When the iPhone X notch was first announced I thought it would be a fantastic security UI opportunity: What if the top of the screen was only writable by the system? It would normally be black or show the time, but whenever there is a password dialog, it turns green with a security lock. This is something I've wanted on all computers for a while: fundamentally, any computer where you can get access to the whole scree…
Fantastic idea, upvote for visibility. Reminds me of the old ctrl+alt+delete but much more friendly for the user.
When the iPhone X notch was first announced I thought it would be a fantastic security UI opportunity: What if the top of the screen was only writable by the system? It would normally be black or show the time, but whenever there is a password dialog, it turns green with a security lock. This is something I've wanted on all computers for a while: fundamentally, any computer where you can get access to the whole scree…
This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…
There are many solutions. First is requiring un-catchable keyboard shortcut to enter the password. Something like "ctrl-alt-delete" for Windows (I'm not sure if it's un-catchable, but you got an idea) or even better some unused key like pause/break. User will be trained to press this shortcut and app can't replicate it, so user won't be tricked. Second is using fingerprint. iOS should just use fingerprint always inst…
This was actually the idea behind using ctrl+alt+del for login. Originally MS wanted a dedicated key for this, but IBM declined (or so the story goes), so they settled for ctrl+alt+del instead.
When the iPhone X notch was first announced I thought it would be a fantastic security UI opportunity: What if the top of the screen was only writable by the system? It would normally be black or show the time, but whenever there is a password dialog, it turns green with a security lock. This is something I've wanted on all computers for a while: fundamentally, any computer where you can get access to the whole scree…
Ditto for the touch bar on Macbooks (although that doesn't fix the issues for OS X in general).
An aside, but wouldn’t you be better off with each person having their own Apple ID and using family sharing to share apps and such?
I tried family sharing with my wife, and it resulted in her being unable to purchase any apps, even though she was set up as an adult user. We ended up turning it off because sharing apps wasn't worth the "Hey, can you buy this app for me?" coordination. And then there was all manner of nonsense after we turned it off, too. I assume there are other weird bugs in family sharing.
Aaaand this is why I probably won't try it. I'll deal with being the only one who "knows the iTunes password".
> But, but, but, why is the . symbol within the ", is this all fake? Fun fact for those who (like me) didn't know for a long time... technically "gmail.com." is actually the domain name for Gmail. It's called the fully qualified domain name (FQDN), akin to an absolute domain name (as opposed to relative to the current subnet).
But this is more related to the American English style of placing punctiation inside the quotes, isn't it? [1]
As a German (we don't do this), I also didn't like that when I saw it the first time.
> 1) Have there in fact been any known phishing attacks in Apple's App Store using this method? no attacks are known. But that doesn't mean a thing. It's very easy to do this, so you'd have to assume that it is being done. > 2) Wouldn't Apple's app review usually notice something like this before allowing it into the store? no. As the article says, this kind of functionality is incredibly easy to hide.
Re: 2) What does Apple review when approving apps?
They can do review-time checks of system calls that show the popup. Look for keywords in the dialog ("password", "account", "ID" etc). At runtime, check if a password entered in a dialog matches the user's Apple account password. Suspend or remove suspicious apps from the Appstore and advise the affected users.
The real problem is that apps can get data off your device too easily. An app that phishes your password isn't actually dangerous until it uploads it to a server somewhere.
Apple should provide an API that limits an app's internet access in severe ways, preventing encryption, large uploads, etc. Unrestricted internet access should be a permission that few apps are granted.
Apps would still find clever ways to exfiltrate data but that itself would be something you could look for. Today, any app that has access to your data can upload it to anywhere without suspicion.
For a while iOS would just seemingly randomly ask me to enter my icloud password. I’m so used to this that without reading this article I would have literally fall for this every single time.
I have a joke with my family that I am forced to enter iTunes password on at least one iOS device - daily. We share one iTunes account, and when you enter the password on one device, all the others prompt for a password when unlocked. It's mildly frustrating when you have kids, and multiple iOS devices. The scenario goes like this: One of my kids' Messages app stops working (thanks Apple!). I am forced to turn off/on…
The Apple's way of implementing authentication into the various services caused me a lot of frustration. All this constant password reassurances combined with the necessity of complex passwords that is difficult to type in on an iOS device and the previously very persistent enforcement of constant user agreement updates made me use the least possible services.
It was far from a pleasant user experience.
I might have missed several things, interestingly looking non-essential programs or cool iCloud features that I gave up to avoid these annoyances, but that is it now. I will never know.
It is still enough to 'click' those remaining stupid messages away that block you from using the device, like click away warning about the accuracy of local positioning when I want to make a photo on a situation that goes away in 3 seconds (so eventually no point of warning me about metadata of a photo not happening), it is absolutely wrong obstructing the user more, repeatedly, in using its device.
I guess I accepted not to use the iPhone that much as its potentials would allow. I don't trust it (firstly just about its usability, now about its security as well).