-alt and assume that delete will be pressed soon and react to that?

You could, but then when the delete actually gets pressed, you'll get pre-empted by the real thing.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#212

Post by tolmasky »

When the iPhone X notch was first announced I thought it would be a fantastic security UI opportunity: What if the top of the screen was only writable by the system? It would normally be black or show the time, but whenever there is a password dialog, it turns green with a security lock. This is something I've wanted on all computers for a while: fundamentally, any computer where you can get access to the whole screen's buffer means you can fake a logged out screen asking you to log in, or any other number of phishing attacks. The only way to prevent this is to have a separate secure screen buffer for a special part of the screen that the user can use to visually verify the security of an operation. The notch provided an awesome opportunity for the because: 1) it was NEW screen real estate, it wouldn't feel like you were acquiescing existing screen space for this security need and 2) it looks absolutely horrible when integrated into apps anyways, so why not use it minimally for good reason instead?

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#213

Post by bighi »

zimpenfish wrote: post #104
mikestew wrote: post #96

Earlier quoted context omitted.

If someone finds my phone, it'll be locked and they won't be able to install anything “Does your phone have a calculator? Mine’s in my bag and I need to add these values real quick.”

"Then get yours out, you ain't touching my phone."

Easy to say when defending your point on Hacker News. We're already talking about security, and about someone with malicious intent having access to your phone. In the context of this conversation, you're already in simulated high security mental mode.

It's completely different when you're relaxed (maybe having some fun), and the person asking for your phone is someone you know.

In a relaxed social environment, you will probably not be that rude to someone you know.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#214

Post by KekDemaga »

BCM43 wrote: post #63
throwaway613834 wrote: post #45

> But, but, but, why is the . symbol within the ", is this all fake? Fun fact for those who (like me) didn't know for a long time... technically "gmail.com." is actually the domain name for Gmail. It's called the fully qualified domain name (FQDN), akin to an absolute domain name (as opposed to relative to the current subnet).

Do you have a source for this? I've not heard this before. The Wikipedia article on FQDN doesn't mention ti.

I learned this while configuring Bind9 for the first time: https://wiki.debian.org/Bind9#A.2Fetc.2Fresolv.conf_File

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#215

Post by have_faith »

raldi wrote: post #162
have_faith wrote: post #66

Isn't this one of the oldest tricks in the book? the following story is completely made up... When I was in college me and a friend re-made the win2000 login sequence in visual basic to play pranks on people. After typing username and password it pretended to load and then just quit itself so the desktop would show so it looked like everything was fine. We'd then go in and do the classic "take a screenshot of your de…

If you had enough access to run your Visual Basic program, didn't you already have enough access to change the wallpaper and hide the icons even without the victim's password?

We logged into the machine, ran the app, leave the computer, person A would go up and "log in", except everything wouldn't be right as it's not their account, so they just logged out and back in for real. All of the details were saved on the schools networks drive for later shenanigans like the wallpaper stuff. It was very basic.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#216

Post by TylerE »

seiferteric wrote: post #197
vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

Ya there are some solutions, like you can prefix a '\' before a command to make sure you are running the real command and not a alias, so in your example running: \sudo would defeat your attack. But few are in the practice of doing that.

Would it?

If the attacker was able to backdoor the system, isn't also possible they could install a modified shell that no-ops \?

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#217

Post by zbentley »

jclardy wrote: post #115
vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

It is crazy to me that this is an issue on iOS or Android, there is so much they can do to actually make it secure. For one, on iOS, just "fading out" the app view over the users homescreen wallpaper. There is no way an app can do this, and it is a simple visual indication that the request is coming from the OS. Problem solved. Also something I don't understand - the OS knows where the request is coming from, yet the…

> "fading out" the app view over the users homescreen wallpaper

This is done sometimes, but has only limited success. Most users will click the "your computer is infected, click here to upgrade!" fake windows presented by webpage JS on a PC. You really think an app-fade effect will help enough to make a difference? It would help a bit, but not much.

> they don't show an app icon in that view? Why not?

Because then malicious/spammy applications would present fake alerts, which were non-badged normal popups, and add false badges. I guess you could badge everything, and push the problem onto apps whose icons look similar enough to other apps when shrunk down to whatever size your badge is. Either way, it still ends up in the same boat: probably a little bit helpful, but not much.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#218

Post by gruez »

jaclaz wrote: post #94
vbezhenar wrote: post #11

Earlier quoted context omitted.

There are many solutions. First is requiring un-catchable keyboard shortcut to enter the password. Something like "ctrl-alt-delete" for Windows (I'm not sure if it's un-catchable, but you got an idea) or even better some unused key like pause/break. User will be trained to press this shortcut and app can't replicate it, so user won't be tricked. Second is using fingerprint. iOS should just use fingerprint always inst…

>Something like "ctrl-alt-delete" for Windows (I'm not sure if it's un-catchable, but you got an idea) or even better some unused key like pause/break. I think that even that is catchable (if needed), at least on old Windows XP Embedded, if you used minlogon (which happened very often) you lost ctrl+alt+del access to Task Manager, but there was a third-party service to restore the "hook": http://www.mp3car.com/forum/…

but does it suppress the real thing? otherwise the user is going to see the (real) windows security dialog, followed by your fake one after they exited the real one.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#219

Post by zoul »

tolmasky wrote: post #212

When the iPhone X notch was first announced I thought it would be a fantastic security UI opportunity: What if the top of the screen was only writable by the system? It would normally be black or show the time, but whenever there is a password dialog, it turns green with a security lock. This is something I've wanted on all computers for a while: fundamentally, any computer where you can get access to the whole scree…

Especially when there’s already a UI precedent: the coloured status bar indicating a call, personal hotspot connection, etc. Great idea!

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#220

Post by ryanlol »

jlgaddis wrote: post #149
vbezhenar wrote: post #11

Earlier quoted context omitted.

There are many solutions. First is requiring un-catchable keyboard shortcut to enter the password. Something like "ctrl-alt-delete" for Windows (I'm not sure if it's un-catchable, but you got an idea) or even better some unused key like pause/break. User will be trained to press this shortcut and app can't replicate it, so user won't be tricked. Second is using fingerprint. iOS should just use fingerprint always inst…

> iOS should just use fingerprint always ... Some of us don't want to use TouchID so, no, it shouldn't.

Do you not have fingers? Or is there some other good reason not to use TouchID outside of the lock screen?
Post reply on HN