Earlier quoted context omitted.
Ok, but that's hardly the point...
I know Apple uses curly quotes for EVERYTHING so that raises an instant alarm in my head.
Yup. Everyone who had accidentally edited a JSON file in TextEdit knows this.
iOS Privacy: Easily get a user's Apple ID password, just by asking
251–260 of 326 posts
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#252When the iPhone X notch was first announced I thought it would be a fantastic security UI opportunity: What if the top of the screen was only writable by the system? It would normally be black or show the time, but whenever there is a password dialog, it turns green with a security lock. This is something I've wanted on all computers for a while: fundamentally, any computer where you can get access to the whole scree…
Great idea. Except, I'm not sure if the average user would benefit from this. Would they be aware of this feature?
(Of course, no question that for us hackers this would be a very useful improvement!)
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#253Earlier quoted context omitted.
I really like the solution that includes the iOS background — the os password dialogues should adopt this approach immediately. Zoom out to a view that includes springboard and your background image, and maybe include a preview of the app in a little window that the user can tap to return to the app rather than a non-contextual “cancel” button if the password prompt is related to the app context for some reason.
I've seen this at banks that do something similar (and it's probably for this reason). They include a user-selected picture at logon, so if you see the wrong picture, you know that their logon page is being spoofed. I have no idea of the feasibility of locking down some piece of user data such that the OS can display it for privileged access, but random apps cannot, but this seems like a reasonable solution. Include…
Those pictures can easily be proxies by a spoofer, so I don't see the point of them.
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#254Earlier quoted context omitted.
This already exists on Windows (via require Ctrl-Alt-Del) and to a lesser degree on Android (by always being able to show the action bar in fullscreen).
Not really. From the GP > This is something I've wanted on all computers for a while: fundamentally, any computer where you can get access to the whole screen's buffer means you can fake a logged out screen asking you to log in, or any other number of phishing attacks. In Windows, I can render the whole screen, so I can put up a fake login dialog. To some extent, Windows users are used to requiring a ctrl-alt-delete…
No, he's correct.
Ctrl-Alt-Delete on windows is a privileged hotkey that goes directly to the kernel. A phishing program can't intercept it once it has been pressed. If you know that Ctrl-Alt-Delete has been pressed, you are already privileged as the kernel and would be able to compromise a hypothetical protected screen buffer anyways.
https://i.imgur.com/BE0xN3i.png
The Windows login screen here doesn't allow you to type in the password until you press the magical keys that only the kernel can access. This significantly increases security, since any phishing program that puts up a fake static image doesn't know when to present the login dialog.
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#255Earlier quoted context omitted.
One solution that seems obvious to me is - the OS itself can detect fake popups such as this. It can even be a fast neural net that checks the screen, say, once a second.
A neural net for what could be a simple string comparison?
A string comparison would not catch my next attack, a bitmap-based imitation.
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#256Earlier quoted context omitted.
You could, but then when the delete actually gets pressed, you'll get pre-empted by the real thing.
Back on XP I recall C-A-D not showing the task manager on malware-infested machines. Not sure if that's changed since then (is the full-screen c-a-d in 7/8/10 related)?
This only works when malware already has root privileges.
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#257Earlier quoted context omitted.
The single biggest point of confusion for newcomers to iOS in my experience is the dichotomy between the iTunes password and the device pass code and internalizing which is needed when. The iTunes password is needed so rarely these days that most people really struggle to even remember setting it. IMO, the iTunes password should be eliminated entirely. But I have no idea how to handle the activation lock situation if…
> IMO, the iTunes password should be eliminated entirely. Whoa whoa whoa - hold on there. Your ‘iTunes password’ protects purchases in the App Store and iTunes media stores, access to the iCloud website, your iCloud email, iMessages, app data such as notes and contacts, third party app data, and freaking backups of your entire device. What exactly would you suggest Apple do to eliminate that account? You might as wel…
Should just be handled by icloud instead of iTunes, even though these days it's the same thing
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#258Earlier quoted context omitted.
What’s annoying about the iTunes login is they expect you to know your password. I use a password manager, I’m not about to memorize my iTunes pass. Naturally those logins windows don’t work with password managers either. Better solution would be not having login windows at all and make it all in the app and do a sort of oauth type flow if the system needs to share it.
Lots of tools and apps require knowing passwords; my password manager just lets me press "Copy" when I open it to a particular login, and then I paste it into the iTunes prompt or elsewhere. A little extra hassle but I don't need to remember the password.
Thats what I do, but when you have a modal window like the one in the article, you cant get back to it if you hit cancel to open your password manager. I guess you could copy your password and hope it pops back up...
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#259Earlier quoted context omitted.
It is crazy to me that this is an issue on iOS or Android, there is so much they can do to actually make it secure. For one, on iOS, just "fading out" the app view over the users homescreen wallpaper. There is no way an app can do this, and it is a simple visual indication that the request is coming from the OS. Problem solved. Also something I don't understand - the OS knows where the request is coming from, yet the…
> "fading out" the app view over the users homescreen wallpaper This is done sometimes, but has only limited success. Most users will click the "your computer is infected, click here to upgrade!" fake windows presented by webpage JS on a PC. You really think an app-fade effect will help enough to make a difference? It would help a bit, but not much. > they don't show an app icon in that view? Why not? Because then ma…
I'm specifically referring to iOS with the window fade. Of course the issue with it is that the user would have to notice the lack-of the effect on the fake popups (or apps trying to fake the users app icons/wallpaper)
My point is that literally anything would be better than a generic UIAlertController with a password field that exists today, I can fake one in literally ten seconds and have it be remotely triggered by a key on a server to pass through app review. Anything added would enhance security for users.
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#260Not sure how feasible this is, but the OS could detect when you've typed your password into a non-system prompt and present a warning or block of some sort.