Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS Privacy: Easily get a user's Apple ID password, just by asking

krausefx.com

Post reply on HN
Print view View original

271–280 of 326 posts

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#271

Post by acomjean »

dboreham wrote: post #152
acomjean wrote: post #53

Earlier quoted context omitted.

>The login prompt could easily be spoofed by a user-mode program. On the VT100 terminals in the computer lab in college (back in the early 90s) someone was doing this. A shell script to harness logins, print it was unsuccessful and log out. . There was a key at the top of the vt-100 keyboard that would reset it. The "key" part was often pried off (accidental pressing was bad), but you could still press the nub left b…

In my misspent youth I wrote a login trojan for VAX/VMS. It circumvented the "break" key trick that you are alluding to above. I had to drop down to Bliss-32 and use the $QIO syscall but it can be done. Once I had captured the sysadmin password and logged in once to prove my achievement I never ran it again. Learned many interesting things though. My task was made easier because DEC published the source code for the…

> DEC published the source code for the OS, albeit as Microfiche.

Wait.... What?

Nice job decoding that.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#272

Post by eric_h »

ProfessorLayton wrote: post #240
tolmasky wrote: post #212

When the iPhone X notch was first announced I thought it would be a fantastic security UI opportunity: What if the top of the screen was only writable by the system? It would normally be black or show the time, but whenever there is a password dialog, it turns green with a security lock. This is something I've wanted on all computers for a while: fundamentally, any computer where you can get access to the whole scree…

This would also make sense on the MBP's touchbar

Yes indeed. I'm always a little anxious when an installer (or something) prompts me for an administrator password, and some secure channel indicating that it's really the OS that's asking for it would help to assuage my fears.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#273

Post by PascLeRasc »

bighi wrote: post #213
zimpenfish wrote: post #104

Earlier quoted context omitted.

"Then get yours out, you ain't touching my phone."

Easy to say when defending your point on Hacker News. We're already talking about security, and about someone with malicious intent having access to your phone. In the context of this conversation, you're already in simulated high security mental mode. It's completely different when you're relaxed (maybe having some fun), and the person asking for your phone is someone you know. In a relaxed social environment, you w…

I think the person you're responding to isn't familiar with relaxed social environments. Seriously, it's so hard to find empathy in security research.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#274

Post by kccqzy »

beepzop wrote: post #260

Not sure how feasible this is, but the OS could detect when you've typed your password into a non-system prompt and present a warning or block of some sort.

That would be such an inconvenience to the people who re-use their passwords!

/s

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#275

Post by eric_h »

dawnerd wrote: post #91
hellofunk wrote: post #16

Earlier quoted context omitted.

One solution would be for an OS to never have such a popup that requested credentials to be entered right there. Instead, the popup should just say "Visit System Settings to enter your account password to download whatever." This would be similar to measures companies say in emails, "we never ask for your password, always visit our site directly," etc.

What’s annoying about the iTunes login is they expect you to know your password. I use a password manager, I’m not about to memorize my iTunes pass. Naturally those logins windows don’t work with password managers either. Better solution would be not having login windows at all and make it all in the app and do a sort of oauth type flow if the system needs to share it.

My personal password strategy requires that I do, in fact, have to recall from memory a small number of secure passwords (device access passwords, ssh key passwords, password manager password and one web service password (iCloud)).

My memorized password count is less than 10 and they're all long and secure (and completely different from one another). It's unfortunate that iCloud is on that list, but it's the only one that shouldn't really belong there, so I'm okay with it.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#276

Post by magoon »

hintss wrote: post #223
vbezhenar wrote: post #11

Earlier quoted context omitted.

There are many solutions. First is requiring un-catchable keyboard shortcut to enter the password. Something like "ctrl-alt-delete" for Windows (I'm not sure if it's un-catchable, but you got an idea) or even better some unused key like pause/break. User will be trained to press this shortcut and app can't replicate it, so user won't be tricked. Second is using fingerprint. iOS should just use fingerprint always inst…

This was actually the idea behind using ctrl+alt+del for login. Originally MS wanted a dedicated key for this, but IBM declined (or so the story goes), so they settled for ctrl+alt+del instead.

I think this is a misunderstanding. Microsoft didn’t ask IBM something for logging users in in the DOS days. They wanted a way to reset via the keyboard. IBM provided that with Crtl-Alt-Del.

Windows didn’t use this for anything until NT in the early 90s, and it was their choice to do so. Nothing to do with IBM.

When people ask Gates about Ctrl-Alt-Del they’re obviously asking about why it was chosen for a login sequence, but I believe Gates conveniently answers a different question to make it seem like IBM had something to do with that choice.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#277

Post by kibwen »

krallja wrote: post #253
Splines wrote: post #209

Earlier quoted context omitted.

I've seen this at banks that do something similar (and it's probably for this reason). They include a user-selected picture at logon, so if you see the wrong picture, you know that their logon page is being spoofed. I have no idea of the feasibility of locking down some piece of user data such that the OS can display it for privileged access, but random apps cannot, but this seems like a reasonable solution. Include…

Those pictures can easily be proxies by a spoofer, so I don't see the point of them.

Those pictures are indeed useless when used by banks, since they do nothing against MITM. But for the attack described in the OP they would actually be a reasonable defense, since this sort of indiscriminate low-privilege phishing can't intercept requests between the user and the system in order to determine the secret image.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#278

Post by dpkonofa »

mcphage wrote: post #25

Once an OS trains it’s users to enter their password without thinking about it, because of random (seeming) password prompts, they’re already fucked. Apple screwed this up on iOS years ago.

In fairness, this isn't unique to Apple devices. Most people I know turn off Windows UAC controls for exactly this reason. I'm sure the same is true of Android or any other devices too.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#279

Post by colemickens »

soared wrote: post #205
seanwilson wrote: post #184

I think OAuth and single sign on is great but I always thought OAuth had a similar issue to this. You're on a random website, you click to login via e.g. Google and then enter your Google password into the login dialog that appears. It's asking wayyy too much from regular users to be able to tell if this is safe or not. I'm really surprised there haven't been more phishing attempts where a fake login is shown which s…

One of those recent widespread google docs attack used this strategy to get into lots of business g accounts. https://news.ycombinator.com/item?id=14205432

That's rather specifically not the same attack.

One uses the normal OAuth flow and mis-represents a valid application identity in order to get the user to grant permissions normally. The other flow, that the grandparent refers to, redirects users to a phishing domain and steals credentials.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#280

Post by blahshaw »

mikestew wrote: post #96
mikeash wrote: post #50

Earlier quoted context omitted.

If someone finds my phone, it'll be locked and they won't be able to install anything. If they can unlock the phone then it's already game over for me.

If someone finds my phone, it'll be locked and they won't be able to install anything “Does your phone have a calculator? Mine’s in my bag and I need to add these values real quick.”

You could use Guided Access to allow them to use the calculator without leaving the app.
Post reply on HN